Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Understanding Passkeys

michal.sapka.me

Post reply on HN
Print view View original

51–60 of 79 posts

Re: Understanding Passkeys

#51

Post by cxmcc »

tunesmith wrote: post #25

I'm just confused about the "something-you-know" aspect of this. From my understanding, in the US you can be legally forced to give your fingerprint, face scan, probably your retina scan, maybe your voice identification... these are all "things you have", more akin to "username". But a password is the "thing you know", the thing they can't take from you (discussions of torture and AI mind-reading aside). So is the id…

passkeys are often 2 factors but not necessarily something you know, examples:

- with macbook fingerprint sensor: something you have (private key on your device) and something you are (fingerprint)

- with yubikey without fingerprint: something you know (passcode, hopefully required) and something you have (private key on yubikey)

- with yubikey with fingerprint sensor: something you are (fingerprint, falling back to passcode which is something you know) and something you have (private key on yubikey)

Re: Understanding Passkeys

#52

Post by effie »

growse wrote: post #28
throw7 wrote: post #7

Is it the _goal_ of FIDO to get rid of passwords? If it is, I am against this industry group. Passwords should always be kept as a valid authentication method. The OP brings up a point about not having access to the private key... I agree with that. If I don't have access to the private key (like I currently do with ssh) then it's dead in the water to me.

> Passwords should always be kept as a valid authentication method Why? > If I don't have access to the private key (like I currently do with ssh) then it's dead in the water to me. You don't have 'access' to the private key for any well designed HSM either. And there's nothing in the passkey spec that says you need to put the private key in at inaccessible place.

> Why?

Because access by password provides unique abilities to the person who knows the password.

Re: Understanding Passkeys

#53

Post by JohnFen »

lukeschlather wrote: post #42
JohnFen wrote: post #38

Earlier quoted context omitted.

> fingerprint, face scan, probably your retina scan, maybe your voice identification Technically, those are "things you are", not "things you have". A Yubikey would be an example of a "thing you have". I think the ideal is that you're supposed to use a hardware key that uses a biometric like a fingerprint to unlock it. Then the passkey itself is the "thing you know", the hardware key is the "thing you have", and the…

A passkey is never a "thing you know." It is a "thing you have access to, which mostly behaves like a 'thing you have' but also your OS provider probably has it if they want it."

Well, we're deep into semantics now, but I think the passkey is "something you know". That you've chosen to offload your memory onto a device doesn't really change that.

But, honestly, this is a point of little importance. Almost all of the "something you..." categories are only a rough guide, and most items can arguably fall into more than one of them.

Re: Understanding Passkeys

#54

Post by tunesmith »

cxmcc wrote: post #51
tunesmith wrote: post #25

I'm just confused about the "something-you-know" aspect of this. From my understanding, in the US you can be legally forced to give your fingerprint, face scan, probably your retina scan, maybe your voice identification... these are all "things you have", more akin to "username". But a password is the "thing you know", the thing they can't take from you (discussions of torture and AI mind-reading aside). So is the id…

passkeys are often 2 factors but not necessarily something you know, examples: - with macbook fingerprint sensor: something you have (private key on your device) and something you are (fingerprint) - with yubikey without fingerprint: something you know (passcode, hopefully required) and something you have (private key on yubikey) - with yubikey with fingerprint sensor: something you are (fingerprint, falling back to…

But that's the whole point - yubikey with fingerprint, or any combination of things that exclude "something you know", opens you up to a whole set of vulnerabilities. Like "legal snooping"; that can't be done if you're protected with "something you know".

Re: Understanding Passkeys

#55

Post by JohnFen »

woodruffw wrote: post #47

A note on attestation, since that's a part of Passkeys (and Webauthn) that's frequently misunderstood: WebAuthn has a broad understanding of "attestation," including "self attestations"[1] and no attestations at all[2]. To the best of my knowledge, Passkeys do not impose any further constraints on attestations, meaning that compliant authenticators don't need to send any attestation at all. Relying parties can of cou…

My worry about attestation isn't that it will lead to vendor lock-in, it's that some services may choose to reject authenticators that don't attest that they're storing the keys in TPM or similar.

Re: Understanding Passkeys

#56

Post by noman-land »

JohnFen wrote: post #53
lukeschlather wrote: post #42

Earlier quoted context omitted.

A passkey is never a "thing you know." It is a "thing you have access to, which mostly behaves like a 'thing you have' but also your OS provider probably has it if they want it."

Well, we're deep into semantics now, but I think the passkey is "something you know". That you've chosen to offload your memory onto a device doesn't really change that. But, honestly, this is a point of little importance. Almost all of the "something you..." categories are only a rough guide, and most items can arguably fall into more than one of them.

As soon as you write something down it becomes something you have.

Re: Understanding Passkeys

#57

Post by tunesmith »

JohnFen wrote: post #53
lukeschlather wrote: post #42

Earlier quoted context omitted.

A passkey is never a "thing you know." It is a "thing you have access to, which mostly behaves like a 'thing you have' but also your OS provider probably has it if they want it."

Well, we're deep into semantics now, but I think the passkey is "something you know". That you've chosen to offload your memory onto a device doesn't really change that. But, honestly, this is a point of little importance. Almost all of the "something you..." categories are only a rough guide, and most items can arguably fall into more than one of them.

That's not really deep into semantics if it's the whole point. Something you know is by definition not externalized, and thus has a different type of security.

Re: Understanding Passkeys

#58

Post by roundandround »

JohnFen wrote: post #53
lukeschlather wrote: post #42

Earlier quoted context omitted.

A passkey is never a "thing you know." It is a "thing you have access to, which mostly behaves like a 'thing you have' but also your OS provider probably has it if they want it."

Well, we're deep into semantics now, but I think the passkey is "something you know". That you've chosen to offload your memory onto a device doesn't really change that. But, honestly, this is a point of little importance. Almost all of the "something you..." categories are only a rough guide, and most items can arguably fall into more than one of them.

If a passkey is something you know then you are using a failed implementation. A fido/authn device is supposed to be able to attest to never having let the private key out, even with a relaxation to passkeys it should at least be sending it to another device that can attest.

Re: Understanding Passkeys

#59

Post by JohnFen »

roundandround wrote: post #58
JohnFen wrote: post #53

Earlier quoted context omitted.

Well, we're deep into semantics now, but I think the passkey is "something you know". That you've chosen to offload your memory onto a device doesn't really change that. But, honestly, this is a point of little importance. Almost all of the "something you..." categories are only a rough guide, and most items can arguably fall into more than one of them.

If a passkey is something you know then you are using a failed implementation. A fido/authn device is supposed to be able to attest to never having let the private key out, even with a relaxation to passkeys it should at least be sending it to another device that can attest.

True, but I'm hoping that "failed implementation" is accepted, because the correct implementation is too burdensome for my taste.

Re: Understanding Passkeys

#60

Post by JohnFen »

noman-land wrote: post #56
JohnFen wrote: post #53

Earlier quoted context omitted.

Well, we're deep into semantics now, but I think the passkey is "something you know". That you've chosen to offload your memory onto a device doesn't really change that. But, honestly, this is a point of little importance. Almost all of the "something you..." categories are only a rough guide, and most items can arguably fall into more than one of them.

As soon as you write something down it becomes something you have.

I can't argue with that at all.
Post reply on HN