Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale doesn't want your password

tailscale.com

Post reply on HN
Print view View original

201–210 of 316 posts

Re: Tailscale doesn't want your password

#201

Post by stavros »

aetch wrote: post #139
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

The passkey people won’t give you a straightforward answer because you won’t like the answer. If the passkey is truly secure, you don’t get your key bak if you lose the passkey. If you make a copy of the passkey, the passkey purists will say it’s not “secure”. If you lose your phone and delete your existing login cookies you don’t get access again. If email or sms is the recovery method, you might not be able to logi…

> If the passkey is truly secure, you don’t get your key bak if you lose the passkey. If you make a copy of the passkey, the passkey purists will say it’s not “secure”.

That's an uncharitable interpretation. A more charitable way to say this is:

You can choose between secure/uncloneable and less secure but more flexible. Passkeys let you make the choice and don't dictate it for you. Choose whatever better suits your use case.

EDIT: I've written a short post to clarify a few misconceptions:

https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

Re: Tailscale doesn't want your password

#202

Post by Izkata »

junon wrote: post #176
systemvoltage wrote: post #155

Earlier quoted context omitted.

> The passkey people won’t give you a straightforward answer because you won’t like the answer. Well, then this culture needs to be condemned strongly.

Why? Security isn't an opinion, it's a science and art. It doesn't care about what you think of it. Perfect security leaves no room for user friendliness. The most secure system allows no users to use it. Only by reducing security do you gain user friendliness. The most user friendly (as in, triviality of use) system requires no security. The art comes in when trying to create more usability whilst giving up less sec…

> Security isn't an opinion, it's a science and art.

The art side is where opinion lies.

Re: Tailscale doesn't want your password

#203

Post by stavros »

drdaeman wrote: post #97
decryption wrote: post #74

Earlier quoted context omitted.

You need to add multiple passkeys so if one breaks, you can still access the service. Ditto for Yubikeys (which can be added as a passkey), you need more than one so if you lose it you can still access.

Which is going to be a major pain in the ass. Every time you sign up for something you have to perform a complex rite: 1) sign up or add a portable authenticator (Yubikey or software token in something cross-platform like 1Password); and 2) run around the house, grabbing up all the different devices you have that aren't transparently synchronizing (so, something from Apple, something from Microsoft, something from Go…

I don't understand the issue here. Passkeys are just a way for a site to ask your browser for credentials. If you don't like the current solutions, write your own, and it'll work with all Passkeys-enabled sites. Why do you need the standard to be different?

Re: Tailscale doesn't want your password

#205

Post by gcr »

throw0101b wrote: post #189
makeitdouble wrote: post #128

Earlier quoted context omitted.

I've spent about 10 minutes Googling, and I'm still not sure how I backup and restore passkeys. I use a password manager with a full backup of the vault, so the answer to most of the parent's question would be solved by getting the vault back from backup. Except: - passkeys are not yet supported by my password manager, so I'd have to wait for a while - can I move Safari's passkeys to my password managers afterwards,…

> I've spent about 10 minutes Googling, and I'm still not sure how I backup and restore passkeys. In the Apple ecosystem your passkey is / can be sent to your iCloud Keychain, which you can restore when you can a replacement device (and keep using on non-lost/stolen devices): * https://support.apple.com/en-ca/guide/iphone/iph82d6721b2/io... * https://www.google.com/search?q=apple+passkey+icloud

This doesn’t address the issue if OP needs temporary access via an Android device.

Re: Tailscale doesn't want your password

#206

Post by stavros »

crote wrote: post #159
n42 wrote: post #98

Earlier quoted context omitted.

if you're someone who uses a password manager already, and is generating unique random passwords for every website, the only appreciable difference between a passkey and what you do today is: - the passkey is never transmitted anywhere when logging in, eliminating the largest attack vectors for stealing passwords - you can no longer manually type the passkey in on random devices that don't have your password manager…

Not quite. The biggest difference is that websites seem to trust a passkey as both a password and a 2FA token at the same time. So security-wise it essentially means giving up 2FA altogether, as passkeys are about as secure as a password manager. So for anyone with a password manager and 2FA tokens, passkeys are a downgrade .

This is wrong. Everyone here confuses "Passkeys the standard" with "some hardware implementation they've heard of".

Yubikeys require a PIN, and the key is wiped if you enter it wrong ten times. Nobody stops you from making a hardware key that requires a long password to access it. You can do whatever you want, the standard doesn't care how you want to secure your keys. The standard just asks for a key at enrollment and then asks you to sign something with that key at signup.

Anything after that is up to you and your choice of device.

EDIT: I've written a short post to clarify a few misconceptions:

https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

Re: Tailscale doesn't want your password

#207

Post by Izkata »

aniforprez wrote: post #101
rebeccaskinner wrote: post #91

Earlier quoted context omitted.

I see a lot of claims that passkeys are more secure than passwords with 2fa, but my understanding is that they are strictly less secure. As it stands right now, if someone wanted to compromise a service that I use 2fa with, they'd need to both obtain my physical device, and also get my password. Either one of those things may be relatively easy, but it's harder to do both- especially without my knowledge. With passke…

> With passkeys, if someone steals my physical device, then they have full access Unless they also have access to your fingerprints, face or something to that effect, they do not have access to your device. Every time I create a passkey, I am required by the device to provide authentication. I'm not sure if this is a hard requirement because all my devices have PINs, passwords and fingerprints but I assume that your…

> > With passkeys, if someone steals my physical device, then they have full access

> Unless they also have access to your fingerprints, face or something to that effect

Fingerprint scanners are a lot better than they used to be (back when they could be beaten by a gummy bear), but what about a picture of your face?

Biometrics should be thought of as passwords that can't be changed. Use them for convenience, not security.

Re: Tailscale doesn't want your password

#208

Post by megous »

taberiand wrote: post #81
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

Those issues are applicable to using password management tools generally, rather than specifically to passkeys, aren't they? It sounds to me like passkeys are a simpler and more secure approach that apply within the existing context that requires unique complex passwords for every account. In terms of solving those issues, a 1Password account configured on multiple devices with a secured accessible backup of the emer…

> It sounds to me like passkeys are a simpler and more secure approach that apply within the existing context that requires unique complex passwords for every account.

It does not to me. It requires complicated cryptography/tools. Passwords are just directly usable information that are much easier to reason about and work with. I can ask a question about passwords and I can figure out the answer or soltuion for myself without looking up any standards, implementation details of someone elses software or wading through heaps of marketing bullshit.

Say I just want to temporarily share access to an account with someone? How? I know how with passwords. Give it out, change it later to revoke access.

Say I want to export access to just select few accounts (and not the rest) I'll be needing when doing X away from my devices to limit the possiblility of forced compromise. I know how with passwords.

How does backup and recovery work? Can I do it fully offline without invloving any third parties? Will I need anything other than a piece of paper? I know with passwords without looking anything up.

If it's anything, it's not simple compared to passwords. It may be better in a few aspects (or not) but it certainly is not simpler to think about.

The difference between password manager with unique passwords per account and this complicated crypto-thing seems very miniscule. You're either sharing a shared secret or you're proving a possession of a unique secret key per service.

The only difference is how things need to be handled if the service itself is hacked. If it only stores pubkeys, the user's secret keys can still be used for authentication. The problem with this thinking is that attacker may have swapped user's key on the server with his own, hijacking the account anyway. In any case this doesn't lead to compromise of any other services used by the user.

Also, FIDO2 can be used to force you to have to use a device you don't trully own for authentication, taking away your software freedom. Passwords can't be abused like this.

Re: Tailscale doesn't want your password

#209

Post by NikolaNovak »

dfabulich wrote: post #88
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

It's way simpler than you think. You reset your passkey the same way you'd reset your password. So, how do you reset your password when you forget it? Well, it depends. Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there. Som…

>>So, how do you reset your password when you forget it? Well, it depends.

But I don't! I can write a password in any amount of low and high tech ways! I have them printed on paper in safe deposit box (my wife is bad with passwords, so this is safety if I should perish:), I have them in a password manager on USB sticks at home in a safe, I have them copied on my NAS and laptop and so on.

Whereas passkeys, it seems from everywhere I read to be far more fragile, far more locked in to specific perishable hardware device and a specific vendor ecosystem, and very limited or no ways to handle passkeys in a low tech way or as a file/artifact to be backed up. Basically they assume I live on and with my phone.

To put it bluntly:

Passwords are something I can use if I show up naked at a stranger's house. They can be with me in and through an emergency (physical emergencies exist! Computer geeks forget about those!). Or more commonly, I can use them to check my email or comms if I forget my phone at a friend's house.

Passkeys are... strictly worse?

Re: Tailscale doesn't want your password

#210

Post by NikolaNovak »

dzikimarian wrote: post #183
makeitdouble wrote: post #128

Earlier quoted context omitted.

I've spent about 10 minutes Googling, and I'm still not sure how I backup and restore passkeys. I use a password manager with a full backup of the vault, so the answer to most of the parent's question would be solved by getting the vault back from backup. Except: - passkeys are not yet supported by my password manager, so I'd have to wait for a while - can I move Safari's passkeys to my password managers afterwards,…

You can set up as many as you want, so just register your phone as one and your PC as other. Eg. using Windows Hello. If you loose or compromise one device, you just delete it as a passkey - rest is still working. If you loose all of them at the same time somehow, there's usually fall back to password or some kind of reset process.

For every account thought, correct?

Like, I can keep all my passwords in a password manager. And then copy and replicate that database however I want to.

With passkeys, I'd need to set up and authenticate additional devices... for every of hundreds of accounts I have? Am I wrong? Like if I have an android tablet and iPhone and windows PC and a Linux PC (as I do) that's half a dozen setups for each and every account? And this is a good thing??

Post reply on HN