Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale doesn't want your password

tailscale.com

Post reply on HN
Print view View original

101–110 of 316 posts

Re: Tailscale doesn't want your password

#101

Post by aniforprez »

rebeccaskinner wrote: post #91
decryption wrote: post #74

Earlier quoted context omitted.

You need to add multiple passkeys so if one breaks, you can still access the service. Ditto for Yubikeys (which can be added as a passkey), you need more than one so if you lose it you can still access.

I see a lot of claims that passkeys are more secure than passwords with 2fa, but my understanding is that they are strictly less secure. As it stands right now, if someone wanted to compromise a service that I use 2fa with, they'd need to both obtain my physical device, and also get my password. Either one of those things may be relatively easy, but it's harder to do both- especially without my knowledge. With passke…

> With passkeys, if someone steals my physical device, then they have full access

Unless they also have access to your fingerprints, face or something to that effect, they do not have access to your device. Every time I create a passkey, I am required by the device to provide authentication. I'm not sure if this is a hard requirement because all my devices have PINs, passwords and fingerprints but I assume that your device needs to have some form of security for passkeys to even work. In 1Password's demo, I had to authorise every individual login call with my system PIN on Windows and fingerprint on Android

If you don't use biometrics and use a pin/password and the attacker has access to both your device and this information, then there is no difference to how it currently operates because the attacker already has all the info necessary to take over your accounts. If an attacker has your device AND access to biometrics, then you have bigger problems

Re: Tailscale doesn't want your password

#102

Post by sgk284 »

rebeccaskinner wrote: post #91
decryption wrote: post #74

Earlier quoted context omitted.

You need to add multiple passkeys so if one breaks, you can still access the service. Ditto for Yubikeys (which can be added as a passkey), you need more than one so if you lose it you can still access.

I see a lot of claims that passkeys are more secure than passwords with 2fa, but my understanding is that they are strictly less secure. As it stands right now, if someone wanted to compromise a service that I use 2fa with, they'd need to both obtain my physical device, and also get my password. Either one of those things may be relatively easy, but it's harder to do both- especially without my knowledge. With passke…

> if someone steals my physical device, then they have full access

Apple protects passkeys via FaceID or TouchID. If you're satisfied with biometrics as a 2nd factor, then there is no regression in your scenario.

Re: Tailscale doesn't want your password

#103

Post by jjav »

dfabulich wrote: post #88
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

It's way simpler than you think. You reset your passkey the same way you'd reset your password. So, how do you reset your password when you forget it? Well, it depends. Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there. Som…

> (Of course, it's possible to have a site that has no way to reset your password, and just assumes that you'll never forget your password. Similarly, those sites could have no way to reset your passkey. In that case, the problem is as you say: there'd be no way to recover your keys if you lost access to them.)

Isn't this the catch though (I haven't been following passkey work much)?

Every site knows users will absolutely forget passwords, so having a reset mechanism is a must. But I can imagine many sites thinking nobody will forget a passkey since it doesn't need to be remembered, thus hardcoding it in ways that make reset impractical.

Re: Tailscale doesn't want your password

#104

Post by SamvitJ »

scottgg wrote: post #92
SamvitJ wrote: post #89

"Passkeys allow you to go passwordless — rather than a password that can still be phished — you get strong credential that syncs securely across your devices, using your chosen password/passkey manager." This sentence doesn't quite make grammatical sense to me. Is there a typo or two here, or am I missing something?

you get _a_ strong credential, or you get _strong credentials_ , probably There's a lot going on in there!

Ah, thanks, I think it makes sense now. The use of hyphens is confusing too. I would have preferred either:

> Passkeys allow you to go passwordless: rather than a password that can still be phished, you get a strong credential that syncs securely across your devices, using your chosen password/passkey manager.

OR

> Passkeys allow you to go passwordless — rather than a password that can still be phished, you get a strong credential that syncs securely across your devices, using your chosen password/passkey manager.

Re: Tailscale doesn't want your password

#105

Post by martin-adams »

zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

I replaced my iPhone in-store and they transferred all my data. All my data except my Google Authenticator codes.

I lost access to at least one account as a result and had to submit identity documents to recover the account.

I now make sure I have backup codes stored somewhere.

Interestingly, in the past couple of weeks, Google Authenticator can now back up to your Google account.

Re: Tailscale doesn't want your password

#106

Post by DCKing »

Good. I get they don't want to be responsible for keeping user credentials. But requiring permission from a big tech company to manage or access your own networks boggles my mind and made me not use it.

Now if only they supported this for setting up the entire account too, as opposed to additional users only. I hope that's coming.

Re: Tailscale doesn't want your password

#107

Post by JimDabell »

dinvlad wrote: post #87
woodruffw wrote: post #86

Earlier quoted context omitted.

I don't know about Passkeys specifically, but this is unfortunately common enough with WebAuthn rollouts. I'm not sure if it's true anymore, but Twitter for years only supported a single WebAuthn token.

I think even Amazon does that too still, such a shame

If you’re referring to AWS, they added support for multiple MFA devices last year:

https://aws.amazon.com/blogs/security/you-can-now-assign-mul...

Amazon’s shopping site also lets you set up multiple devices, but I’m not sure when they added that.

Re: Tailscale doesn't want your password

#108

Post by _delirium »

jabbany wrote: post #47
nhumrich wrote: post #37

Auto-generated password via a password manager are more secure, convenient, and portable then passkeys and oidc.

Not really, the technology behind passkeys behave kind of like managed ssh keypairs. While they can be designed to have the secrets cloud synced (just lile how you can sync your ssh private keys), there's nothing preventing them from being implemented in other ways, like having them backed by a third party password manager or even a pyhsical token like a yubikey. Of course, this depends on the software (OS, browsers)…

Is there a way to store the ultimate root of trust somewhere non-digital? I currently have my most important root-of-trust passwords printed out on paper stored in places I consider long-term secure. At least in my personal physical and social context, I don't trust any cloud account or dongle to a similar extent.

Re: Tailscale doesn't want your password

#109

Post by PhilipRoman »

dfabulich wrote: post #88
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

It's way simpler than you think. You reset your passkey the same way you'd reset your password. So, how do you reset your password when you forget it? Well, it depends. Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there. Som…

The email password reset feature is an overlooked part of modern security. It has become sort of like a master key for every service. Combined with password reuse it becomes really risky (but oh, so convenient).

Re: Tailscale doesn't want your password

#110

Post by rebeccaskinner »

aniforprez wrote: post #101
rebeccaskinner wrote: post #91

Earlier quoted context omitted.

I see a lot of claims that passkeys are more secure than passwords with 2fa, but my understanding is that they are strictly less secure. As it stands right now, if someone wanted to compromise a service that I use 2fa with, they'd need to both obtain my physical device, and also get my password. Either one of those things may be relatively easy, but it's harder to do both- especially without my knowledge. With passke…

> With passkeys, if someone steals my physical device, then they have full access Unless they also have access to your fingerprints, face or something to that effect, they do not have access to your device. Every time I create a passkey, I am required by the device to provide authentication. I'm not sure if this is a hard requirement because all my devices have PINs, passwords and fingerprints but I assume that your…

As far as I can tell, biometric authentication is locked to proprietary operating systems. On Linux with a yubikey, for example, it seems like you're not only limited to only 25 sites, but you're also at best going to have a pin, and in many cases the hardware alone may be sufficient to gain access. Sure, you need to know what site the key has been registered with, but I'd bet if you found a random key at a conference you'd have pretty good luck trying it with google and github to start with.

edit: after some digging (which was a lot more involved than it should have been) it seems like the current state is:

There is free software to set and manage a pin for a yubikey on Linux. Firefox historically didn't support yubikeys with a pin, but it seems like that was recently merged. Yubikeys still have a 25 site limit per device, and no sync across devices. As long as sites let you register multiple yubikeys as a backup, and support pins, then it's a reasonable workflow. I'm not convinced it's better than passwords + a yubikey for 2fa, but it seems like in practice it's probably not worse either. It still feels like, even if security is a motivator here, there's a lot of opportunity for Google, Apple, and MS to conveniently and "accidentally" cut free software users out of being able to access a lot of the internet with the move to passkeys, and I remain skeptical.

Post reply on HN