Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The transition from logins to cryptographic passkeys is getting messy

wired.com

Post reply on HN
Print view View original

121–130 of 154 posts

Re: The transition from logins to cryptographic passkeys is getting messy

#121

Post by Ajedi32 »

eep_social wrote: post #115
Ajedi32 wrote: post #102

It seems like most people commenting here don't know what passkeys are. I'm seeing a lot of complaints about things that simply aren't a problem with Passkeys, only with plain WebAuthn. Passkeys are based on WebAuthn, but they are not the same from a user experience perspective. The simplest way to describe Passkeys would be "WebAuthn, but with the keys stored in a password manager instead of being tied to a specific…

> Passkeys on iPhone require that you use iCloud Keychain. If you don’t have iCloud Keychain turned on when you try to save a passkey, you’ll be asked to turn it on. Passkeys also require that two-factor authentication is enabled for your Apple ID. Nope, sorry. Enshittification makes this entire concept, as-presented, a non-starter.

That's how credential management works on iOS. The built-in password manager works the same way. What exactly is your concern?

Re: The transition from logins to cryptographic passkeys is getting messy

#122

Post by eep_social »

Ajedi32 wrote: post #121
eep_social wrote: post #115

Earlier quoted context omitted.

> Passkeys on iPhone require that you use iCloud Keychain. If you don’t have iCloud Keychain turned on when you try to save a passkey, you’ll be asked to turn it on. Passkeys also require that two-factor authentication is enabled for your Apple ID. Nope, sorry. Enshittification makes this entire concept, as-presented, a non-starter.

That's how credential management works on iOS. The built-in password manager works the same way. What exactly is your concern?

Yeah and I don’t use that except where it’s unavoidable (wifi passwords) because apple cannot be trusted any more than any other public company.

Re: The transition from logins to cryptographic passkeys is getting messy

#123

Post by donmcronald »

jeroenhd wrote: post #33
_448 wrote: post #29

Oh, what could go wrong! Why is there no discussion on users losing their private keys? Ask all those cryptocurrency users who lost their private keys. Now don't tell that there are crypto wallets/vaults that manage private keys; there are many ways key can be lost even when using wallets/vaults. We engineers live in a different world, disconnected from the regular users who have no clue what public-private keys are!

The standard mantra for physical key-based 2FA has always been "register two keys and keep one in a safe", which seems doable for important accounts (like banks and government stuff) but no way am I going to get a key out of my safe when I want to order a replacement part on JoesDiscountDishwasherParts.biz. I really wish there was a way to register your backup key through your primary key. Luckily, FIDO2 can fix a lo…

> Luckily, FIDO2 can fix a lot of these problems. People who don't have significant security needs can use a trusted service (currently Apple, Google, and a few small companies) rather than a physical device.

And from the article:

> “If I'm Google implementing passkeys, I cede a lot of control to Apple if my user is on an Apple device, I cede a lot of control to Microsoft if the user is on a Windows device, I cede a lot of UX control to Android and browsers,”

To me it sounds like Google, Microsoft, Apple, etc. seizing the last bits of control away from the average person. Everyone will be absolutely beholden to a few big tech companies. Using a fake name or birthday on accounts will be unthinkable because a locked account will mean losing access to your life and the only way to get it back will be to verify your identity which better match the info you provided initially.

We used to have outrage over things like using real names and now we've somehow fallen to the point where everyone is going to mindlessly accept a scheme that could easily morph into verified identities managed by private companies. Participating online will require a verified identity and everything you do will be mapped back to it.

Re: The transition from logins to cryptographic passkeys is getting messy

#124

Post by donmcronald »

GTP wrote: post #95
Semaphor wrote: post #76

Earlier quoted context omitted.

Yeah, but you need to add all those secrets to your backup key. So you need to get it out every time you register somewhere.

I have to admit that I don't own an hardware security key. But since those let you use public key cryptography to login, you could at least theoretically use the same public key for multiple services. Whether the FIDO2 protocol lets you do that or not, I admit I don't know.

The keys are baked in to the devices and are tamper proof. So two devices means you have two different public keys.

I use YubiKeys for accounts I consider important and they're a pretty huge hassle compared to a password manager. I'm also scared to get rid of any of the old ones I've got just in case they're linked to an account I forgot about.

Re: The transition from logins to cryptographic passkeys is getting messy

#125

Post by donmcronald »

dvzk wrote: post #107
NikolaNovak wrote: post #98

Earlier quoted context omitted.

I think the issue here is we don't understand how to. I can, and do, backup and safeguard my KeePass database in ways many and various. I have a fairly robust system to backup "traditional stuff" - including sync to my local NAS, a monthly off-site exchange of external drives with my best friend, and a cloud sync. I have NO clue how to backup my whatever this is keystore or database or whatever, in a way that I'll fe…

Passkey objects on macOS are encrypted at rest within the iCloud Keychain sqlite database in Library/Keychains/*/. It shouldn't be too hard to adapt the keychain extraction tools that exist. I don't know why you would want to though. Since (1) passkeys will rarely be a required nonreissuable credential, and (2) losing access to iCloud Keychain is extremely improbable. For many users, showing ID to a phone store clerk…

> Passkey objects on macOS are encrypted at rest within the iCloud Keychain sqlite database in Library/Keychains/*/. It shouldn't be too hard to adapt the keychain extraction tools that exist.

Really? That sounds awful. So now everything is passwordless and tied to a single database that can be stolen?

I thought the whole point of passkey was to tie the login to a TPM, Secure Enclave, HSM, etc. managed key because that means the private key is in hardened, tamper proof storage that simply signs challenges.

Re: The transition from logins to cryptographic passkeys is getting messy

#126

Post by donmcronald »

flangola7 wrote: post #105
GTP wrote: post #85

Earlier quoted context omitted.

That's why you're always advised to have a backup passkey.

If you are homeless or your current housing is unstable or unsafe what do you do? Not everyone has a safe place to keep physical objects. Homeless individuals already have communication issues because they usually don't have a reliable long term phone or phone number.

> Homeless individuals already have communication issues because they usually don't have a reliable long term phone or phone number.

And that locks them out of most email providers and online services, especially if their only source of internet access is a public library that "looks like a robot" because a lot of people use it simultaneously.

Re: The transition from logins to cryptographic passkeys is getting messy

#127

Post by donmcronald »

lll-o-lll wrote: post #34
_448 wrote: post #29

Oh, what could go wrong! Why is there no discussion on users losing their private keys? Ask all those cryptocurrency users who lost their private keys. Now don't tell that there are crypto wallets/vaults that manage private keys; there are many ways key can be lost even when using wallets/vaults. We engineers live in a different world, disconnected from the regular users who have no clue what public-private keys are!

Passkey is a concept that even the majority of tech enthusiasts seem not to have groked as of today. The thing that google/Apple have brought to the table is cloud backup of your private keys (yes, you should have lots of questions about how that is managed). This should enable disaster recovery/device transition for people using a phone as one of their passkeys. You’d probably add a fingerprint from your laptop for…

> The thing that google/Apple have brought to the table is cloud backup of your private keys (yes, you should have lots of questions about how that is managed).

Absolutely. I keep my BitLocker keys in my Microsoft account because it's a simple solution that provides good enough security for me. If someone wants access to my data they have to get the key and my disk. I understand it and I'm satisfied with how it works.

With passkeys, having a cloud backup doesn't even make sense to me. If I'm using a YubiKey or a TPM, the private key can't be extracted to back it up, so what do they back up? Do I have to opt in to a weaker system to get cloud backups?

At the very least, I should be able to designate trusted parties (parents, siblings, kids) where at least one of them has to approve the recovery of a cloud backup. Microsoft, Google, etc. shouldn't be able to access it at all. I trust my family, not big tech.

Re: The transition from logins to cryptographic passkeys is getting messy

#128

Post by Ajedi32 »

eep_social wrote: post #122
Ajedi32 wrote: post #121

Earlier quoted context omitted.

That's how credential management works on iOS. The built-in password manager works the same way. What exactly is your concern?

Yeah and I don’t use that except where it’s unavoidable (wifi passwords) because apple cannot be trusted any more than any other public company.

Use a different Passkey client then. This is like complaining that the "entire concept" of password managers is "a non-starter" because you don't like Lastpass.

Re: The transition from logins to cryptographic passkeys is getting messy

#129

Post by donmcronald »

dvzk wrote: post #100
007asdflkjsfd wrote: post #69

Name one system that accepts passkeys and allows you to setup two of them. as is the recommended best practice everywhere. even OTP tokens generators goes to great lengths to give a false sense o security that their seed is unique simply by hiding it from the user UI. Google authenticator will happily save the seed and seed tokens in their cloud and allow you to restore. all while still hiding it from the user. if yo…

Like 99% of people in this thread, you are conflating distributed non-device-bound credentials (passkeys) with hardware security keys.

> distributed non-device-bound credentials

If they can be distributed they can be stolen, right? I don't see how it's any better than a password manager at that point.

Re: The transition from logins to cryptographic passkeys is getting messy

#130

Post by donmcronald »

Ajedi32 wrote: post #102

It seems like most people commenting here don't know what passkeys are. I'm seeing a lot of complaints about things that simply aren't a problem with Passkeys, only with plain WebAuthn. Passkeys are based on WebAuthn, but they are not the same from a user experience perspective. The simplest way to describe Passkeys would be "WebAuthn, but with the keys stored in a password manager instead of being tied to a specific…

> Many implementations don't allow the key database to be exported or transferred to a different Passkey client. That's an issue with those implementations though, not an inherent problem with the protocol.

I don't get it. As soon as a key database can be exported, that means it can be stolen, doesn't it? How is Passkey so much better than a password manager with a good implementation that it warrants all the added complexity?

BitWarden already uses my TPM to gate access to the password database.

Post reply on HN