Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale doesn't want your password

tailscale.com

Post reply on HN
Print view View original

121–130 of 316 posts

Re: Tailscale doesn't want your password

#121

Post by mike_d »

lukeschlather wrote: post #80
iknowstuff wrote: post #38

Earlier quoted context omitted.

You can use 3rd party password managers to sync your passkeys however you please. Apple has no access to keychain data: https://support.apple.com/en-us/HT213305

Could you give an example? That support article doesn't mention anything about it. I do recall reading something about that recently, but I read the article and it it made no mention of what syncing passkeys actually means. It sounds like theoretically I could write an app that uses the same APIs Apple uses to sync encrypted credentials between TPMs. But "however you please" sounds suspiciously like "however you plea…

It has been a while since I have dug into it, but from what I remember it works roughly like this:

You login to iCloud which gives your device write access to iCloud storage. The device creates a private key inside the TPM, and uploads the public key. When you add a new device, one of your existing devices has to use its hardware key to sign your new devices key. It also must be signed by a second key derived from your iCloud password (so you). Apple doesn't go into the details on this, but I believe the originating TPM also signs the key with a chain of trust that goes back to Apple itself.

The keychain is encrypted locally and exported to iCloud. The key used to encrypt the keychain is also encrypted using the public keys of all trusted device keys in iCloud that have both a signature from another trusted device and from you.

As a user you can also just open up Keychain Access on a Mac and ask it to generate a CSV export of your entire iCloud keychain - which is how you would go about migrating to another password manager.

Re: Tailscale doesn't want your password

#122

Post by ptman »

freitasm wrote: post #119
decryption wrote: post #74

Earlier quoted context omitted.

You need to add multiple passkeys so if one breaks, you can still access the service. Ditto for Yubikeys (which can be added as a passkey), you need more than one so if you lose it you can still access.

Except the Tailscale implementation doesn't allow you to add more passkeys to an account. There is no "one account multiple keys" here.

That is a very big omission.

Re: Tailscale doesn't want your password

#123

Post by jorams »

iknowstuff wrote: post #34
awayto wrote: post #30

I haven't yet looked into the inner mechanics of passkeys, and the link only talks about the first login. What is the experience like when a user wants to log in from a different system? They press the "Login with Passkey" button on Device 2, and then...?

It presents a qr code you can scan with the other device. You can try it on https://passkeys.io

Note that this requires a "nearby device", which is determined via Bluetooth. There are lots of desktop PCs without Bluetooth, so this requirement is kind of a serious problem.

Re: Tailscale doesn't want your password

#124

Post by freitasm »

gabeio wrote: post #83
zoomTo125 wrote: post #78

Earlier quoted context omitted.

What happens if some websites don't allow you to add more than one passkey? Now, you need to keep track of which site has backup key, and which site doesn't have one. Also, the website needs to store multiple public keys now.

> What happens if some websites don't allow you to add more than one passkey? Do you know of any which currently only allow one passkey?

Tailscale only allows one passkey it seems.

Re: Tailscale doesn't want your password

#125

Post by drdaeman »

JimDabell wrote: post #107
dinvlad wrote: post #87

Earlier quoted context omitted.

I think even Amazon does that too still, such a shame

If you’re referring to AWS, they added support for multiple MFA devices last year: https://aws.amazon.com/blogs/security/you-can-now-assign-mul... Amazon’s shopping site also lets you set up multiple devices, but I’m not sure when they added that.

No Webauthn support at Amazon.com whatsoever. It's mandatory SMS (you must provide a number and you can't say "I don't want this to be even a backup option") with optional TOTP.

Re: Tailscale doesn't want your password

#126

Post by pabs3 »

For those of us wanting non-big-tech implementations of WebAuthn/passkeys, there are options for storing passkeys in software, and for storing passkeys in TPMs.

https://github.com/bulwarkid/virtual-fido/

https://github.com/keepassxreboot/keepassxc/pull/8825

https://github.com/psanford/tpm-fido

https://git.kernel.org/pub/scm/linux/kernel/git/jejb/fido2-c...

Re: Tailscale doesn't want your password

#127

Post by aniforprez »

rebeccaskinner wrote: post #110
aniforprez wrote: post #101

Earlier quoted context omitted.

> With passkeys, if someone steals my physical device, then they have full access Unless they also have access to your fingerprints, face or something to that effect, they do not have access to your device. Every time I create a passkey, I am required by the device to provide authentication. I'm not sure if this is a hard requirement because all my devices have PINs, passwords and fingerprints but I assume that your…

As far as I can tell, biometric authentication is locked to proprietary operating systems. On Linux with a yubikey, for example, it seems like you're not only limited to only 25 sites, but you're also at best going to have a pin, and in many cases the hardware alone may be sufficient to gain access. Sure, you need to know what site the key has been registered with, but I'd bet if you found a random key at a conferenc…

Passkeys are not the same as biometrics. Passkeys are generated and stored locally but do not have to be generated or stored on your device. Password managers are already moving towards supporting storing your passkeys. While you could store passkeys in your Yubikey, the ideal scenario would be your Yubikey is your authentication mechanism for your device or password manager and disconnecting your yubikey will lock down your device and password manager. This way, the attacker needs your Yubikey and your device for gaining access. If you set a pin on your Yubikey when you connect it to a device, that would probably increase the security. Personally, I am eyeing something similar to the fingerprint scanning Yubikeys for my own purposes. But until then, using biometrics on my systems is sufficient. 1Password is also moving to passwordless passkey access at which point my flow would be

1. Unlock my device with a pin/fingerprint/face unlock

2. Unlock 1Password with this same mechanism

3. Unlock access to a passkey supported website/app using 1Password which will store my passkey for that website/app

Through all of this, an attacker would have to have access to my device and my device authentication mechanism for gaining access which still counts as 2 factor

Re: Tailscale doesn't want your password

#128

Post by makeitdouble »

dfabulich wrote: post #88
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

It's way simpler than you think. You reset your passkey the same way you'd reset your password. So, how do you reset your password when you forget it? Well, it depends. Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there. Som…

I've spent about 10 minutes Googling, and I'm still not sure how I backup and restore passkeys.

I use a password manager with a full backup of the vault, so the answer to most of the parent's question would be solved by getting the vault back from backup. Except:

- passkeys are not yet supported by my password manager, so I'd have to wait for a while

- can I move Safari's passkeys to my password managers afterwards, like I did with passwords ? probably not ?

- can I move my password manager's passkeys to another one if I need to ? I have no idea.

That's where, at least for me, none of this is simpler than I think. The same way reset passwords is an absolute last ditch effort, I hope passkeys can be managed without having to get back to the service every time we change how we want to manage access on our side.

Re: Tailscale doesn't want your password

#129

Post by shmde »

dhosek wrote: post #3

Is there a good plug-and-play Java framework for supporting logins via identity providers like this (including passkeys) for web apps? As I build out a web application, I would like to avoid having to do all the hard work of implementing this if I can just grab a jar and have it done for me.

Have you tried keycloak ?

Re: Tailscale doesn't want your password

#130

Post by makeitdouble »

skybrian wrote: post #82
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

This will vary depending the provider, but you could think of passkeys getting synced between devices in much the same way that saved passwords get synced. Apparently Google's implementation stores an encrypted backup of the passkeys in your Google account [1]: > A single passkey identifies a particular user account on some online service. A user has different passkeys for different services. The user's operating sys…

> So, if you use Google to store passwords or passkeys, it would be a good idea to save backup codes for your Google account somewhere safe. (Like you should do anyway.)

Alternatively, if you're locked out of your Google account, these passkeys are also dead as the encryption keys are bound to the account. And passkey reset through email for instance would also probably out of question if it was your primary email account...

People should think long and hard about what services they assign passkeys with their Google accounts, it's a lot more binding than plain password or standard 2FA was.

Post reply on HN