Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys now support external providers

developer.apple.com

Post reply on HN
Print view View original

11–20 of 185 posts

Re: Passkeys now support external providers

#11

Post by drtgh »

oulipo wrote: post #5

Interesting, but can someone tell us what this implies wrt. authorities? If someone gets your iPhone and forces you to press your finger on the TouchID, he gets all your passwords no? While with a general master password you could just pretend to have forgotten it?

Whichever way you look at it, in every sense, password managers are a really bad, bad idea.

Besides that, it is not needed to force you to press your finger; the delinquent needs only to have access to the device for to fool the sensor with a brute force, 2 hours in the worse of the cases with the simplest techniques. Although its easier to take your finger prints from a glass or something you used for to avoid the wait, or directly cut your finger if its a psychopathic criminal.

And in all the cases, once your fingerprint gets public it gets compromised until the end of the times, of course, you can not "change the passw".

This without talking about software infection with a remote attack.

Re: Passkeys now support external providers

#13

Post by Lukas_Skywalker »

drtgh wrote: post #11
oulipo wrote: post #5

Interesting, but can someone tell us what this implies wrt. authorities? If someone gets your iPhone and forces you to press your finger on the TouchID, he gets all your passwords no? While with a general master password you could just pretend to have forgotten it?

Whichever way you look at it, in every sense, password managers are a really bad, bad idea. Besides that, it is not needed to force you to press your finger; the delinquent needs only to have access to the device for to fool the sensor with a brute force, 2 hours in the worse of the cases with the simplest techniques. Although its easier to take your finger prints from a glass or something you used for to avoid the w…

I would argue that password managers are not a "in every sense a really bad, bad idea" for a lot of reasons.

Let's look at password reuse for example. As soon as you have more than a few dozen logins, the possibilities are mostly either reusing one or few passwords, or writing them down.

Reusing is objectively bad, and for writing them down, the password manager makes it easy to use a really long and random password, which would make it tedious to write down.

Re: Passkeys now support external providers

#14

Post by riffraff »

ttul wrote: post #3

This is a smart move by Apple. Authentication infrastructure is necessarily cross platform. It doesn’t generate revenue for Apple, but the lack of cross platform auth would limit enterprise adoption of Apple products.

> It doesn’t generate revenue for Apple,

but it creates lock-in, if all your credentials are in a iCloud keychain, you're encouraged to get a phone that can sync with your ipad, laptop, and desktop.

Manually find and re-sync your stuff from firefox-on-desktop to chrome-on-mobile to safari-on-ipad is a major PITA.

Re: Passkeys now support external providers

#15

Post by Hamuko »

francislavoie wrote: post #9

That's great to see! I just tried out 1Password's beta browser extension which has passkeys support, and the UX is super seamless. Played around with it on https://www.passkeys.io/ I'm really hopeful about this, a lot more than any of the previous iterations of the FIDO stuff. I worked at a company that was an early adopter/implementer of the original FIDO U2F spec, and it had major UX problems, enough that I couldn'…

I did a WebAuthn implementation at work and the UX for WebAuthn was fucking awful. Especially on macOS, every browser had a completely separate implementation of WebAuthn, and if you used the Touch ID as a WebAuthn device, you basically could not see it anywhere and deleting it was also a pain in the ass. On Chrome, you basically had to just delete all of your passwords for the last N days to get rid of them.

On Windows, I think all browsers handled it centrally with Windows Hello, but even there the WebAuthn devices just kinda disappear into the ether once you register them, and deleting them had to be done through the command-line. There were also weird ass bugs where the UI would behave completely differently depending on whether or not you had Windows Hello login in use, so websites would need to engineer around it.

Haven't played around with passkeys key, but I imagine the only direction to go is up.

Re: Passkeys now support external providers

#16

Post by francislavoie »

Hamuko wrote: post #15
francislavoie wrote: post #9

That's great to see! I just tried out 1Password's beta browser extension which has passkeys support, and the UX is super seamless. Played around with it on https://www.passkeys.io/ I'm really hopeful about this, a lot more than any of the previous iterations of the FIDO stuff. I worked at a company that was an early adopter/implementer of the original FIDO U2F spec, and it had major UX problems, enough that I couldn'…

I did a WebAuthn implementation at work and the UX for WebAuthn was fucking awful. Especially on macOS, every browser had a completely separate implementation of WebAuthn, and if you used the Touch ID as a WebAuthn device, you basically could not see it anywhere and deleting it was also a pain in the ass. On Chrome, you basically had to just delete all of your passwords for the last N days to get rid of them. On Wind…

Yeah. With 1Password it's just another item like a password, but named "passkey". And in the browser when you set it up or use it, you get a little overlay on the website in the top-right and you click on it. That's it. Super simple, no faff, full visibility.

Re: Passkeys now support external providers

#17

Post by misnome »

drtgh wrote: post #11
oulipo wrote: post #5

Interesting, but can someone tell us what this implies wrt. authorities? If someone gets your iPhone and forces you to press your finger on the TouchID, he gets all your passwords no? While with a general master password you could just pretend to have forgotten it?

Whichever way you look at it, in every sense, password managers are a really bad, bad idea. Besides that, it is not needed to force you to press your finger; the delinquent needs only to have access to the device for to fool the sensor with a brute force, 2 hours in the worse of the cases with the simplest techniques. Although its easier to take your finger prints from a glass or something you used for to avoid the w…

> Whichever way you look at it, in every sense, password managers are a really bad, bad idea.

Okay, how about, the actual problem they solved: Reusing a single, simple password on every site, shared behind an email login.

That doesn’t sound like a really, really bad idea.

Re: Passkeys now support external providers

#18

Post by vladvasiliu »

francislavoie wrote: post #9

That's great to see! I just tried out 1Password's beta browser extension which has passkeys support, and the UX is super seamless. Played around with it on https://www.passkeys.io/ I'm really hopeful about this, a lot more than any of the previous iterations of the FIDO stuff. I worked at a company that was an early adopter/implementer of the original FIDO U2F spec, and it had major UX problems, enough that I couldn'…

> who the heck would carry a USB key with them??

> but with this, synced to your password manager of choice, that's A LOT better

While I agree with your general point that passkeys are great, I strongly disagree with these specific points. It's much easier for me to carry a small usb-key everywhere than it is to carry a big-ass phone (I often leave it at home) or my own computer.

With a yubikey on my keychain, I can log into my company's AzureAD from any computer. In a pinch, this also works on a phone if it has an NFC reader. It used to work fine on my iphone 7.

Another use case is specifically not wanting anything company-related on my own computing device. My personal phone isn't enrolled in the company's AzureAD, I don't have their 1passwork vault there, etc.

Re: Passkeys now support external providers

#19

Post by ljlolel »

ckastner wrote: post #10

Of all the recent publications with regards to passkeys, FIDO2, WebAuthn, etc., finally there's one with a simple and concise summary of the benefits: > Strong credentials. Every passkey is strong. They’re never guessable, reused, or weak. > Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers. > Safe from phishing. Passkeys are intrinsically linked with the app…

The last one is a problem for a lot of use cases. Lots of sites have different domains (also for example when HBO max renamed to max).

Plaid also relies on entering bank passwords on neobank sites and is widely used.

Re: Passkeys now support external providers

#20

Post by francislavoie »

vladvasiliu wrote: post #18
francislavoie wrote: post #9

That's great to see! I just tried out 1Password's beta browser extension which has passkeys support, and the UX is super seamless. Played around with it on https://www.passkeys.io/ I'm really hopeful about this, a lot more than any of the previous iterations of the FIDO stuff. I worked at a company that was an early adopter/implementer of the original FIDO U2F spec, and it had major UX problems, enough that I couldn'…

> who the heck would carry a USB key with them?? > but with this, synced to your password manager of choice, that's A LOT better While I agree with your general point that passkeys are great, I strongly disagree with these specific points. It's much easier for me to carry a small usb-key everywhere than it is to carry a big-ass phone (I often leave it at home) or my own computer. With a yubikey on my keychain, I can…

I'm talking about the "personal use" usecase and not the professional/business usecase. I agree with the value of security keys as being a physical token with low/no risk of leaking. But for personal use there's no way I can make that work for me day-to-day, even less of a chance I could get my parents bought-in on that idea. And I've tried, as someone who actually developed software to interface with this tech directly. I always have my phone with me, but if not, I can always login to my cloud-synced password manager in a pinch. (Worth mentioning, I don't have the same paranoia as some regarding cloud-synced vaults when done right, big reason I left that aforementioned company).
Post reply on HN