Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys will come at a cost

fy.blackhats.net.au

Post reply on HN
Print view View original

71–80 of 600 posts

Re: Passkeys will come at a cost

#71

Post by mixmastamyk »

kj4ips wrote: post #6
saulrh wrote: post #2

That's a rather uncharitable take on the situation. I'll propose an alternative: If you want to take advantage of the new auth standard that will eliminate weak passwords and password reuse (thereby preventing 99% of casual account break-ins), you'll have to spend $30 to upgrade off the legacy yubikey you've been coasting on since 2013.

I just looked a the technical manual for the 5 series, and it only supports 25. I only have two right now, but I have way more than 25 TOTPs. I don't know what the Bio FIDO ones have, but if it is similar, YubiCo may not have a product well placed for a large number of RKs. ~Edit: The Bio's have the same limit of 25

I think the FLOSS keys can handle more than that. But, I'd probably separate work and personal accounts to different pairs of keys anyway.

Re: Passkeys will come at a cost

#72

Post by aseipp »

katbyte wrote: post #66
Ajedi32 wrote: post #27

Is it even a good idea to use physical security keys as passkeys in the first place? Passkeys are meant to be a password _replacement_, and for that you probably want the 2-factor properties afforded by phones or desktops which usually require "something you know" or "something you are" to unlock in addition to the "something you have" afforded by physically possessing them. IMO physical security keys are better left…

i think they could be great for websites i don't really care about and already use weaker passwords. but for important sites where security matters? nope

Passkeys are unphishable and can't meaningfully leak credentials in the case of a hack, nor can they be reused by design. For "important sites where security matters" they are literally better in every way than a password, it doesn't matter how weak or strong. You can use a pure software solution, and soon probably even your existing password manager, to handle them. Again, you should think of them as replacing passwords. You can still enforce post-authentication requirements like SMS or calls to known numbers, bank account deposits, magic follow-up links in a confirmed email, push notifications, etc.

SSH keys are the best analogy. "SSH keys are great for useless servers, but for important servers? no way!" No! That's exactly where SSH keys are most useful. And you also happen to encrypt your SSH keys locally with a password, don't you? This is the exact same principle, but applied to arbitrary websites. Nobody goes around randomly generating login passwords for SSH'ing into each and every server they use, and then pats themselves on the back.

Re: Passkeys will come at a cost

#73

Post by zb3 »

Any form of authentication based on "something you have, but can also lose" is fundamentally broken. Either I'll lose access if I lose the device, or their superior security doesn't matter because the weakest link has to be somewhere else.

Re: Passkeys will come at a cost

#74

Post by radicalbyte »

kj4ips wrote: post #6
saulrh wrote: post #2

That's a rather uncharitable take on the situation. I'll propose an alternative: If you want to take advantage of the new auth standard that will eliminate weak passwords and password reuse (thereby preventing 99% of casual account break-ins), you'll have to spend $30 to upgrade off the legacy yubikey you've been coasting on since 2013.

I just looked a the technical manual for the 5 series, and it only supports 25. I only have two right now, but I have way more than 25 TOTPs. I don't know what the Bio FIDO ones have, but if it is similar, YubiCo may not have a product well placed for a large number of RKs. ~Edit: The Bio's have the same limit of 25

As matthewaveryusa says above, you can have the key on the Yubi generate then encrypt the private key; that encrypted private key is then stored on mass storage (synced to iCloud etc). Then to use it you supply the key + data to sign the auth challenge.

My issue then is that these keys allow total tracking. We need hardware implementing more complex and privacy protecting schemes (BBS+ etc).

Re: Passkeys will come at a cost

#75

Post by NoZebra120vClip »

ilikepi wrote: post #70
e40 wrote: post #63

Earlier quoted context omitted.

That's not how my YK works. When I go to a new computer and login to my Google account, it asks me to insert it and press the button. Did I configure it wrong?

Are you sure you have a YubiKey (e.g. a "5 Series"[1]) and not a YubiCo "Security Key"[2]? The latter is a less expensive device with less functionality[3], though still good for arguably the most common 2FA situations. [1]: https://www.yubico.com/products/yubikey-5-overview/ [2]: https://www.yubico.com/products/security-key/ [3]: https://www.yubico.com/store/compare/

The Security Key models have an access PIN just the same.

Re: Passkeys will come at a cost

#76

Post by wongarsu »

asdff wrote: post #37

Passkeys make no sense. Its selling you something you already own, since a fingerprint or a retina scan makes a fine good two factor as well.

In 2014 the fingerprints of Angela Merkel and the German Defense Minister were "cloned" by taking high resolution pictures at a press conference. Against targeted attacks, using something that's readily visible on your person isn't the best idea.

Re: Passkeys will come at a cost

#77

Post by dandanua »

shawnz wrote: post #50
dathinab wrote: post #21

Earlier quoted context omitted.

Because secure tamper resistend storage is expensive. I would even go as far and say from a security POV the best security key is the key which has 0 storage. Because in my experience any protocol which injects and stores a secure token into a security key/enclave/whatever instead of deriving it from shared secrets etc. has serious flaws. Sometimes it's fundamentally security flaws (like TOTP). Sometimes it's complex…

Why not just store the master key in the tamper resistant storage and then have some regular old consumer grade storage to store all the derived keys?

This allows to copy derived keys easily, which ruins the purpose of the whole security key idea.

Re: Passkeys will come at a cost

#78

Post by caminante »

prophesi wrote: post #39
politelemon wrote: post #38

Earlier quoted context omitted.

I don't see phones as being very different in terms of also being a physical security key.

I think the key (pun not intended) differences are that phones are something you'll always have on your person, Apple/Google will allow it to sync across devices, and phones require a pin/biometrics to authenticate with them.

Have you not heard of "SIM swapping?" [0]

The FBI (US) receives thousands of complaints, which I'm guessing means it's orders of magnitude more common.

[0]https://blog.mozilla.org/en/privacy-security/mozilla-explain...

Re: Passkeys will come at a cost

#79

Post by gleenn »

prophesi wrote: post #39
politelemon wrote: post #38

Earlier quoted context omitted.

I don't see phones as being very different in terms of also being a physical security key.

I think the key (pun not intended) differences are that phones are something you'll always have on your person, Apple/Google will allow it to sync across devices, and phones require a pin/biometrics to authenticate with them.

FWIW, some Yubikeys require a pin as mentioned elsewhere and some more expensive ones even have biometric fingerprint readers on the key.

Re: Passkeys will come at a cost

#80

Post by tiltowait »

katbyte wrote: post #62
microtonal wrote: post #55

Earlier quoted context omitted.

Apple opened up OS integration for other applications. 1Password is currently doing beta testing of their Passkey implementation. Besides that, the whole idea of Passkey (in contrast to what this blog claims) was that the key material can be synced between devices, so I am not sure how only the phone would be 'a passkey'. iCloud Keychain syncs my Passkeys between all my devices, including to my MacBooks.

are there many places that use passkey yet? i've not encountered one, or rather not seen a place to make use of it

This website has a list of sites allegedly supporting passkeys: https://passkeys.directory

I say "allegedly", because a few of them (Paypal, eBay, a couple others) have never once offered to let me use a passkey.

Sites I know, off the top of my head (because I used them in the past 24 hours):

* Porkbun

* Google

* GitHub (if you enable the preview feature)

I know I've used more, but I don't have an easy way of searching for them.

Post reply on HN