Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

121–130 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#121

Post by booi »

krono wrote: post #85
judge2020 wrote: post #66

Earlier quoted context omitted.

> What I don't like bout Google doing this is that the big providers use this to tether and lock you in to their platform. This is the concern, but exporting passkeys to other ecosystems seems like it'll come with time, even if via third-party tools or like how browsers will prompt you to "import your " upon setup.

Call me a cynic but I'm convinced that won't be happening anytime before critical mass adoption of these companies' own solutions, and either defeated acceptance of this new norm or abject incomprehension by whomever remains. "All your base are belong to us"

Yeah I fail to see why google would be incentivized to provide this functionality.

Re: Passkeys: The beginning of the end of the password

#122

Post by themoonisachees »

oasisbob wrote: post #116
Gasp0de wrote: post #94

There is a legal advantage that passwords have that passkeys and FIDO and so on do not have. In civilized countries, no one can force you to hand over a password (as you have a right to not incriminate yourself). That does not hold for property which can be confiscated or even biometric attributes which can be taken against your will legally. Theoretically, passkeys could still offer this advantage if they are stored…

> In civilized countries, no one can force you to hand over a password (as you have a right to not incriminate yourself). Which countries? In the US, the intersection between 5th amendment rights and password disclosure is not complete. You can be forced to disclose a password in certain circumstances here.

Pretty much only the US explicits this right. I know France tacks on more charges to protesters who refuse to unlock their phones when arrested.

Re: Passkeys: The beginning of the end of the password

#123

Post by sebk »

petedoyle wrote: post #113
dgrin91 wrote: post #5

How is this more secure? They say "with a fingerprint, a face scan or a screen lock PIN", but basically all phones let you fall back to PINs if you dont want to do face or fingerprints. Pins are flat out not secure - typically just 4 digits. Yeah its probably better than 80% of people having "password123", but it seems strictly worse than a password + password manager? Or at least just having proper 2FA.

This has been bothering me, a lot. Google talks [1] about how Passkey replication is e2e encrypted between devices, but AFAICT they're just using a pin + key derivation. A six digit pin is like 20 bits of entropy before a KDF. [2] Has anyone seen any docs that might help characterize how much entropy the keys have for e2e encryption (Android/iOS)? I must be missing something, because I can't see how Google would call…

Talking about Apple here because it's what I'm more familiar with, and their security whitepapers are more widely available.

The PIN and key derivation wraps the actual encryption key that's stored locally in the device or secure enclave, not the actual secrets that are stored in the provider's cloud. The actual wrapping keys are random 256 bit AES-GCM keys. This approach works because the secure enclave provides measures against bruteforcing and tampering.

There is some controversy that I can't find an explanation for in any whitepaper, specifically here: https://support.apple.com/en-us/HT202303 where it reads "(...) this data remains secure even in the case of a data breach in the cloud. If you lose access to your account, only you can recover this data, using your device passcode or password, recovery contact, or recovery key." because that implies off-device use of the PIN, so those measures are lost. There's no further explanation that I could find about that. Some previous discussion about that particular point here: https://news.ycombinator.com/item?id=33897793&p=2#33900540

Re: Passkeys: The beginning of the end of the password

#124

Post by seti0Cha »

awaythrow98765 wrote: post #57

Those passkeys are either insecure or unreliable. Let me explain: Those passkeys are asymmetric cryptographic keypairs where the private key is securely stored on a device, unlockable (for use, not reading) only by convincing your devices security processor to do so by pin/fingerprint/pattern. Which in itself can be secure, given you do trust that magic security processor (which you shouldn't, see yesterday's news fo…

The idea seems to be that you will either trust a provider like Apple or Google to keep you private key safe and let them sync it around, or you will create a passkey for each device that you use. If you lose the device, deauthorize the passkey. If you somehow lose the passkey itself, create another one, either by using an older form of authentication, or by creating using a different device to authenticate. There is no need for passkey recovery or backup.

Re: Passkeys: The beginning of the end of the password

#125

Post by judge2020 »

gst wrote: post #38

Just a heads-up if you're planning to use passkeys with iOS/macOS: Might be fixed already, but last time I tried it out it seemed like iOS only stored a single passkey per domain. If you first store a passkey for a@domain and then later on store a passkey for a different user b@domain the a@domain passkey is overwritten without any warning. Or at least this seemed to be the case a couple of months ago when I tried it…

All the way back in iOS 15, when getting passkeys meant building an xcode app to access the developer menu and enable passkeys, I had no trouble storing multiple per domain when adding passkeys to GitHub. Maybe the site you were trying to use sent the same `user.id` for both requests? /shrug

Re: Passkeys: The beginning of the end of the password

#126

Post by gowld »

EGreg wrote: post #119
segmondy wrote: post #41

I'm still salty about this. Called it passkey too. http://www.multipasskey.com/susdemo/ . Built this 5-6yrs ago and applied to YC. Crickets. Hope to see this take off, with my approach I made it where you don't even need to "register", you can go to a site and just have an account. I did the fingerprint, face scan, PIN approach for more security, but my favorite was NFC ring. Basically you have an NFC ring you wear o…

Contact me and let’s add it to https://qbix.com/platform and ecosystem so it is not captured by Big Tech corporations. We have a lot to talk about and exchange information. greg at the domain qbix.com

> greg at the domain qbix.com

I regret to inform you that someone has carelessly or maliciously leaked your deobfuscated email address, on the site

https://qbix.com/resume.html

Re: Passkeys: The beginning of the end of the password

#127

Post by Hamuko »

themoonisachees wrote: post #122
oasisbob wrote: post #116

Earlier quoted context omitted.

> In civilized countries, no one can force you to hand over a password (as you have a right to not incriminate yourself). Which countries? In the US, the intersection between 5th amendment rights and password disclosure is not complete. You can be forced to disclose a password in certain circumstances here.

Pretty much only the US explicits this right. I know France tacks on more charges to protesters who refuse to unlock their phones when arrested.

Has that been tested with the ECJ yet?

Re: Passkeys: The beginning of the end of the password

#128

Post by stinkytaco »

oasisbob wrote: post #116
Gasp0de wrote: post #94

There is a legal advantage that passwords have that passkeys and FIDO and so on do not have. In civilized countries, no one can force you to hand over a password (as you have a right to not incriminate yourself). That does not hold for property which can be confiscated or even biometric attributes which can be taken against your will legally. Theoretically, passkeys could still offer this advantage if they are stored…

> In civilized countries, no one can force you to hand over a password (as you have a right to not incriminate yourself). Which countries? In the US, the intersection between 5th amendment rights and password disclosure is not complete. You can be forced to disclose a password in certain circumstances here.

I think in Florida v. Voigt someone was sentenced to 6 months for not handing their iPhone password in an extortion case. If I recall, the phone was ultimately hacked to get the evidence.

Re: Passkeys: The beginning of the end of the password

#129

Post by judge2020 »

falcolas wrote: post #102

Auth is as secure as the weakest link - in the case of this it's your email and/or customer service To put it another way, it's not really any more secure than passwords. Sure, there's a lower risk of password breaches, but if you're the target audience for passkeys, you probably also use a password manager with unique passwords per site (even if that manager is the one built into your browser and synced across your…

> but if you're the target audience for passkeys

This is the difference. With the big players pushing it, including Apple instructing developers on the best way to integrate passkeys in their apps[0], it's going to overall shift more people from passwords to passkeys (especially when developers prioritize passkeys during signup).

0: https://developer.apple.com/documentation/authenticationserv...

Re: Passkeys: The beginning of the end of the password

#130

Post by pphysch »

hdiehdis wrote: post #53
segmondy wrote: post #41

I'm still salty about this. Called it passkey too. http://www.multipasskey.com/susdemo/ . Built this 5-6yrs ago and applied to YC. Crickets. Hope to see this take off, with my approach I made it where you don't even need to "register", you can go to a site and just have an account. I did the fingerprint, face scan, PIN approach for more security, but my favorite was NFC ring. Basically you have an NFC ring you wear o…

i say this every time this is mentioned... all these thing are mostly to help advertisers and fight spam and reduce cost on their servers. theres a million ways to provide this functionality without relying on vendor lock in. they are pretty much working as a mini certificate authority/vendor. instead of vetting clients and giving them CAs, they just run your credit card for some hardware or subscription, and validat…

> theres a million ways to provide this functionality without relying on vendor lock in. they are pretty much working as a mini certificate authority/vendor.

Identity systems aren't too technically difficult, the challenge is properly rolling them out and getting mass adoption. Which means getting vendors/users on board. It's a problem solved by power and politics, not technological innovation.

Post reply on HN