41–50 of 316 posts
Slightly off topic: did Apple just make it super easy for law enforcement to unlock your phone & passkeys as part of iOS 17?
> ”Apple ID. Securely sign in to your iPhone using a nearby device or any email address or phone number listed in your account.”
Like many round trips we have made, I suspect in the year 2035, we’ll look back and say to ourselves: “Yeah, password was super based. Just copy paste it in the box and you’re logged in. Can store it anywhere, even in a notebook. Safekeep it by printing them. No need for HyperBigTechCorp. Portable. Those gray beards had it right the whole time.” Can we please stop the bandwagon for a moment and inquire about the down…
How do you bootstrap it? You get robbed at gunpoint by some ruffians and they take your wallet, cellphone, keys, and laptop. Hopefully they can't get into your accounts, but never mind that, how do you get back in to everything?
This isn't that uncommon. Things like disk encryption also do this (e.g. bitlocker)
This sounds counter productive. Third party authentication providers are a single point of failure, and usually they themselves require a password to authenticate you anyway. If your gmail password is hacked, then effectively all your accounts on websites that use Google auth are also hacked. Passkeys appear to also be handled by central services? At least that appears to be the case with Apple, according to the link…
I don't think it is true that passkeys require a third party, but can someone else confirm?
Earlier quoted context omitted.
e2e encryption is one forced update away from being plain text.
I trust big tech companies more than I trust startups or smaller tech companies. I have faith that neither Apple nor Google would do that. This is a personal belief based on chatting with Apple and Google employees. You don't have to agree.
Like many round trips we have made, I suspect in the year 2035, we’ll look back and say to ourselves: “Yeah, password was super based. Just copy paste it in the box and you’re logged in. Can store it anywhere, even in a notebook. Safekeep it by printing them. No need for HyperBigTechCorp. Portable. Those gray beards had it right the whole time.” Can we please stop the bandwagon for a moment and inquire about the down…
How do you bootstrap it? You get robbed at gunpoint by some ruffians and they take your wallet, cellphone, keys, and laptop. Hopefully they can't get into your accounts, but never mind that, how do you get back in to everything?
Earlier quoted context omitted.
Passkeys are WebAuthn under the hood; they don't store your credentials with a large company any more than using a hardware token stores your credentials with Yubikey. Apple does some additional trickery to synchronize credentials between devices, but they get away with this because their devices have contained dedicated silicon for sensitive data management for years[1]. They have some user-facing documentation on h…
Apple can synchronize the passkey between devices. As far as I understand I cannot. So I don't really understand how this can be said to be a hardware security token. It seems pretty clear that it is as far as I am concerned, but that Apple has nothing constraining them from copying my passkeys. Which seems like the worst of both worlds.
No one claimed it's a hardware security token, but the private keys are stored in iCloud Keychain, which is end-to-end encrypted. Apple cannot access your private keys even if iCloud is compromised by an external attacker or employee.
If you're curious about the security engineering, you should watch the "Synchronizing secrets" part of this Black Hat talk from 2016: https://youtu.be/BLGFriOKz6U?t=1353 or you should read the "Synchronization security" section of the "About the security of passkeys" support doc: https://support.apple.com/en-us/HT213305
Auto-generated password via a password manager are more secure, convenient, and portable then passkeys and oidc.
While they can be designed to have the secrets cloud synced (just lile how you can sync your ssh private keys), there's nothing preventing them from being implemented in other ways, like having them backed by a third party password manager or even a pyhsical token like a yubikey.
Of course, this depends on the software (OS, browsers) actually respecting and supporting that interoperability. But that's not really a limitation of the underlying tech.
Hey it's asymmetric crypto that generates a key/cert pair for every site you register at. Neat. Why not just say so?
I'm getting shades of "passwords are so insecure, passphrases are secure" here.
Earlier quoted context omitted.
> I have already had several malicious login attempts Doesn't that mean they know your username and password? How does that happen so easily.
They said login attempt, not successful login. So no.
I get these pretty frequently on my work machines as I reuse my passwords and they have already leaked. At least that was my assumption.
Yay.