Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

71–80 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#71

Post by boudin »

awaythrow98765 wrote: post #57

Those passkeys are either insecure or unreliable. Let me explain: Those passkeys are asymmetric cryptographic keypairs where the private key is securely stored on a device, unlockable (for use, not reading) only by convincing your devices security processor to do so by pin/fingerprint/pattern. Which in itself can be secure, given you do trust that magic security processor (which you shouldn't, see yesterday's news fo…

I find this to be a regression in terms of usability and security as well.

On top of what you mentioned, it also fails really hard when someone has access to you and your trusted device (which will be the smartphone in most cases). It's already an issue allowing easy access to smartphone content, it will extend it to any account using that method of authentication.

Re: Passkeys: The beginning of the end of the password

#72

Post by awaythrow98765 »

Shank wrote: post #63
awaythrow98765 wrote: post #57

Those passkeys are either insecure or unreliable. Let me explain: Those passkeys are asymmetric cryptographic keypairs where the private key is securely stored on a device, unlockable (for use, not reading) only by convincing your devices security processor to do so by pin/fingerprint/pattern. Which in itself can be secure, given you do trust that magic security processor (which you shouldn't, see yesterday's news fo…

The point of passkeys isn’t to be perfect — the point is to replace passwords, which are already far more imperfect than passkeys. The bonus points with a password is that every site that uses them has to secure them properly and theft of passwords, in plain-text, hashed, etc form is common.

For an end-user, reliability and ease-of-use trump security. Passkeys are imperfect in the wrong places imho.

Re: Passkeys: The beginning of the end of the password

#73

Post by arnarbi »

Nextgrid wrote: post #67

How do you handle delegation in this case? Let's say I want to delegate access to my account to a partner/friend/employee on a service that doesn't support multiple users per account, charges extra for it or outright doesn't want me to delegate access to someone else (so it's not always possible to rely on the website's cooperation). Currently I can just message them the password or even write it down on a post-it no…

You can create a passkey for your account on their device, e.g. by selecting "Use another device" when creating it, and scanning the QR with their phone (their phone does not need to be signed in to your account).

And if you both use iOS, you can Airdrop a passkey: https://support.apple.com/guide/iphone/share-passkeys-passwo...

Re: Passkeys: The beginning of the end of the password

#74

Post by kevincox »

Nextgrid wrote: post #67

How do you handle delegation in this case? Let's say I want to delegate access to my account to a partner/friend/employee on a service that doesn't support multiple users per account, charges extra for it or outright doesn't want me to delegate access to someone else (so it's not always possible to rely on the website's cooperation). Currently I can just message them the password or even write it down on a post-it no…

This is what I love about passwords. They are tangable and understandable. I would have loved if we could move towards a solution that has the benefits of passkeys (prevents phishing, strong secret, doesn't seen the secret to the server) without ditching the underlying secret being a somewhat human-readable password. It seems that in-browser password-managers get us 99% of the way there. I would have loved to do something like adding a PAKE system to regular passwords rather than a new system built on top of non-human readable keys.

I'm sure we will gain the ability to dump the key to a file or write down onto paper at some point but it seems that we are starting from the wrong end.

Re: Passkeys: The beginning of the end of the password

#75

Post by somedudetbh »

VoodooJuJu wrote: post #19
dgrin91 wrote: post #5

How is this more secure? They say "with a fingerprint, a face scan or a screen lock PIN", but basically all phones let you fall back to PINs if you dont want to do face or fingerprints. Pins are flat out not secure - typically just 4 digits. Yeah its probably better than 80% of people having "password123", but it seems strictly worse than a password + password manager? Or at least just having proper 2FA.

>with a fingerprint, a face scan or a screen lock PIN I agree - not secure. And just a daily reminder that biometrics are usernames , they are not passwords. You can change a password, a lock, a key, you cannot change biometrics, and thus they should not be used for guarding sensitive info. The only use-case for biometrics is deanonymization, sold to you under the auspices of security, primarily used for corporate su…

> And just a daily reminder that biometrics are usernames, they are not passwords.

I think you should stop giving out this daily reminder. This meme has outlived its usefulness.

Using face id to unlock a local key store to enable my device to sign a signed challenge from a site I want to log into with the private key stored on my device is not a 'username' in any meaningful sense.

The problem is, the metaphor about passwords and usernames is not a good, structure-preserving simplification of the actual problem of authentication.

The biometric data and/or pin code are not being used to prove that you are you to Gmail, it's being used to unlock the set of private keys you have on your device. This doesn't fit into the metaphor at all.

If my non-technical parents said they were migrating all their accounts to passkeys, I would be very pleased. I wouldn't be worried about their inability to change their biometrics and that causing a problem following some sort of breach in the future. I am highly worried about their extreme susceptibility to phishing, especially in their inability to distinguish phishing sites from real sites, or real account maintence contacts via email and SMS from phishing contacts, their reuse of very simple passwords that are probably circulating in combolists already, and their general inability to retain username/password pairs. I have a lot of sympathy for them when I try to talk them through something like logging in to an Apple device with their apple id, when their appleid username is their email, which ends with @gmail.com. "But...why would i log in to apple with my gmail?" nevermind how confused they are about 'log in with google', 'log in with facebook', etc.

Moving to a model where their devices store webauthn credentials and guard them with a pin or faceid-style biometric shortcut is a _massive_ improvement in practical resistance to account takeover for my parents, and I don't think continuing to say 'biometrics are usernames in authn' is accurate or helpful.

Re: Passkeys: The beginning of the end of the password

#76

Post by johndough »

wepple wrote: post #45
VoodooJuJu wrote: post #19

Earlier quoted context omitted.

>with a fingerprint, a face scan or a screen lock PIN I agree - not secure. And just a daily reminder that biometrics are usernames , they are not passwords. You can change a password, a lock, a key, you cannot change biometrics, and thus they should not be used for guarding sensitive info. The only use-case for biometrics is deanonymization, sold to you under the auspices of security, primarily used for corporate su…

> The only use-case for biometrics is deanonymization, sold to you under the auspices of security, primarily used for corporate surveillance. Please provide evidence that biometric data has ever been extracted from a major platform (IE Apple/enclave). Absence of evidence != evidence of absence, I know, but you’re selling it as the only use case so surely you have proof.

> Please provide evidence that biometric data has ever been extracted from a major platform

Why extract it from a platform when it can be extracted easily from the person? Imagine your password was written on every surface you touched (fingerprint) or is prominently displayed on your social media accounts (face).

Re: Passkeys: The beginning of the end of the password

#77

Post by nashashmi »

barkerja wrote: post #33
nashashmi wrote: post #14

So yahoo has had this for a while. yes ... Yahoo. What's wrong with Google these days? They seem to be too focused. BTW, passkey is the name for a password that is made using word keys.

Google has actually had this rolled out for some time. I've been using a Passkey on my account for the better part of a year. For whatever reason, they're just now announcing it.

Thanks for the info. I am upset I missed out on this.

Re: Passkeys: The beginning of the end of the password

#78

Post by asimpletune »

XorNot wrote: post #4

I hate this, I hate every part of this. The attempt to get rid of passwords has been the biggest assault on the free internet in recent history, and people are asleep at the wheel as it's happening. They want to tie you to an external service, so they can tie you to your phone, which they also manage with another external service. All of these schemes are braindead with obtuse, user-unfriendly backup/transfer/restore…

But you still need a password to use a passkey right? So passwords aren’t going away, they’re just being used to a more secure way.

My mom can’t tell if a website is fake if it’s made to look exactly like Facebook, for example. So in a sense passwords are actually awful for users because they’re required to remember dozens of passwords and verify that a website is legit. If they just reuse the same password everywhere then they are vulnerable to another kind of attack because some website somewhere will mishandle it, forcing her to change every password on every site afterward.

Instead, she can have the best of both worlds by remembering one master password, that basically opens a magic app that will check that the website is legit and create/retrieve a unique passkey for each login.

Re: Passkeys: The beginning of the end of the password

#79

Post by jmbwell »

awaythrow98765 wrote: post #57

Those passkeys are either insecure or unreliable. Let me explain: Those passkeys are asymmetric cryptographic keypairs where the private key is securely stored on a device, unlockable (for use, not reading) only by convincing your devices security processor to do so by pin/fingerprint/pattern. Which in itself can be secure, given you do trust that magic security processor (which you shouldn't, see yesterday's news fo…

As an administrator, I hear you, but we have to adapt. Passwords are awful. On the whole, the effort and energy spent training people on passwords, battling phishing, dealing with password managers, cleaning up from breaches, and more… passwords can't die soon enough.

FWIW, asymmetric PKI is technically mature and relatively easy to implement in most applications (without "vendor lock-in", I might add to comments upthread), and there are ways to address most of your concerns about key loss and recovery beyond what you describe, as by the ring of trust scheme Apple uses, for example.

The only way through this is forward. I'm confident it really will get better once passwords become a smelly indicator of bad security practice.

Re: Passkeys: The beginning of the end of the password

#80

Post by dhess »

cbeach wrote: post #62

Anyone know if it's possible to use this with Google Workspace accounts yet? From the Google Blog I clicked on "Today, passkeys for Google Accounts are available. You can try them out here" However, I got: "Passkeys aren’t allowed on this account. Contact your admin for help" And the Workspace admin page doesn't seem to include any options for Passkeys.

Same here, but note that in this post on the Google Security Blog:

https://security.googleblog.com/2023/05/so-long-passwords-th...

the first sentence reads, "Starting today, you can create and use passkeys on your personal Google Account." (Emphasis mine.)

Post reply on HN