Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

51–60 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#51

Post by oli-g »

VoodooJuJu wrote: post #19
dgrin91 wrote: post #5

How is this more secure? They say "with a fingerprint, a face scan or a screen lock PIN", but basically all phones let you fall back to PINs if you dont want to do face or fingerprints. Pins are flat out not secure - typically just 4 digits. Yeah its probably better than 80% of people having "password123", but it seems strictly worse than a password + password manager? Or at least just having proper 2FA.

>with a fingerprint, a face scan or a screen lock PIN I agree - not secure. And just a daily reminder that biometrics are usernames , they are not passwords. You can change a password, a lock, a key, you cannot change biometrics, and thus they should not be used for guarding sensitive info. The only use-case for biometrics is deanonymization, sold to you under the auspices of security, primarily used for corporate su…

> biometrics are usernames, they are not passwords

While I see where you're coming from, they really aren't just usernames. It's not like I can log into your e-mail account by typing VoodooJuJu and pressing Enter.

Re: Passkeys: The beginning of the end of the password

#52

Post by jefftk »

neilalexander wrote: post #47
red_trumpet wrote: post #42

> passkeys are resistant to online attacks like phishing, making them more secure than things like SMS one-time codes. What is the scenario in which SMS one-time codes are prone to fishing, but passkeys are not?

https://en.wikipedia.org/wiki/SIM_swap_scam

That is also an issue with 2fa sms, but it's not phishing.

Re: Passkeys: The beginning of the end of the password

#53

Post by hdiehdis »

segmondy wrote: post #41

I'm still salty about this. Called it passkey too. http://www.multipasskey.com/susdemo/ . Built this 5-6yrs ago and applied to YC. Crickets. Hope to see this take off, with my approach I made it where you don't even need to "register", you can go to a site and just have an account. I did the fingerprint, face scan, PIN approach for more security, but my favorite was NFC ring. Basically you have an NFC ring you wear o…

i say this every time this is mentioned... all these thing are mostly to help advertisers and fight spam and reduce cost on their servers.

theres a million ways to provide this functionality without relying on vendor lock in. they are pretty much working as a mini certificate authority/vendor.

instead of vetting clients and giving them CAs, they just run your credit card for some hardware or subscription, and validate your login.

Re: Passkeys: The beginning of the end of the password

#55

Post by kmlx »

i’ve got passkeys enabled on github, cloudflare, google, twitter etc via apple’s passkey implementation (https://support.apple.com/en-gb/guide/iphone/iphf538ea8d0/io...). they all implemented passkeys as an alternative to sms OTP. very easy to use, and should be better than sms, but still haven’t seen full on login using passkeys. if anyone knows of such a site i’m curios how they implemented it.

Re: Passkeys: The beginning of the end of the password

#56

Post by Pxtl »

XorNot wrote: post #4

I hate this, I hate every part of this. The attempt to get rid of passwords has been the biggest assault on the free internet in recent history, and people are asleep at the wheel as it's happening. They want to tie you to an external service, so they can tie you to your phone, which they also manage with another external service. All of these schemes are braindead with obtuse, user-unfriendly backup/transfer/restore…

Okay, but the alternative is users managing a separate password for every service, which is impossible to do securely without using a password-manager, and the password-manager is basically a weaker version of an external service like Google's.

Re: Passkeys: The beginning of the end of the password

#57

Post by awaythrow98765 »

Those passkeys are either insecure or unreliable. Let me explain:

Those passkeys are asymmetric cryptographic keypairs where the private key is securely stored on a device, unlockable (for use, not reading) only by convincing your devices security processor to do so by pin/fingerprint/pattern. Which in itself can be secure, given you do trust that magic security processor (which you shouldn't, see yesterday's news for example). However, if that key cannot be read, you cannot make a backup of it, so it will be unrealiable and easy to loose. The recovery process will either be insecure and prone to social engineering, or unreliable because proving your identity will be nigh impossible without that passkey. Now one could allow backups of a passkey, but then that passkey would be as insecure as a password. One could allow multiple instances of authorized passkeys, but those would be even more insecure than passwords, because malicious software on your device could create evil new key instances.

In all a bad and dangerous idea.

Re: Passkeys: The beginning of the end of the password

#58

Post by barkerja »

Armic wrote: post #54

What happens if you lose all your hardware factors (eg if you have a home fire)? Are you just locked out of all your accounts with this approach?

Not if the Passkey was synced (ex: you used iCloud keychain). If the passkey was not synced, then I would have to assume it would be the same if you lost a physical hardware key.

Re: Passkeys: The beginning of the end of the password

#59

Post by vlovich123 »

ytch wrote: post #23
vlovich123 wrote: post #10

Earlier quoted context omitted.

Sure. But am I still locking my ability to access that account permanently to Google? Can I login via Chrome on an Apple/Windows platform and add a passkey there? I’m also a bit worried that this permanently entrenches these as the platform vendors because no one is going to port to a new platform unless you’re already a major tech company (maybe).

For Chrome on desktop OS, it will popup a QR code that you can scan it by passkey-registered phone like[1]. If your desktop/laptop has TPM, TrustZone or other similar devices, it can register Passkey too. [1] https://9to5google.com/2022/10/12/android-chrome-passkey-sup...

That’s interesting and I think potentially addresses the concern. I don’t think I’ve seen Apple have a QR scanning code option for passcodes but it’s possible that’s just integrated into normal QR in-camera. Apple doesn’t have a QR export does it?

What would be nicer if there’s a way to do this in Chrome on mobile. I’m not always near a computer although I’m reality that’s probably when I’d be adding the passkey via chrome.

Re: Passkeys: The beginning of the end of the password

#60

Post by ghaff »

XorNot wrote: post #4

I hate this, I hate every part of this. The attempt to get rid of passwords has been the biggest assault on the free internet in recent history, and people are asleep at the wheel as it's happening. They want to tie you to an external service, so they can tie you to your phone, which they also manage with another external service. All of these schemes are braindead with obtuse, user-unfriendly backup/transfer/restore…

Passwords are terrible for a world where people have hundreds of them and are lazy. And password managers are a bandaid solution.

Arguing effectively that passwords were fine for computing in 1970 isn't an answer. So if you don't like passkeys it's reasonable to ask for your alternative.

Post reply on HN