Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

191–200 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#191

Post by falcolas »

judge2020 wrote: post #129
falcolas wrote: post #102

Auth is as secure as the weakest link - in the case of this it's your email and/or customer service To put it another way, it's not really any more secure than passwords. Sure, there's a lower risk of password breaches, but if you're the target audience for passkeys, you probably also use a password manager with unique passwords per site (even if that manager is the one built into your browser and synced across your…

> but if you're the target audience for passkeys This is the difference. With the big players pushing it, including Apple instructing developers on the best way to integrate passkeys in their apps[0], it's going to overall shift more people from passwords to passkeys (especially when developers prioritize passkeys during signup). 0: https://developer.apple.com/documentation/authenticationserv...

I have... doubts. Already webauthn isn't prompting for passkeys on Apple. Chrome wants a bluetooth connection out of the box, and firefox does its own internal auth path that doesn't involve the OS.

Chrome and Edge on Windows are the only ones that prompt me for passkeys today (Firefox tries to use Windows for auth, which throws up a scary prompt).

Re: Passkeys: The beginning of the end of the password

#192

Post by michaelt »

lxgr wrote: post #153
segmondy wrote: post #41

I'm still salty about this. Called it passkey too. http://www.multipasskey.com/susdemo/ . Built this 5-6yrs ago and applied to YC. Crickets. Hope to see this take off, with my approach I made it where you don't even need to "register", you can go to a site and just have an account. I did the fingerprint, face scan, PIN approach for more security, but my favorite was NFC ring. Basically you have an NFC ring you wear o…

> use this to tether and lock you in to their platform. You could say this about Google's proprietary authenticator app in the past, but now that they support Passkeys, arguably the opposite is true. Importantly, you can now (with FIDO CTAP 2.2 and tunnel services [1]) use an out-of-platform Passkey to log into your account cross-device, e.g. you can use an iOS Passkey to log into an account on a Windows Chrome insta…

The article says "Instead, passkeys let users sign in to apps and sites the same way they unlock their devices: with a fingerprint, a face scan or a screen lock PIN."

Does that not rather imply that, if I log in with faceid on an iphone, my login will be tied to my ability to faceid on an iphone, and hence only available on iphones and macs?

As a user, that's sounding a lot like platform lock-in to me.

And as a developer, if I want a way for users to log in without a password, and I don't mind that login mechanism being reliant on the user's account with apple / google / microsoft - wouldn't I just add a 'log in with apple / google / microsoft' button to my login page?

Re: Passkeys: The beginning of the end of the password

#193

Post by petedoyle »

015a wrote: post #143
petedoyle wrote: post #113

Earlier quoted context omitted.

This has been bothering me, a lot. Google talks [1] about how Passkey replication is e2e encrypted between devices, but AFAICT they're just using a pin + key derivation. A six digit pin is like 20 bits of entropy before a KDF. [2] Has anyone seen any docs that might help characterize how much entropy the keys have for e2e encryption (Android/iOS)? I must be missing something, because I can't see how Google would call…

Sure, but if that key derivation function is protected by a "you get 10 attempts then we wipe the keys" safeguard, the effective entropy is much higher. The question shouldn't really surround the effective entropy of the PIN, but rather the systems in-place to protect bypassing safeguards in the key derivation function which render the actual entropy of the PIN irrelevant. There probably isn't no way around that safe…

> Sure, but if that key derivation function is protected by a "you get 10 attempts then we wipe the keys" safeguard, the effective entropy is much higher.

Thank you. 100% agree.

> Passkeys do not and are not designed to protect against nation-state level attackers

I've been mulling over some use-cases where this is important, hence the deep consideration over entropy. 100% not a huge deal for the passkeys case for many 9's of people.

Re: Passkeys: The beginning of the end of the password

#194

Post by hedora »

lxgr wrote: post #158
alberth wrote: post #145

Dumb questions: 1. what's the backup login mechanism when you lose your mobile device? 2. with Passkeys enabled/used, will this stop google from randomly locking my account because I happen to be a person who travels a lot and they constantly think I'm a fraudster attempting to log into my own account. 3a. can I use my google passkey for logging into non-Google sites? 3b. can I use my google passkey (biometric) to lo…

> 1. what's the backup login mechanism when you lose your mobile device? Passkeys are synced to the cloud by default on iOS and Android, which is probably a good idea for many use cases, but might not be what you want in some instances. > will this stop google from randomly locking my account because I happen to be a person who travels a lot and they constantly think I'm a fraudster attempting to log into my own acco…

Like the commenter you are responding to, I still don't understand how any of this can possibly work in practice.

> Passkeys are synced to the cloud by default on iOS and Android, which is probably a good idea for many use cases, but might not be what you want in some instances.

OK, so how do I use my cloud synced passkey to log on to my Google account (which no longer has a password or other secret that I can back up locally) after I lose my phone?

> Probably not, but it will make it much easier to log back in – you won't even need to type your password if you use a 2FA-capable authenticator/passkey.

OK, but if the account is locked, that just gets them to display the "you're screwed" screen faster (since they don't need to wait for me to type a password), and the blast radius goes from just my Google account to all my other accounts, right?

Re: Passkeys: The beginning of the end of the password

#195

Post by red_trumpet »

jefftk wrote: post #50
red_trumpet wrote: post #42

> passkeys are resistant to online attacks like phishing, making them more secure than things like SMS one-time codes. What is the scenario in which SMS one-time codes are prone to fishing, but passkeys are not?

1. You're tricked into visiting evil.example and don't realize it. 2. evil.example: confirm 2fa code to log in. 3. evil.example starts logging into good.example as you, triggering good.example to send the 2fa code. 4. You see the 2fa code and enter it into evil.example. 5. evil.example has phished your 2fa code. This doesn't work with passkeys (or 2fa tokens) because those verify the domain matches.

Yes, I understand how phishing with 2fa works. But to me, passkeys sound like 2fa with your fingerprint/smartphone PIN? What's actually different there?

Re: Passkeys: The beginning of the end of the password

#196

Post by garganzol »

toomuchtodo wrote: post #17
TheChaplain wrote: post #9

And if you have your google account banned/disabled for whatever reason, then what?

Passkeys should still be on your local device. Account recovery should fall back to e-mail magic link or government credential proofing (depending on data sensitivity and threat model). (manages customer IAM for a FinTech)

And when that last device dies in an accident or force major, what's next? Proofing won't work because if the solution is really as secure as it should be then neither party can have access in an unencrypted form.

Re: Passkeys: The beginning of the end of the password

#197

Post by voxic11 »

michaelt wrote: post #192
lxgr wrote: post #153

Earlier quoted context omitted.

> use this to tether and lock you in to their platform. You could say this about Google's proprietary authenticator app in the past, but now that they support Passkeys, arguably the opposite is true. Importantly, you can now (with FIDO CTAP 2.2 and tunnel services [1]) use an out-of-platform Passkey to log into your account cross-device, e.g. you can use an iOS Passkey to log into an account on a Windows Chrome insta…

The article says "Instead, passkeys let users sign in to apps and sites the same way they unlock their devices: with a fingerprint, a face scan or a screen lock PIN." Does that not rather imply that, if I log in with faceid on an iphone, my login will be tied to my ability to faceid on an iphone, and hence only available on iphones and macs? As a user, that's sounding a lot like platform lock-in to me. And as a devel…

No passkeys are just normal private keys. You can store those private keys in a particular platform's secure key store which on phones can be decrypted/made usable when you unlock the device. But there is nothing stopping you from transferring these keys to a different device if you wish.

Re: Passkeys: The beginning of the end of the password

#199

Post by bb88 »

jrm4 wrote: post #146
somedudetbh wrote: post #75

Earlier quoted context omitted.

> And just a daily reminder that biometrics are usernames, they are not passwords. I think you should stop giving out this daily reminder. This meme has outlived its usefulness. Using face id to unlock a local key store to enable my device to sign a signed challenge from a site I want to log into with the private key stored on my device is not a 'username' in any meaningful sense. The problem is, the metaphor about p…

It's 100% accurate. And I get why it may not seem helpful, but I think this is simply due to this industry trying too hard to cater to people who want things to be 6-year-old level easy. Security is HARD. There's no getting around that. Your data is valuable and protecting it is not an easy task. At some level, security and convenience is a zero-sum game. As for old people, my dad writes down his passwords on a text…

> It's 100% accurate.

No it's not.

The security triad is "something you are", "something you know", and "something you have". Fingerprints are something you are. Usernames are something you claim to be.

The username is the "claim" you are this person. The password is the "proof" you are.

If I'm fingerprinted by any federal agency today (and my fingerprints have been on file with the government since the 90's for a security clearance), then my fingerprints can serve as absolute proof of my identity. This is helpful to me should my identity ever be stolen and I need to show absolute proof of who I am.

Re: Passkeys: The beginning of the end of the password

#200

Post by lxgr »

hedora wrote: post #194
lxgr wrote: post #158

Earlier quoted context omitted.

> 1. what's the backup login mechanism when you lose your mobile device? Passkeys are synced to the cloud by default on iOS and Android, which is probably a good idea for many use cases, but might not be what you want in some instances. > will this stop google from randomly locking my account because I happen to be a person who travels a lot and they constantly think I'm a fraudster attempting to log into my own acco…

Like the commenter you are responding to, I still don't understand how any of this can possibly work in practice. > Passkeys are synced to the cloud by default on iOS and Android, which is probably a good idea for many use cases, but might not be what you want in some instances. OK, so how do I use my cloud synced passkey to log on to my Google account (which no longer has a password or other secret that I can back u…

> […] how do I use my cloud synced passkey to log on to my Google account (which no longer has a password or other secret that I can back up locally) after I lose my phone?

You don't, in the same way that you can't store the password to your password manager in your password manager. That's why having another way to log back in to your Passkey sync/backup account is crucial.

> OK, but if the account is locked, that just gets them to display the "you're screwed" screen faster (since they don't need to wait for me to type a password), and the blast radius goes from just my Google account to all my other accounts, right?

If you lose both access to your Google account and all of your devices that have your Passkeys locally synchronized, yes. The same goes for somebody taking over one synchronized device and remotely deleting all of your passkeys before you can take another device offline.

I'm personally pretty skeptical of passkey synchronization by default without a way to opt out, but I can see how availability might be just as big a concern for most non-technical users as security.

Post reply on HN