Passkeys: The beginning of the end of the password • Hacker News Board

Re: Passkeys: The beginning of the end of the password

#411

Post by taeric » Thu, May 04, 2023, 12:04 AM UTC

xg15 wrote: post #383

mk89 wrote: post #357

Earlier quoted context omitted.

You need to click on the link that is in the post: https://blog.google/technology/safety-security/one-step-clos... > Instead, your phone will store a FIDO credential called a passkey which is used to unlock your online account. The passkey makes signing in far more secure, as it’s based on public key cryptography and is only shown to your online account when you unlock your phone. It looks like a token stored on your…

I'm not completely sure, but my understanding is that it's basically the same principle as SSH keypairs, with the added twist that the user never gets direct access to the private keys. The keys are also per-device, so e.g. if you use your Google account from your phone, your laptop and your workplace PC, there would be three public keys associated with your account. Because the private key (in principle) doesn't eve…

Sounds like you are describing how hardware tokens are typically done? With this being an idea of how to move the token into the cloud?

I can kind of see the reasoning on why the browser wants to do this. Every one of them has a "generate secure password" feature bolted on, now. And I'm not clear that any of them have a way to port passwords out to another source.

Still feels a bit uneasy to me. Physical keys for property provide the kind of security that just doesn't cut it for virtual assets. Such that I'm having a hard time seeing any model without terrible failure cases. :( Super glad that isn't my day job. Good luck to them.

Re: Passkeys: The beginning of the end of the password

#412

Post by snowwrestler » Thu, May 04, 2023, 12:14 AM UTC

jamilton wrote: post #348

waboremo wrote: post #282

Earlier quoted context omitted.

Can you explain how passkeys explicitly reaches that end goal, when all of that is already currently possible without passkeys?

You can share passwords easily, I don't think you can trivially share passkeys.

You don’t need to share them because you can enroll more than one for a given account. So for example if 3 people are sharing an account, you can enroll 3 passkeys for that account and they each have their own access.

I don’t see any way that passkeys kill account sharing.

Re: Passkeys: The beginning of the end of the password

#413

Post by csomar » Thu, May 04, 2023, 12:14 AM UTC

I understand crypto/web3 are hated because of all the scams and NFTs out there. However, I worked on a web3 login implementation and I think it’s the best login/account experience out there. Basically, your private key is your password. You can use your phone, a browser extension or a hardware wallet (kind of the equivalent of a YubiKey).

It’s a pretty straightforward experience and it keeps the full ownership of the credentials to the user.

Re: Passkeys: The beginning of the end of the password

#414

Post by nitwit005 » Thu, May 04, 2023, 12:14 AM UTC

latchkey wrote: post #84

somedudetbh wrote: post #75

Earlier quoted context omitted.

> And just a daily reminder that biometrics are usernames, they are not passwords. I think you should stop giving out this daily reminder. This meme has outlived its usefulness. Using face id to unlock a local key store to enable my device to sign a signed challenge from a site I want to log into with the private key stored on my device is not a 'username' in any meaningful sense. The problem is, the metaphor about p…

> If my non-technical parents said they were migrating all their accounts to passkeys, I would be very pleased. I wouldn't be worried about their inability to change their biometrics My 76 yr old dad can't do it. His phone is some shitty android trash that when he's setting up his biometrics, he shakes a bit, and it never stores the finger data correctly. I have to hold his finger and his phone at the same time to ev…

It might not be that the android is crappy. Some people's fingerprints stop being readable as they age, and there are various injuries and diseases that have that result.

Essentially every biometric has a population they won't function well with.

Re: Passkeys: The beginning of the end of the password

#415

Post by shadowgovt » Thu, May 04, 2023, 12:15 AM UTC

brokenmachine wrote: post #404

shadowgovt wrote: post #328

Earlier quoted context omitted.

I'm actually going to set this up on my mother-in-law's machine next time I see her. She's forever losing her book of passwords, but always has her phone on her.

That'll be fun when she drops her phone in the toilet.

Then she's back to where she is now.

Re: Passkeys: The beginning of the end of the password

#416

Post by snowwrestler » Thu, May 04, 2023, 12:20 AM UTC

JohnFen wrote: post #382

dcow wrote: post #359

Earlier quoted context omitted.

I like to explain it like this: If you use a password manager today, then you're already essentially using something you have, because you need to be in possession of your login database to retrieve passwords, and nobody can remember that in their head. Passkeys is a formalization of the idea that you should be using a password manager where all the passwords are random uncrackable 32 character strings, and if we add…

> The generalized solution to this is allowing 3rd parties to be your passkey provider, so that you can choose how your passkeys are stored The password manager I use has no cloud component (which is why I chose it), and addresses this by allowing me to export my password collection to an encrypted backup file. Would this be a thing that the passkey folks would be OK with? That would ease a lot of my hesitation.

Yes you can just use a hardware FIDO token like a Yubikey as your passkey.

And you can enroll more than one, so if you lose or wreck one, you’re not locked out.

Re: Passkeys: The beginning of the end of the password

#417

Post by snowwrestler » Thu, May 04, 2023, 12:22 AM UTC

csomar wrote: post #413

I understand crypto/web3 are hated because of all the scams and NFTs out there. However, I worked on a web3 login implementation and I think it’s the best login/account experience out there. Basically, your private key is your password. You can use your phone, a browser extension or a hardware wallet (kind of the equivalent of a YubiKey). It’s a pretty straightforward experience and it keeps the full ownership of the…

This is how passkeys work

Re: Passkeys: The beginning of the end of the password

#418

Post by stanislavb » Thu, May 04, 2023, 12:25 AM UTC

jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

If people here can't understand what passkeys are, how are the "normies" gona get it? Or maybe the wide public is not supposed to get it how it works; they should "simply" use it.

Re: Passkeys: The beginning of the end of the password

#419

Post by Rufbdbskrufb473 » Thu, May 04, 2023, 12:27 AM UTC

dcow wrote: post #359

NikolaNovak wrote: post #345

Ignorant question: Are Passkeys, at some level of abstraction, permanently replacing "something you know" (password) with "something you have"? If I am in some kind of calamity (dropped my phone, got robbed, etc), and I come to a friendly person's house, it sounds to me like I simply would not be able to login to potentially critical services, no matter how much I know , because I don't have anything (the device that…

I like to explain it like this: If you use a password manager today, then you're already essentially using something you have, because you need to be in possession of your login database to retrieve passwords, and nobody can remember that in their head. Passkeys is a formalization of the idea that you should be using a password manager where all the passwords are random uncrackable 32 character strings, and if we add…

So can I set up a self-hosted solution?

I don't want to trust a 3rd party to be able to restore access to accounts after losing my phone. I've lost several Google and Yandex accounts that way. Despite knowing the passwords, they refused to let me log in again after loosing my phone.

Re: Passkeys: The beginning of the end of the password

#420

Post by scott00 » Thu, May 04, 2023, 12:28 AM UTC

jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

The passkey itself is an encryption key.

When you register a passkey to access a site, the component that holds the passkey generates a site-specific asymmetric encryption keypair. It then gives the site the (unencrypted) public key, and the private key encrypted with the passkey.

To authenticate, the site sends the client the encrypted private key and a challenge. The client uses the passkey to decrypt the private key, which it then uses to sign the challenge, then it sends the signature back to the site. The site verifies that the signature is valid and then lets you in.

A lot of what is interesting about passkeys is the supporting components that are available on popular platforms. Generally speaking, on client devices they store the passkey in special hardware so that the passkey itself is not available to the regular cpu. They also store it in the cloud, probably also in special hardware, and can send it to new client devices.

This all has some nice security properties, namely: * sites don't have any information that would be useful in gaining access to a different site (reduced blast radius when any given site is hacked) * the passkey is not available in the clear to regular programs running on client devices (hard for malware to steal) * The client software ensures that the passkey is very hard to guess. * The client software authenticates the site before signing the challenge. (makes it hard to phish)