Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale doesn't want your password

tailscale.com

Post reply on HN
Print view View original

211–220 of 316 posts

Re: Tailscale doesn't want your password

#211

Post by stavros »

NikolaNovak wrote: post #209
dfabulich wrote: post #88

Earlier quoted context omitted.

It's way simpler than you think. You reset your passkey the same way you'd reset your password. So, how do you reset your password when you forget it? Well, it depends. Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there. Som…

>>So, how do you reset your password when you forget it? Well, it depends. But I don't! I can write a password in any amount of low and high tech ways! I have them printed on paper in safe deposit box (my wife is bad with passwords, so this is safety if I should perish:), I have them in a password manager on USB sticks at home in a safe, I have them copied on my NAS and laptop and so on. Whereas passkeys, it seems fr…

You can do this with Passkeys. You can write your Passkey down on a post-it, or memorize it and cross the border with it, or anything you want.

This thread has urged me to write a post clarifying some of the misconceptions I always see:

https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

Re: Tailscale doesn't want your password

#212

Post by stavros »

megous wrote: post #208
taberiand wrote: post #81

Earlier quoted context omitted.

Those issues are applicable to using password management tools generally, rather than specifically to passkeys, aren't they? It sounds to me like passkeys are a simpler and more secure approach that apply within the existing context that requires unique complex passwords for every account. In terms of solving those issues, a 1Password account configured on multiple devices with a secured accessible backup of the emer…

> It sounds to me like passkeys are a simpler and more secure approach that apply within the existing context that requires unique complex passwords for every account. It does not to me. It requires complicated cryptography/tools. Passwords are just directly usable information that are much easier to reason about and work with. I can ask a question about passwords and I can figure out the answer or soltuion for mysel…

Most of your comment seems to be "I'd rather stay with an extremely insecure authentication scheme to avoid learning anything new".

Re: Tailscale doesn't want your password

#213

Post by masfuerte »

stavros wrote: post #211
NikolaNovak wrote: post #209

Earlier quoted context omitted.

>>So, how do you reset your password when you forget it? Well, it depends. But I don't! I can write a password in any amount of low and high tech ways! I have them printed on paper in safe deposit box (my wife is bad with passwords, so this is safety if I should perish:), I have them in a password manager on USB sticks at home in a safe, I have them copied on my NAS and laptop and so on. Whereas passkeys, it seems fr…

You can do this with Passkeys. You can write your Passkey down on a post-it, or memorize it and cross the border with it, or anything you want. This thread has urged me to write a post clarifying some of the misconceptions I always see: https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

That's really helpful. Do you know of an open source passkey client?

Re: Tailscale doesn't want your password

#214

Post by yrro »

tough wrote: post #195
martin-adams wrote: post #105

Earlier quoted context omitted.

I replaced my iPhone in-store and they transferred all my data. All my data except my Google Authenticator codes. I lost access to at least one account as a result and had to submit identity documents to recover the account. I now make sure I have backup codes stored somewhere. Interestingly, in the past couple of weeks, Google Authenticator can now back up to your Google account.

Authy is a nice alternative to google's Authenticator Was bought by Twilio, but still rocking. I love the plugin for raycast.app for it You set a master password and can login back with your phone number/master password in any device Much easier to not fuck up 2FA with it when changing phones

FreeOTP is another alternative - passphrase-encrypted backups can be saved to local or cloud storage and imported to FreeOTP running on another device.

Re: Tailscale doesn't want your password

#215

Post by brookst »

makeitdouble wrote: post #182
jiggywiggy wrote: post #132

Earlier quoted context omitted.

I don't know about Windows, but if you see the example your Mac is putting it in your keychain app, which is usely available on other devices that are connected to your Apple account. Also if you install a new macbook. Most likely also on your iphone. If you have an Android phone that will be a lot less smoot

I had the impression that Apple stores and syncs them for you, but at no point will give you the option to actually backup or restore (have a copy of the info under your management). Let's say I need to move a credential from my account to my wife's, I guess it's probably not allowed. Or god forbid I change Apple IDs.

https://developers.google.com/identity/passkeys/faq#how_can_...

Re: Tailscale doesn't want your password

#216

Post by brookst »

stavros wrote: post #211
NikolaNovak wrote: post #209

Earlier quoted context omitted.

>>So, how do you reset your password when you forget it? Well, it depends. But I don't! I can write a password in any amount of low and high tech ways! I have them printed on paper in safe deposit box (my wife is bad with passwords, so this is safety if I should perish:), I have them in a password manager on USB sticks at home in a safe, I have them copied on my NAS and laptop and so on. Whereas passkeys, it seems fr…

You can do this with Passkeys. You can write your Passkey down on a post-it, or memorize it and cross the border with it, or anything you want. This thread has urged me to write a post clarifying some of the misconceptions I always see: https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

Thank you. It is disheartening that so many HN readers would rather imagine how passkeys work, and freak out at their own imaginings, than just learn the real thing.

Re: Tailscale doesn't want your password

#217

Post by Wool2662 »

zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

Recovery is the same as with passwords. Depends on the services policies.

Passkeys and YubiKeys are different things. But generally it is recommemded to have a second YubiKey in a safe place and to register at least two keys on every service. Unfortunatly the implementations for using hardware keys are often pretty bad and require to activate alternate MFA which defeats the purpore of having a hardware token in the first place.

For backing up a yubikey. If you manage it you get a massive bugbounty. The whole purpose of a yubikey is to not be able to read the embedded key. Yubikey guarantees physical posession of the key itself if you can prove knowledge of the key within.

For passkeys: Only the authentication/creation process is specified. How passkeys are stored, shared, backedup etc is totally up to the implementing party. So Google and Apple will synchronize the keys using their existing password infrastructure.

In the end the only difference to passwords is: - It is always randomly generated - You can have multiple passkeys per service - The application managing passkey is required to verify that passkeys are only transmitted to the service they were created for (making them phishing resistant)

Passkeys are basically the point between passwords and hardware tokems like the yubikey. Safer than passwords and less safe than a yubikey but easily usabale by everyone.

Re: Tailscale doesn't want your password

#218

Post by kdklol »

nottorp wrote: post #197
kdklol wrote: post #191

Earlier quoted context omitted.

>What will work driverlessly? WebAuthn. So, registration and authentization. I'm not exactly sure if which standard deals with changing PIN, but it worked everywhere I tried it out of the box. >OMG did you say CHROME??!!! Yes, how dare I... It was an example. I don't use Chrome either, but not many people do use other stuff, so that's why I mentioned Chrome specifically. Currently, the support is best in Chrome and s…

> Are you trolling? No. Also, only nonces are generated for each new _credential_, so you don't need to store so much data on the key. You should be more worried about how long it will take to do the authentization exchange, which takes under a second from my experience. I'm not talking about the CPU time needed to generate the bits... Aren't the keys device specific so you need to generate new keys on a new device?…

>Aren't the keys device specific so you need to generate new keys on a new device? It's being touted as a security feature

Yes, the keys are device specific. This is a feature and the reason why it's more secure. If it could be backed up (exfiltrated), it would not protect you in case your device is compromised, which is one of the design goals. You could probably work around this by using an emulated key (which is what Apple does I think?), but that would obviously eliminate this key security feature.

> I'm guesstimating that at 1 hour of the user clicking through various interfaces.

I see, sorry, I missunderstood.

Again, it's just like changing a password or a TOTP secret. Unfortunatelly, no standard can fix bad UX design, but I sympathize. Silver lining is that even cheaper hardware keys are built like a tank, and software is... well... software.

> my concern is passkeys are adding too many dependencies on devices/providers.

Which is reasonable. The question is, is the dependency worth the security benefit? It seems many major device makers/service providers think so.

> Giving me a list of possible devices/providers does not address my concern.

Well, I can't do anything about that, can I? Nor can anyone else.

I think this is, again, a question of priority. TLS is now essentially a dependency for using the web at large, but it wasn't in the 90s. I'm sure that is of concearn to some people, but most agree it's a net benefit.

Re: Tailscale doesn't want your password

#220

Post by stavros »

masfuerte wrote: post #213
stavros wrote: post #211

Earlier quoted context omitted.

You can do this with Passkeys. You can write your Passkey down on a post-it, or memorize it and cross the border with it, or anything you want. This thread has urged me to write a post clarifying some of the misconceptions I always see: https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

That's really helpful. Do you know of an open source passkey client?

Someone has linked a few implementations in the thread here:

https://news.ycombinator.com/item?id=36238001

Post reply on HN