Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The transition from logins to cryptographic passkeys is getting messy

wired.com

Post reply on HN
Print view View original

141–150 of 154 posts

Re: The transition from logins to cryptographic passkeys is getting messy

#141

Post by quesera »

jrochkind1 wrote: post #103
quesera wrote: post #97

Earlier quoted context omitted.

> and one in a realtor-style lockbox in my back yard FWIW be sure to assign proper expectations of security to those lockboxes, i.e. very very low. I make a hobby of defeating them at friends' houses. Takes a few minutes. The last time I sold a house, I brought the lockbox to the closing to hand to my real estate agent. He was perplexed.

> I make a hobby of defeating them at friends' houses. Takes a few minutes. Fair and good warning, but I'm curious, how long would it take you to pick my front door lock instead? Are you saying those lockboxes are significantly easier to defeat than a standard front door lock? (I am genuinely curious! I imagine it could depend on both the particular brand/model of lockbox and door lock!) (Plus I have bars on some bas…

This is a good point. I'm a pretty quick lockpick too, for the common Schlage-class at least, but this requires tools and practice.

The real estate agent lockbox can be defeated by a random ten year old kid in less than ten minutes. Watch out TikTok!

Re: The transition from logins to cryptographic passkeys is getting messy

#142

Post by donmcronald »

lll-o-lll wrote: post #132
donmcronald wrote: post #127

Earlier quoted context omitted.

> The thing that google/Apple have brought to the table is cloud backup of your private keys (yes, you should have lots of questions about how that is managed). Absolutely. I keep my BitLocker keys in my Microsoft account because it's a simple solution that provides good enough security for me. If someone wants access to my data they have to get the key and my disk. I understand it and I'm satisfied with how it works…

Apple, as an example, promise that your keys are end-to-end encrypted and not viewable by Apple themselves. https://support.apple.com/en-au/HT213305#:~:text=Recovery%20... . Should you trust Apple? Is this secure enough if a password can still be used that recovers all these keys? Ultimately there is always a convenience/security trade-off. The “passkey” concept has it right for the 99% of users case (in my opinion).…

> Apple, as an example, promise that your keys are end-to-end encrypted and not viewable by Apple themselves.

That means single device users are in for a bad time if they lose their device.

Re: The transition from logins to cryptographic passkeys is getting messy

#143

Post by jareklupinski »

donmcronald wrote: post #123
jeroenhd wrote: post #33

Earlier quoted context omitted.

The standard mantra for physical key-based 2FA has always been "register two keys and keep one in a safe", which seems doable for important accounts (like banks and government stuff) but no way am I going to get a key out of my safe when I want to order a replacement part on JoesDiscountDishwasherParts.biz. I really wish there was a way to register your backup key through your primary key. Luckily, FIDO2 can fix a lo…

> Luckily, FIDO2 can fix a lot of these problems. People who don't have significant security needs can use a trusted service (currently Apple, Google, and a few small companies) rather than a physical device. And from the article: > “If I'm Google implementing passkeys, I cede a lot of control to Apple if my user is on an Apple device, I cede a lot of control to Microsoft if the user is on a Windows device, I cede a…

shout out to all my friends celebrating their 123rd birthdays this year, according my Apple/iCloud shared calendars (1900 cohort)

Re: The transition from logins to cryptographic passkeys is getting messy

#144

Post by xracy »

traceroute66 wrote: post #14
xracy wrote: post #6

Part of the problem is that right now the most convenient use of things like yubikeys is that the most convenient use of them is just leave them in your computer wherever they may be. That makes them a pretty hard sell for any workplace environment, but also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... Seems like 2FA is the future...

> also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... May I humbly suggest you RTFM before posting FUD. You can set a PIN on the Yubikey (or on the Yubikey Bio's, your fingerprint). Further, the PIN will block after three failed attempts, requiring the PUK to reset the PIN. Key loggers are of course defeated by the Yubikey's touch requiremen…

Sorry... but... like... How is that not 2FA?

You moved one of the factors.

The possible factors are: Something you know Something you are Something you have

Choose 2.

A PIN would be something you know A fingerprint would be something you are. The key is something you have.

I'm saying in the post that we're never going to just a passkey for this. And the yubikeys I have used in the past have all been just "something you have".

Re: The transition from logins to cryptographic passkeys is getting messy

#145

Post by xracy »

md_ wrote: post #13
xracy wrote: post #6

Part of the problem is that right now the most convenient use of things like yubikeys is that the most convenient use of them is just leave them in your computer wherever they may be. That makes them a pretty hard sell for any workplace environment, but also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... Seems like 2FA is the future...

This is an extraordinarily bad take. :) - The biggest threat almost all users face is in the form of remote attackers: password phishing, database leaks + password reuse, tricking users into installing malware, etc. Local attackers are so far down the list of concerns that, really, using unique passwords and storing them on Post-Its is, for most people, an improvement in security! - Leaving a Yubikey in the computer…

It's possible that I'm just missing the distinction here between passkeys and FIDO security keys. Because all of the things I'm seeing in this space fall into just one factor of authentication.

I will point out that I explicitly called out 2FA as being necessary. And any of PIN/Biometric (not sure what screenlock is), seems like that 2nd factor to me. So if these are different things, then the rollout is going really rocky (on par with Wii vs. Wii U), and they should probably come up with a better naming schema.

Re: The transition from logins to cryptographic passkeys is getting messy

#146

Post by lll-o-lll »

donmcronald wrote: post #142
lll-o-lll wrote: post #132

Earlier quoted context omitted.

Apple, as an example, promise that your keys are end-to-end encrypted and not viewable by Apple themselves. https://support.apple.com/en-au/HT213305#:~:text=Recovery%20... . Should you trust Apple? Is this secure enough if a password can still be used that recovers all these keys? Ultimately there is always a convenience/security trade-off. The “passkey” concept has it right for the 99% of users case (in my opinion).…

> Apple, as an example, promise that your keys are end-to-end encrypted and not viewable by Apple themselves. That means single device users are in for a bad time if they lose their device.

Incorrect. They get a new phone, login with their password and all their keys are downloaded to the new device.

Re: The transition from logins to cryptographic passkeys is getting messy

#147

Post by md_ »

xracy wrote: post #145
md_ wrote: post #13

Earlier quoted context omitted.

This is an extraordinarily bad take. :) - The biggest threat almost all users face is in the form of remote attackers: password phishing, database leaks + password reuse, tricking users into installing malware, etc. Local attackers are so far down the list of concerns that, really, using unique passwords and storing them on Post-Its is, for most people, an improvement in security! - Leaving a Yubikey in the computer…

It's possible that I'm just missing the distinction here between passkeys and FIDO security keys. Because all of the things I'm seeing in this space fall into just one factor of authentication. I will point out that I explicitly called out 2FA as being necessary. And any of PIN/Biometric (not sure what screenlock is), seems like that 2nd factor to me. So if these are different things, then the rollout is going really…

Passkeys (as password replacements) generally require user verification (like a PIN or fingerprint) to unlock the secret.

I don't think very many people know what "security keys" or "FIDO" are, to be honest, so you're probably in the tiny part of the Venn diagram of people who a) know what those things are but b) don't know that they support user verification. ;)

Re: The transition from logins to cryptographic passkeys is getting messy

#148

Post by GTP »

donmcronald wrote: post #124
GTP wrote: post #95

Earlier quoted context omitted.

I have to admit that I don't own an hardware security key. But since those let you use public key cryptography to login, you could at least theoretically use the same public key for multiple services. Whether the FIDO2 protocol lets you do that or not, I admit I don't know.

The keys are baked in to the devices and are tamper proof. So two devices means you have two different public keys. I use YubiKeys for accounts I consider important and they're a pretty huge hassle compared to a password manager. I'm also scared to get rid of any of the old ones I've got just in case they're linked to an account I forgot about.

I thought you could generate a key on your PC and store it inside the YubiKey, are you sure it isn't possible?

Re: The transition from logins to cryptographic passkeys is getting messy

#149

Post by stavros »

eep_social wrote: post #114
stavros wrote: post #79

Earlier quoted context omitted.

> I feel like I'm an old grouch who wants things to stay the same... It does seem like it. The things you mention aren't drawbacks of this technology, and this is par for the course for whenever I see discourse on WebAuthn. People just mention random fears that they have, the vast majority of which aren't true.

As another old grouch, it’s on the experts to explain. They’re doing a piss poor job of it so far. “Just trust us” is deeply problematic.

Sure, but "I don't understand" cannot reasonably be followed by "therefore I will inject my own fears into this". WebAuthn is just a way for a website to tell your device it needs to authenticate. It has nothing to do with a specific company, hardware or software, etc.

If you want, you can keep on using your existing password manager for WebAuthn, or use a password. The standard doesn't care.

Re: The transition from logins to cryptographic passkeys is getting messy

#150

Post by stavros »

nly wrote: post #15

Just give me password auth back. I work in a lab that requires fingerprint login (TrustKey FIDO keys) with no fallback. Every 6-8 weeks I need to have my keys reset with new prints, which is a process that involves meeting a member of the security team in a room for 20 minutes so my key and the backup key (kept in a safe by the firm) can both be reset. Everyday, without fail, I sit there like a chimp taking on averag…

This has nothing to do with the standard and everything to do with your lab, though.
Post reply on HN