The transition from logins to cryptographic passkeys is getting messy • Hacker News Board

Re: The transition from logins to cryptographic passkeys is getting messy

#151

Post by swiftcoder » Thu, Apr 27, 2023, 4:49 PM UTC

brazzy wrote: post #38

swiftcoder wrote: post #28

Earlier quoted context omitted.

> The biggest threat almost all users face is in the form of remote attackers I'm not sure what users you interact with most on a regular basis, but for a pretty significant portion of the population, the most likely threats to their online (and offline) safety are jealous boyfriends/spouses/parents

Actually a valid point, but if you're gonna be that condescending about someone not considering that part of the population you should have something better than weasel words to argue how big it is.

> if you're gonna be that condescending about someone not considering that part of the population

We're talking about somewhere around 65% of the overall population. Entirely ignoring women and children from your target market warrants a little condescention

Re: The transition from logins to cryptographic passkeys is getting messy

#152

Post by donmcronald » Fri, Apr 28, 2023, 4:08 AM UTC

lll-o-lll wrote: post #146

donmcronald wrote: post #142

Earlier quoted context omitted.

> Apple, as an example, promise that your keys are end-to-end encrypted and not viewable by Apple themselves. That means single device users are in for a bad time if they lose their device.

Incorrect. They get a new phone, login with their password and all their keys are downloaded to the new device.

I’m guessing that means there’s some kind of key derivation happening which means it’s super similar to modern password managers IMO. I realize there are some benefits, but in a password based world I can memorize my highest value passwords and salt others with a common password.

I don’t see the value in making such a big change for such little gain.

Re: The transition from logins to cryptographic passkeys is getting messy

#153

Post by donmcronald » Fri, Apr 28, 2023, 4:16 AM UTC

GTP wrote: post #148

donmcronald wrote: post #124

Earlier quoted context omitted.

The keys are baked in to the devices and are tamper proof. So two devices means you have two different public keys. I use YubiKeys for accounts I consider important and they're a pretty huge hassle compared to a password manager. I'm also scared to get rid of any of the old ones I've got just in case they're linked to an account I forgot about.

I thought you could generate a key on your PC and store it inside the YubiKey, are you sure it isn't possible?

It’s possible, at least for GPG. I’m not sure about WebAuthn. Regardless, generating the key right on the device is the most secure way of doing it.

It’s also hard to manage keys you’re loading yourself. Once I loaded a private key onto my YubiKey and accidentally failed to backup the private key because I used the wrong syntax when I exported it. I didn’t even realize until I got a new YubiKey and went to load my GPG keys onto it. I was only using it for signing, so it wasn’t a huge deal, but if I’d been using it for encryption / decryption it would have been a disaster.

Re: The transition from logins to cryptographic passkeys is getting messy

#154

Post by swiftcoder » Sun, Apr 30, 2023, 9:05 AM UTC

postalrat wrote: post #65

swiftcoder wrote: post #27

Earlier quoted context omitted.

> whichever software vault you're using Do consumers perceive a significant difference between "login with Facebook" and "login with LastPass"? In both cases I'm delegating my security credentials to a cloud service I have limitted influence over.

Passkeys don't require any cloud provider.

In theory, no, but in practice if I don't have a cloud provider backing up my passkeys, I'm just going to lose them all next time my phone/computer dies (same problem as with local-only 2fac code generators today).