Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys now support external providers

developer.apple.com

Post reply on HN
Print view View original

21–30 of 185 posts

Re: Passkeys now support external providers

#21

Post by gjulianm »

ljlolel wrote: post #19
ckastner wrote: post #10

Of all the recent publications with regards to passkeys, FIDO2, WebAuthn, etc., finally there's one with a simple and concise summary of the benefits: > Strong credentials. Every passkey is strong. They’re never guessable, reused, or weak. > Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers. > Safe from phishing. Passkeys are intrinsically linked with the app…

The last one is a problem for a lot of use cases. Lots of sites have different domains (also for example when HBO max renamed to max). Plaid also relies on entering bank passwords on neobank sites and is widely used.

AFAIK, passkeys aren't really linked to a domain. It's old-school public-key verification, the server stores your public key and uses it to verify the signature of a challenge they send to your device on login. As long as the different domains/apps can share the public key you should be able to login.

And for things like Plaid, I think banks are moving towards OAuth-style permissions, where you login to your bank and authorize the connection. Under the hood, Plaid or other app can connect to the bank with limited permissions using API authorization keys. It's a different problem, I think.

Re: Passkeys now support external providers

#22

Post by ElFitz »

ljlolel wrote: post #19
ckastner wrote: post #10

Of all the recent publications with regards to passkeys, FIDO2, WebAuthn, etc., finally there's one with a simple and concise summary of the benefits: > Strong credentials. Every passkey is strong. They’re never guessable, reused, or weak. > Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers. > Safe from phishing. Passkeys are intrinsically linked with the app…

The last one is a problem for a lot of use cases. Lots of sites have different domains (also for example when HBO max renamed to max). Plaid also relies on entering bank passwords on neobank sites and is widely used.

I’ve never understood Plaid. Given what they do, they can’t possibly encrypt the credentials they’re given, let alone hash them, can they?

And considering how most banks are set up, we are talking about the user’s only set of credentials. Which have the user’s permissions.

Then there are all these fintech startups saying that they’re secure because they use Plaid to access all your financial life, all to provide you with centralised analytics or supposed financial advice.

Sure it’s probably (one can hope) more secure than every single one of them rolling out their own hacked together equivalent. But still.

Am I missing something?

Re: Passkeys now support external providers

#23

Post by masklinn »

ElFitz wrote: post #22
ljlolel wrote: post #19

Earlier quoted context omitted.

The last one is a problem for a lot of use cases. Lots of sites have different domains (also for example when HBO max renamed to max). Plaid also relies on entering bank passwords on neobank sites and is widely used.

I’ve never understood Plaid. Given what they do, they can’t possibly encrypt the credentials they’re given, let alone hash them, can they? And considering how most banks are set up, we are talking about the user’s only set of credentials. Which have the user’s permissions. Then there are all these fintech startups saying that they’re secure because they use Plaid to access all your financial life, all to provide you…

I don’t think you are, plaid is a horrible and completely insecure work around banks not providing programmatic access.

I’m not sure how it even works with second factors (I’ve never looked).

Re: Passkeys now support external providers

#25

Post by squeaky-clean »

ElFitz wrote: post #22
ljlolel wrote: post #19

Earlier quoted context omitted.

The last one is a problem for a lot of use cases. Lots of sites have different domains (also for example when HBO max renamed to max). Plaid also relies on entering bank passwords on neobank sites and is widely used.

I’ve never understood Plaid. Given what they do, they can’t possibly encrypt the credentials they’re given, let alone hash them, can they? And considering how most banks are set up, we are talking about the user’s only set of credentials. Which have the user’s permissions. Then there are all these fintech startups saying that they’re secure because they use Plaid to access all your financial life, all to provide you…

If your bank doesn't use something like OAuth they do store your login credentials. If your bank does use OAuth or similar Plaid still has to store the access token, which hopefully your bank has given a read-only scope.

They can definitely encrypt the credentials, they just also have to make it simple for their backend to decrypt it when they need access to your bank, which defeats a lot of the security there. (It's still better than just storing it in plaintext).

https://support-my.plaid.com/hc/en-us/articles/4410324401047...

> In other cases, when you link a financial institution to an app via Plaid, you provide your login credentials to us. We store those credentials and use them to collect the data to power the services you’ve chosen and, when requested, securely share it with the app you’re using and establish a secure connection that you control. We then help keep your data safe and private with best-in-class encryption protocols.

Re: Passkeys now support external providers

#26

Post by tialaramex »

ljlolel wrote: post #19
ckastner wrote: post #10

Of all the recent publications with regards to passkeys, FIDO2, WebAuthn, etc., finally there's one with a simple and concise summary of the benefits: > Strong credentials. Every passkey is strong. They’re never guessable, reused, or weak. > Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers. > Safe from phishing. Passkeys are intrinsically linked with the app…

The last one is a problem for a lot of use cases. Lots of sites have different domains (also for example when HBO max renamed to max). Plaid also relies on entering bank passwords on neobank sites and is widely used.

Sure, the Big Boss will be extremely annoyed. Thanks to their innovative branding strategy they've grown New Brand from $0 to $150M revenue in just the first year of operation, a huge success. Did it cannibalise customers from Old Brand, which was $180M revenue and now is just $1M of residual revenue on its way to closing down? Sure, but don't do arithmetic, focus on the tremendous leadership.

If authentication systems, like customers, think New Brand is just pointlessly confusing because it's different from Old Brand for no good reason, that undermines Big Boss's amazing strategy and makes it look like something a toddler would try, and that's not OK.

However the nice thing when you have players like Google is that their technical people have got license from above to say "Fuck off" on technical issues without somebody who doesn't know the first thing about it overruling them because their golf buddy asked them to. So you're not going to see a way to override this behaviour and thus allow phishing even though I'm sure HBO execs would think that's fine.

In terms of practical effect, what that means is that when they use WebAuthn outfits like HBO end up needing to keep login.old-brand.example working, even though supposedly old-brand.example was a completely different product and is now dead, because that's how users actually log into new-brand.example as they are in reality the exact same product.

Re: Passkeys now support external providers

#27

Post by squeaky-clean »

masklinn wrote: post #23
ElFitz wrote: post #22

Earlier quoted context omitted.

I’ve never understood Plaid. Given what they do, they can’t possibly encrypt the credentials they’re given, let alone hash them, can they? And considering how most banks are set up, we are talking about the user’s only set of credentials. Which have the user’s permissions. Then there are all these fintech startups saying that they’re secure because they use Plaid to access all your financial life, all to provide you…

I don’t think you are, plaid is a horrible and completely insecure work around banks not providing programmatic access. I’m not sure how it even works with second factors (I’ve never looked).

If you have 2 factor enabled for each login you get told your account settings are incompatible with Plaid and have to disable 2fah. If it's only enabled for first time logins on a new browser/client Plaid ask you for the code.

https://support-my.plaid.com/hc/en-us/articles/9098915502999...

I don't know for sure how they do it, but it must just be a thousand custom forms and browser automations for each bank they support. And have to be updated whenever the bank updates.

Re: Passkeys now support external providers

#28

Post by xmdx »

Is the whole idea of syncing passkeys a bad idea? Or at least a less secure idea. Someone explained to me that passkeys are hardware backed, each passkey is stored on device and tied to the hardware, so even if someone managed to get access to it, they would also need the hardware to get it to work. These software based keys that can be synced are less secure as a result. Then it just becomes like a password again.

I need to read up a bit more on passkeys in general tbh.

Re: Passkeys now support external providers

#29

Post by tialaramex »

gjulianm wrote: post #21
ljlolel wrote: post #19

Earlier quoted context omitted.

The last one is a problem for a lot of use cases. Lots of sites have different domains (also for example when HBO max renamed to max). Plaid also relies on entering bank passwords on neobank sites and is widely used.

AFAIK, passkeys aren't really linked to a domain. It's old-school public-key verification, the server stores your public key and uses it to verify the signature of a challenge they send to your device on login. As long as the different domains/apps can share the public key you should be able to login. And for things like Plaid, I think banks are moving towards OAuth-style permissions, where you login to your bank and…

> AFAIK, passkeys aren't really linked to a domain. It's old-school public-key verification, the server stores your public key and uses it to verify the signature of a challenge they send to your device on login. As long as the different domains/apps can share the public key you should be able to login.

In principle the fancier systems with a user interface could add a feature where you can change the DNS names associated with a key it's storing. That sounds like a monumental pain in the backside, and of course the primary consequence would be it increases phishing because now your users can be tricked into allowing it - but sure, they could do that.

For simpler devices like a Yubico Security Key, there is no such interface, they aren't storing any keys so there's no way to make such an association. The keys are bound to the DNS name and are actually stored (encrypted) by the sites you're actually authenticating to. So without a matching DNS name they're intentionally just useless nonsense.

Re: Passkeys now support external providers

#30

Post by stavros »

xmdx wrote: post #28

Is the whole idea of syncing passkeys a bad idea? Or at least a less secure idea. Someone explained to me that passkeys are hardware backed, each passkey is stored on device and tied to the hardware, so even if someone managed to get access to it, they would also need the hardware to get it to work. These software based keys that can be synced are less secure as a result. Then it just becomes like a password again. I…

It is less secure, but more convenient. You can pick either option. Or you can have both with delegation ("your husband is trying to log in as you on www.google.com, allow?").
Post reply on HN