Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

361–370 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#361

Post by lxgr »

jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

How about: "Passkeys are digital keys that can be securely stored either in a physical device (such as a Yubikey) or in an online account (such as iCloud Keychain or Google Passwords)"?

Thinking about this some more, maybe we should start calling Yubikey etc. keyrings, rather than keys, given that they can store multiple independent passkeys securely?

Re: Passkeys: The beginning of the end of the password

#362

Post by lxgr »

laegooose wrote: post #308
TulliusCicero wrote: post #302

Earlier quoted context omitted.

This goes into more detail: https://developers.google.com/identity/passkeys As far as I can tell: it's a system of private keys stored on devices, in order to transmit a key you also need to unlock a device (e.g. phone) with some other method like a PIN or fingerprint/face scan. Combine those two things and it means a would-be hacker would need both the physical device as well as the local authentication for that dev…

Can it be uses on both Android and iOS? What about desktop machines with no fingerprint sensor or faceID? What happens if user loses the only device on which passkey was enrolled?

> Can it be uses on both Android and iOS?

Yes!

> What about desktop machines with no fingerprint sensor or faceID?

You can use a PIN, your login/screen lock password, or an external device offering a fingerprint sensor.

> What happens if user loses the only device on which passkey was enrolled?

You can either sync passkeys to an online account and across multiple devices, or use multiple passkeys stored in multiple physical authenticators.

Re: Passkeys: The beginning of the end of the password

#365

Post by lxgr »

angry_octet wrote: post #344
lxgr wrote: post #163

Earlier quoted context omitted.

Passkeys are an authentication mechanism, and as such replace (authentication) passwords, not (encryption) passphrases. A password (at least as I understand the term) is used to authenticate to some third-party entity to get access to your data or services. The (implied or legal) contract here is: "Only give access to my data to anybody that can provide my password." Government authorities can in most cases just go t…

This is incorrect because you’re conflating access by request and access with a court order. Without a warrant, or even probable cause, police can get some meta data, but not everything in the cloud. In many places police can force you to use biometrics to unlock devices, but not compel a passphrase. (Passphrases are significantly harder for e.g. Greykey to glitch brute force than PINs.)

What's "access by request"?

> Passphrases are significantly harder for e.g. Greykey to glitch brute force than PINs.

PINs are their own thing, i.e. neither passwords nor passphrases. They form a hierarchy:

Passphrases: High (enough) entropy; can be stretched into an encryption key using a PBKDF.

Passwords: Medium entropy; long enough to be somewhat brute-force resistant in case of a database breach. Can't really be used to encrypt data by themselves.

PINs: Very low entropy, must be part of a larger, trusted system that can reliably enforce limits on invalid PIN attempts. Practically, this means tamper-resistant hardware, e.g. a HSM, TPM, smartcard, Yubikey...

Re: Passkeys: The beginning of the end of the password

#366

Post by yeeeloit »

shadowgovt wrote: post #321
berkle4455 wrote: post #310

Earlier quoted context omitted.

It’s a password that Google controls so when they incorrectly ban you from their services you lose access to literally everything. Or if you drop your phone in a lake you’re out of luck too.

It's the second one, not the first one. The protocol is private key stored on your hardware; public on the service you're authing to. Google doesn't have a way to MITM that, but if you lose the machine storing the private key, best have another way to auth. (Note: some implementations, including Chrome on Android, do allow sync and sharing of the key, but IIUC even if Google bars you access to your account, the phone…

> the phone will still have the private key and can still do the login

One of the main gripes people have is about whether or not the user actually has access to the key or not.

ie. Can I save my passkey somewhere that I control, can I login on another device, etc. etc. Or do I need google's sync/account to do that for me.

Re: Passkeys: The beginning of the end of the password

#367

Post by rgrmrts »

My understanding of passkeys was that they replace passwords, but a few places where I’ve seen them implemented just use passkeys as a second factor, NOT a replacement for passwords themselves.

Can anyone who knows more about passkeys explain why this is the case? Are service providers just misusing passkeys as the second factor, or do I misunderstand passkeys?

Re: Passkeys: The beginning of the end of the password

#368

Post by JoshTko »

One weakness with passkeys is that a person can't login to an account with just information that they know. I.e. they need a authorised device. Given that devices can be lost, it seems that folks that only own one device should not use Passkeys. Most passkey users should probably have a minimum of three biometric enabled - authorized personal devices if they want to use passkeys. This might be the biggest roadblock to adoption as few have this many personal devices.

Re: Passkeys: The beginning of the end of the password

#369

Post by shortcake27 »

tialaramex wrote: post #330
Springtime wrote: post #225

> And, unlike passwords, passkeys are resistant to online attacks like phishing, making them more secure than things like SMS one-time codes. It's a bit disappointing seeing them re-affirm SMS as a a more vulnerable form for 2FA when Google's stance has been to try and force a phone requirement on Google accounts that lack them in order to login—and then using the phone for SMS 2FA. In the past number of years only a…

> In the past number of years only after a phone is attached do other 2FA methods like TOTP become accessible as options. I do always see these comments on HN and I think "Huh, really?" and I go check and, nope, Google doesn't have my phone number, but they do know I have security keys, so that's all working as intended.

I don’t have my phone number “registered” with Google. IE it does not appear in my account.

A few years back I was logging into a new machine from a known network. I provided the correct username, password, and TOTP on the first try. Google then forced me to authenticate further by providing my phone number _in the sign in flow_ to receive an SMS. This is pure theatre as I could have provided any number. No security was gained. Google does, however, now have my number. Even if it isn’t displayed on my account.

Re: Passkeys: The beginning of the end of the password

#370

Post by __MatrixMan__ »

mk89 wrote: post #357
jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

You need to click on the link that is in the post: https://blog.google/technology/safety-security/one-step-clos... > Instead, your phone will store a FIDO credential called a passkey which is used to unlock your online account. The passkey makes signing in far more secure, as it’s based on public key cryptography and is only shown to your online account when you unlock your phone. It looks like a token stored on your…

Why not call it a private key then, we've been handling those since the 70's.

They don't need to be rebranded, they need to be taught in high school with the same words we've always used to talk about them.

Post reply on HN