Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale doesn't want your password

tailscale.com

Post reply on HN
Print view View original

221–230 of 316 posts

Re: Tailscale doesn't want your password

#221

Post by stavros »

brookst wrote: post #216
stavros wrote: post #211

Earlier quoted context omitted.

You can do this with Passkeys. You can write your Passkey down on a post-it, or memorize it and cross the border with it, or anything you want. This thread has urged me to write a post clarifying some of the misconceptions I always see: https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

Thank you. It is disheartening that so many HN readers would rather imagine how passkeys work, and freak out at their own imaginings, than just learn the real thing.

Yep, that's what frustrates me as well, especially for a technology that will be a massive gift to both security and usability.

Re: Tailscale doesn't want your password

#222

Post by sanitycheck »

junon wrote: post #176
systemvoltage wrote: post #155

Earlier quoted context omitted.

> The passkey people won’t give you a straightforward answer because you won’t like the answer. Well, then this culture needs to be condemned strongly.

Why? Security isn't an opinion, it's a science and art. It doesn't care about what you think of it. Perfect security leaves no room for user friendliness. The most secure system allows no users to use it. Only by reducing security do you gain user friendliness. The most user friendly (as in, triviality of use) system requires no security. The art comes in when trying to create more usability whilst giving up less sec…

If a "reset passkey by email" option exists, they don't seem much more secure than a unique complex password + (non-SMS) 2FA.

So for most people on HN (who also probably won't be successfully phished) they offer only new problems, yet if implemented and used widely they're probably a net positive.

It's a bit like the Covid rules. I am more than capable of avoiding other humans without new laws, but "normal" people seemed to need a lot of coercion.

Personally I'll give it a few years and see how passkeys pan out before I switch (if I get the choice).

Re: Tailscale doesn't want your password

#223

Post by eadmund »

> Passkeys are synchronized across devices using services you already use and trust, like iCloud Keychain from Apple, Google Password Manager, and 1Password.

I don’t trust any of those, and it’s weird that anyone does.

Re: Tailscale doesn't want your password

#224

Post by ursuscamp »

dicytea wrote: post #199
Technotroll wrote: post #146

Earlier quoted context omitted.

I had this problem with Dashlane after they suddenly changed their policies, though with a regular password. My solution? Out of frustration I developed my own password manager. Eventually I was able to recover the password from my email provider though. But at that point I had no more nails left.

I had the same issue with LastPass a few years ago. When I reinstalled my OS they decided to lock me out of my account because they thought I was a different person. The only way through is e-mail verification. Guess where that email's password was stored in? Lost everything. Been using Bitwarden ever since.

Everyone must know two passwords: their password manager's password, and their email password.

Re: Tailscale doesn't want your password

#225

Post by MilaM »

NikolaNovak wrote: post #210
dzikimarian wrote: post #183

Earlier quoted context omitted.

You can set up as many as you want, so just register your phone as one and your PC as other. Eg. using Windows Hello. If you loose or compromise one device, you just delete it as a passkey - rest is still working. If you loose all of them at the same time somehow, there's usually fall back to password or some kind of reset process.

For every account thought, correct? Like, I can keep all my passwords in a password manager. And then copy and replicate that database however I want to. With passkeys, I'd need to set up and authenticate additional devices... for every of hundreds of accounts I have? Am I wrong? Like if I have an android tablet and iPhone and windows PC and a Linux PC (as I do) that's half a dozen setups for each and every account?…

It's my understanding that passkeys that are created by platform authenticators or password managers can be backed up. That's how replicating your key through iCloud likely works. Hardware keys on the other hand don't support backups by design. You need to enroll multiple keys to have a backup.

> With passkeys, I'd need to set up and authenticate additional devices

This is true, if you don't use a platform authenticator or password manager and only use hardware keys.

Re: Tailscale doesn't want your password

#226

Post by selykg »

gcr wrote: post #205
throw0101b wrote: post #189

Earlier quoted context omitted.

> I've spent about 10 minutes Googling, and I'm still not sure how I backup and restore passkeys. In the Apple ecosystem your passkey is / can be sent to your iCloud Keychain, which you can restore when you can a replacement device (and keep using on non-lost/stolen devices): * https://support.apple.com/en-ca/guide/iphone/iph82d6721b2/io... * https://www.google.com/search?q=apple+passkey+icloud

This doesn’t address the issue if OP needs temporary access via an Android device.

If you still have access to a device that can handle the passkeys then you can use the scan of a QR code to gain access.

If you do not have access to a device with your pass key on it then using iCloud Keychain is probably not the best service to use for your use case of an Android device. Use one of the many other services that also provide Android support and passkey support. Then you can access that service and access your passkeys.

iCloud is one of many. Bitwarden and 1Password will both support passkeys, both have Android support.

Re: Tailscale doesn't want your password

#228

Post by perryizgr8 »

stavros wrote: post #211
NikolaNovak wrote: post #209

Earlier quoted context omitted.

>>So, how do you reset your password when you forget it? Well, it depends. But I don't! I can write a password in any amount of low and high tech ways! I have them printed on paper in safe deposit box (my wife is bad with passwords, so this is safety if I should perish:), I have them in a password manager on USB sticks at home in a safe, I have them copied on my NAS and laptop and so on. Whereas passkeys, it seems fr…

You can do this with Passkeys. You can write your Passkey down on a post-it, or memorize it and cross the border with it, or anything you want. This thread has urged me to write a post clarifying some of the misconceptions I always see: https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

> You can do this with Passkeys.

Maybe in theory. In practice, I couldn't even look at the passkey Google has created on my android phone. So you absolutely cannot write it down.

Re: Tailscale doesn't want your password

#229

Post by stavros »

perryizgr8 wrote: post #228
stavros wrote: post #211

Earlier quoted context omitted.

You can do this with Passkeys. You can write your Passkey down on a post-it, or memorize it and cross the border with it, or anything you want. This thread has urged me to write a post clarifying some of the misconceptions I always see: https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

> You can do this with Passkeys. Maybe in theory. In practice, I couldn't even look at the passkey Google has created on my android phone. So you absolutely cannot write it down.

If you don't like Google's implementation, you should use another one. It doesn't make much sense to say "I can't do X with my thing, therefore I can't do it with anything".

The fact remains that, if you want a Passkey you can write down, you can do that.

Re: Tailscale doesn't want your password

#230

Post by AmenBreak »

kdklol wrote: post #191
nottorp wrote: post #186

Earlier quoted context omitted.

> In general, no. Assuming they run a reasonably recent version of Chrome and Windows/Linux/Android* (I don't have apple so idk), it will work driverlessly. What will work driverlessly? The generating of new keys that still will take an hour? Also excuse me, but did you just say Chrome? I should send Google my browsing so I can use passkeys? Edit: forgot to mention their AI bans with no appeal process. Do you really…

>What will work driverlessly? WebAuthn. So, registration and authentization. I'm not exactly sure if which standard deals with changing PIN, but it worked everywhere I tried it out of the box. >OMG did you say CHROME??!!! Yes, how dare I... It was an example. I don't use Chrome either, but not many people do use other stuff, so that's why I mentioned Chrome specifically. Currently, the support is best in Chrome and s…

[flagged]
Post reply on HN