Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

161–170 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#161

Post by signal11 »

lxgr wrote: post #135

WebAuthN is great, but I can't help but feel that Passkeys are actually a step backwards. At least on iOS, there is no way of preventing them from being synced to iCloud, which is the opposite of what I want for high-stakes credentials like bank accounts or government e-signatures. I've tried to raise [1] a related issue (i.e. the inability for relying parties to opt out of credential syncing, if not an explicit requ…

My cynical assessment of Passkeys is:

If Google/Amazon/Apple/Meta/whoever locks your account out, you now lose access everywhere.

This isn’t a theoretical risk. You’ll see lots of people complain about this online.

Also, Passkey providers now get sweet sweet metadata about your accounts around the web.

But yeah, authn is hard to do right. Equally, asking your users to fall into $BIG_PROVIDER’s arms seems wrong.

My personal hope is that various accountable nonprofits will begin to offer passkeys.

Re: Passkeys: The beginning of the end of the password

#162

Post by 015a »

Gasp0de wrote: post #94

There is a legal advantage that passwords have that passkeys and FIDO and so on do not have. In civilized countries, no one can force you to hand over a password (as you have a right to not incriminate yourself). That does not hold for property which can be confiscated or even biometric attributes which can be taken against your will legally. Theoretically, passkeys could still offer this advantage if they are stored…

As opposed to where you store your passwords? I can only speak for me, but they're in 1Password; if the police get my phone, the same thing protects 1Password as would protect these passkey private keys: FaceID, maybe a PIN if a lockout can be triggered before they get it, and at its core, the Secure Enclave. There's no legal advantage to passwords, unless you were actually memorizing every password you've got (and if that's the case, son we got bigger fish to fry).

A ton of people in our bubble have this Mission Impossible-esque view of their security footprint, which simply isn't true in reality. Its XKCD 538 every time this comes up.

Re: Passkeys: The beginning of the end of the password

#163

Post by lxgr »

Gasp0de wrote: post #94

There is a legal advantage that passwords have that passkeys and FIDO and so on do not have. In civilized countries, no one can force you to hand over a password (as you have a right to not incriminate yourself). That does not hold for property which can be confiscated or even biometric attributes which can be taken against your will legally. Theoretically, passkeys could still offer this advantage if they are stored…

Passkeys are an authentication mechanism, and as such replace (authentication) passwords, not (encryption) passphrases.

A password (at least as I understand the term) is used to authenticate to some third-party entity to get access to your data or services. The (implied or legal) contract here is: "Only give access to my data to anybody that can provide my password."

Government authorities can in most cases just go to the service and demand that access legally; there is no need to get your password through whatever means.

A passphrase, on the other hand, can be used to encrypt your data directly, and the service provider might not be able to hand over your data to the authorities without it.

Re: Passkeys: The beginning of the end of the password

#164

Post by lxgr »

awaythrow98765 wrote: post #57

Those passkeys are either insecure or unreliable. Let me explain: Those passkeys are asymmetric cryptographic keypairs where the private key is securely stored on a device, unlockable (for use, not reading) only by convincing your devices security processor to do so by pin/fingerprint/pattern. Which in itself can be secure, given you do trust that magic security processor (which you shouldn't, see yesterday's news fo…

What would be a better idea, then?

Re: Passkeys: The beginning of the end of the password

#165

Post by jahnu »

sebk wrote: post #147
jahnu wrote: post #22

Earlier quoted context omitted.

Indeed I wouldn’t trust Google or Apple to be the only place my passkeys are stored. I’m currently a 1Password user and their upcoming support looks like it could address this issue (I’m not in any way affiliated with them) https://www.future.1password.com/passkeys/

Sure but this currently means a virtual authenticator that puts unwrapped passkeys in the same memory as other applications, leaving only the OS and no other physical measures to protect a direct-memory read. That might be acceptable for your threat model, but no other currently adopted WebAuthn authenticators work this way other than password managers that don't want to be left out. Hopefully in the future OSs will…

Thanks for that info! Still just learning about this stuff.

Re: Passkeys: The beginning of the end of the password

#166

Post by sebk »

lxgr wrote: post #135

WebAuthN is great, but I can't help but feel that Passkeys are actually a step backwards. At least on iOS, there is no way of preventing them from being synced to iCloud, which is the opposite of what I want for high-stakes credentials like bank accounts or government e-signatures. I've tried to raise [1] a related issue (i.e. the inability for relying parties to opt out of credential syncing, if not an explicit requ…

For the client-side, the spec is comprehensive in allowing the authenticator to decide whether backups are allowed. In this case it's iOS not exposing that to you as a user. I get why you'd want this, but trusting Apple to store your single-device passkeys for high-stakes credentials but not trusting them for syncing them is somewhat of a very specific threat model I'd say, and definitely not in Apple's own interest to support, to your detriment.

RP-side, it's true that RPs can't opt out of credential syncing, but I think that would be weak at best, as the authenticator can do what it wants. The RP can use attestation and the DPK extension to effectively bind authentications to the same originating device.

Re: Passkeys: The beginning of the end of the password

#167

Post by lxgr »

admax88qqq wrote: post #156
lxgr wrote: post #142

Earlier quoted context omitted.

The difference is that I can choose my password manager on iOS (and thereby pick my desired security level for password synchronization or opt out of it completely), but not my Passkey synchronization backend: iOS forces these to be stored in iCloud Keychain. (Passkeys are unavailable without iCloud Keychain [1]!) Ideally, there would be a per-passkey UI option to opt out of synchronization at creation time. > Securi…

> The difference is that I can choose my password manager on iOS This is what you expect when you buy into the closed Apple ecosystem.

Yes, being able to choose my own password manager is indeed an important feature to me. I'm pretty sure that feature is not unique to closed platforms, though.

Re: Passkeys: The beginning of the end of the password

#168

Post by lxgr »

toomuchtodo wrote: post #155
lxgr wrote: post #142

Earlier quoted context omitted.

The difference is that I can choose my password manager on iOS (and thereby pick my desired security level for password synchronization or opt out of it completely), but not my Passkey synchronization backend: iOS forces these to be stored in iCloud Keychain. (Passkeys are unavailable without iCloud Keychain [1]!) Ideally, there would be a per-passkey UI option to opt out of synchronization at creation time. > Securi…

I agree there should be a way to opt out of system level ecosystem passkey sync with a big ol’ “you’re fucked if you don’t back these up somewhere” click through warning.

That's exactly what I want, ideally at a per-passkey level.

It should also be able for relying parties to express that desire (whether opt-in or opt-out by default). As it is, I think it'll just make banks and governments less likely to adopt passkeys.

That's sad, because all in all I think WebAuthN has the potential to have a very positive impact on security globally.

Re: Passkeys: The beginning of the end of the password

#169

Post by judge2020 »

ghancock wrote: post #110

I wrote about my experience with passkey support on other services here: https://news.ycombinator.com/item?id=35758918 . That experience was mostly negative. For anyone implementing this, the user experience matters and requires usability testing of a lot of combinations. In comparison to those, Google’s support seems better. It worked, was transparent about what was going on, and gave me the option to create the key…

> it just said I already had a registered key on this device

Is this Android? Because, before this change, there was no way to register a real WebAuthn-based passkey with Google, at least when I was trying with chrome (it did not prompt the webauthn popup, just the OS-native security key popup).

Re: Passkeys: The beginning of the end of the password

#170

Post by barkerja »

Gasp0de wrote: post #103
barkerja wrote: post #58

Earlier quoted context omitted.

Not if the Passkey was synced (ex: you used iCloud keychain). If the passkey was not synced, then I would have to assume it would be the same if you lost a physical hardware key.

How do you access iCloud without your passkey?

I use a yubikey. But AFAIK, Apple doesn't actually use passkeys for iCloud/Apple ID authentication.
Post reply on HN