Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

321–330 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#321

Post by shadowgovt »

berkle4455 wrote: post #310
jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

It’s a password that Google controls so when they incorrectly ban you from their services you lose access to literally everything. Or if you drop your phone in a lake you’re out of luck too.

It's the second one, not the first one.

The protocol is private key stored on your hardware; public on the service you're authing to. Google doesn't have a way to MITM that, but if you lose the machine storing the private key, best have another way to auth.

(Note: some implementations, including Chrome on Android, do allow sync and sharing of the key, but IIUC even if Google bars you access to your account, the phone will still have the private key and can still do the login).

Re: Passkeys: The beginning of the end of the password

#322

Post by [deleted] »

TulliusCicero wrote: post #302
JustSomeNobody wrote: post #297

Earlier quoted context omitted.

Thank you. I've been trying to figure out what they hell they are and have been unsuccessful. I thought it was just me.

This goes into more detail: https://developers.google.com/identity/passkeys As far as I can tell: it's a system of private keys stored on devices, in order to transmit a key you also need to unlock a device (e.g. phone) with some other method like a PIN or fingerprint/face scan. Combine those two things and it means a would-be hacker would need both the physical device as well as the local authentication for that dev…

[deleted]

Re: Passkeys: The beginning of the end of the password

#323

Post by mrb »

Dalewyn wrote: post #312
jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

Passwords will never be supplanted unless the new challenger can satisfy all of the following: * Easy to understand. (A password is just a word/phrase/string of characters only you know.) * Easy to use. (Using a password only requires remembering and typing it in when prompted.) * Convenient. (Only your ability to remember and type required. No other tools or gadgets required.) * Simple. (All of the above.) If someth…

Passwords will never be supplanted? As always, it's a false dichotomy. Passwords will continue to be useful for some scenarios, but in others they will and are being replaced by other methods such as biometrics, U2F tokens, etc

Re: Passkeys: The beginning of the end of the password

#325

Post by [deleted] »

jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

[deleted]

Re: Passkeys: The beginning of the end of the password

#326

Post by jmholla »

alberth wrote: post #145

Dumb questions: 1. what's the backup login mechanism when you lose your mobile device? 2. with Passkeys enabled/used, will this stop google from randomly locking my account because I happen to be a person who travels a lot and they constantly think I'm a fraudster attempting to log into my own account. 3a. can I use my google passkey for logging into non-Google sites? 3b. can I use my google passkey (biometric) to lo…

Here's what Google has to say [0]:

> Passkeys use public key cryptography. Public key cryptography reduces the threat from potential data breaches. When a user creates a passkey with a site or application, this generates a public–private key pair on the user's device. Only the public key is stored by the site, but this alone is useless to an attacker. An attacker can't derive the user's private key from the data stored on the server, which is required to complete authentication. > Because passkeys are bound to a website or app's identity, they're safe from phishing attacks. The browser and operating system ensure that a passkey can only be used with the website or app that created them. This frees users from being responsible for signing in to the genuine website or app.

Two is already handled by a good password manager (which every announcement of passkeys leaves out), so the real benefits are in one. Instead of providing the same password each time, you prove that you have your private key in a way only that website (or whatever holds the public key) can ask.

Among the many issues, I think the biggest is that this functionality is being locked behind these large corporations as gate keepers. Is anyone aware of any open source, self-hostable work to provide passkey functionality?

It seems to me not all of it could be since some implementations will require that you prove your private key is stored by a special chips that can be attested which you necessarily can't muck with or reproduce (at least without a lot of effort and maybe running afoul of laws). And there's nothing that guarantees that your keys can be take elsewhere unlike passwords which you can do whatever you want with.

Something else to keep in mind, when they talk about the guarantees of passkeys, they're talking about several other layers of technology. That's why password managers already offer a lot of the security being touted.

[0]: https://developers.google.com/identity/passkeys

Re: Passkeys: The beginning of the end of the password

#327

Post by red_trumpet »

jefftk wrote: post #204
red_trumpet wrote: post #195

Earlier quoted context omitted.

Yes, I understand how phishing with 2fa works. But to me, passkeys sound like 2fa with your fingerprint/smartphone PIN? What's actually different there?

The difference is in step 4. With SMS or one-time code 2FA (or passwords) you're just entering text into a website, and nothing verifies you're interacting with the right website. With passkeys or FIDO tokens, though, there's a cryptographic protocol that considers the domain: your fingerprint/PIN isn't sent to the website.

So, evil.example tries to log in and triggers the passkey thing on my smartphone. My smartphone asks "Do you want to log in to good.example?" Because I'm currently being phished and didn't pay attention to the URL "evil.example" anyway, I will confirm this on my smartphone and evil.example is granted access to my account. I don't see how this is more phishing resistant than current 2fa. How can my smartphone know whether I'm interacting with the correct website on my laptop?

Re: Passkeys: The beginning of the end of the password

#328

Post by shadowgovt »

Dalewyn wrote: post #312
jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

Passwords will never be supplanted unless the new challenger can satisfy all of the following: * Easy to understand. (A password is just a word/phrase/string of characters only you know.) * Easy to use. (Using a password only requires remembering and typing it in when prompted.) * Convenient. (Only your ability to remember and type required. No other tools or gadgets required.) * Simple. (All of the above.) If someth…

I'm actually going to set this up on my mother-in-law's machine next time I see her. She's forever losing her book of passwords, but always has her phone on her.

Re: Passkeys: The beginning of the end of the password

#330

Post by tialaramex »

Springtime wrote: post #225

> And, unlike passwords, passkeys are resistant to online attacks like phishing, making them more secure than things like SMS one-time codes. It's a bit disappointing seeing them re-affirm SMS as a a more vulnerable form for 2FA when Google's stance has been to try and force a phone requirement on Google accounts that lack them in order to login—and then using the phone for SMS 2FA. In the past number of years only a…

> In the past number of years only after a phone is attached do other 2FA methods like TOTP become accessible as options.

I do always see these comments on HN and I think "Huh, really?" and I go check and, nope, Google doesn't have my phone number, but they do know I have security keys, so that's all working as intended.

Post reply on HN