Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys will come at a cost

fy.blackhats.net.au

Post reply on HN
Print view View original

141–150 of 600 posts

Re: Passkeys will come at a cost

#141

Post by saint_yossarian »

etothepii wrote: post #126
jauntywundrkind wrote: post #106

Earlier quoted context omitted.

It means though that your secure hardware token has a reliable way where the secrets all self-destruct. That someone can easily do if they get even brief hardware access. For people who have a problem keeping sufficient backups (almost everyone on earth) this seems like a horrific blocker, a show stopper for this entire intiative. I personally think these things absolutely should be able to be exported & backed up se…

I struggle with this on a lot of 2FA. I change my phone every 1 or 2 years when I get an upgrade and the 6 months after I end up having to keep my old phone around to handle the 2FA apps that can't be ported over, it is incredibly annoying. For me allowing a weak 2FA that moves you from the pool of people that can be trawled to the people that need to be specifically targeted is a huge improvement, but my fear of los…

I use Aegis Authenticator on Android which does encrypted cloud backups, so changing phones isn't much of a problem.

I also only keep critical accounts there, the rest goes into Bitwarden. I realize this isn't as secure, but with those accounts I wouldn't even bother with 2FA otherwise.

Re: Passkeys will come at a cost

#142

Post by jabbany »

sedatk wrote: post #128
jabbany wrote: post #91

Earlier quoted context omitted.

This is a terrible idea though. I had the misfortune of getting into a cycling accident which broke my phone display (completely lost display output and touch input), and it meant I lost access to all my OTP 2FAs for a couple of days (which is actually kind of scary). I was able to fix it myself by getting parts and going through an ifixit guide (right to repair anyone? ;-), after which I promptly exported my 2FA see…

That's indeed scary. Losing your 2nd factor shouldn't block you from accessing your accounts indefinitely . There should at least be one recovery path outside 2FA be it "printed recovery keys", "email recovery", "support channels", or even (despite being fully insecure) SMS maybe with a grace period (like 48 hours). Backing up your 2FA secrets isn't user-friendly at all, and it's even harder after you've started usin…

This is definitely good advice.

My point here is to note that "phones" are not a good 2nd factor, unfortunately, because they're not that durable and are kind of targets of theft. So moving to solely rely on phone sounds like a bad idea.

In my case, this was not the end of the world since I use a Yubikey for Google rather than TOTP, so at least my core email services (which represent a huge identity provider) were fine.

(This is also the reason why I could afford to wait to get parts and fix the phone rather than get into some panic mode of having all my digital accounts in a state where I might get locked out at any point.)

Re: Passkeys will come at a cost

#143

Post by jabbany »

thrashh wrote: post #122
jabbany wrote: post #96

Earlier quoted context omitted.

The problem with cloud-sync-based managers like the iCloud Keychain is bootstrapping. Since you need to be able to log in to the services themselves to provision access to the passwords. This makes travelling a bit risky, since it's not that hard to lose/break/have your devices stolen during a random trip. This makes it immensely hard to recover, since you cannot just hop onto a public terminal and authenticate (whic…

Knowing ahead of that problem, you can plan a solution though? Everything I have is cloud-synced and even if I lose my phone right now in a random country, I definitely know how I can recover all my 2FA tokens and logins from a random terminal (or preferably a new boxed phone) -- I DO have to remember some passcodes which I otherwise never use but that's not too hard. If Google or Apple implements this, they can desi…

> I DO have to remember some passcodes which I otherwise never use but that's not too hard.

Right, but you're giving up a lot of security to do this, since it implies with these rare passcodes someone else could also bootstrap your logins.

With HW tokens, you don't have to worry about recovery passcodes being leaked/hacked (the recommended procedure today is to print out the recovery codes and destroy digital copies).

Re: Passkeys will come at a cost

#144

Post by deathanatos »

matthewaveryusa wrote: post #29
upofadown wrote: post #5

This raises a question for me. Why are hardware keys so limited in storage? How much extra would it cost to have a secure processor that could access a mass storage device also built in to the key. This mass storage device would of course be strongly encrypted by the secure processor with a key that would be erased at the same time everything else is erased.

It's less that they are limited in memory, and more so that they are designed to not have memory limits. If you look at TPMs, basically each time you want to sign something, your input is the data you want to sign and a sealed private key. The sealed key is the private key that was generated by the TPM and then symmetrically encrypted with the key embedded in the TPM. You store the sealed key in your mass storage, an…

What you're talking about seems to be what the article would call a "non-resident" key, whereas this commenter is specifically asking about "resident" keys.

Or, if you think you are describing resident keys, then you need to reconcile,

> This design allows you to have as many keys as your mass storage will allow you to save.

with the OP: the article states that to be roughly "20", and people tend to have more than 20 logins, and that is the reason the person you're responding to is asking the question they're asking.

Re: Passkeys will come at a cost

#145

Post by jrozner »

Ajedi32 wrote: post #27

Is it even a good idea to use physical security keys as passkeys in the first place? Passkeys are meant to be a password _replacement_, and for that you probably want the 2-factor properties afforded by phones or desktops which usually require "something you know" or "something you are" to unlock in addition to the "something you have" afforded by physically possessing them. IMO physical security keys are better left…

When using a resident/discoverable credential the authenticator is supposed to authenticate the user (using a pin, biometrics, etc.) This fulfills the multi-factor requirement. All passkeys/webauthn credentials are something you have and you can use a something to know/something to are to unlock the credential stored on the authenticator.

Re: Passkeys will come at a cost

#146

Post by gtvwill »

Gonna only say this once. Stop building your forts with only one wall and one gate. Build many walls to cross, many gates to open, observe the user through each of these.

lol op assumes passkeys or pw's are the only lock being used to protect things. Well from a security implementation standpoint...I assume someone either you on the rust end or someone on the yubikey end is already a weak link and your password is probably already compromised. But thats ok.

TBH from a security standpoint, yeah I expect your PW to be correct, but I also do assume that its not secret. Its only part of the parcel. I expect about a dozen other metrics to be correct too pending on how secure you need your stuff or how important the security is. If you don't tick most of these if not all of these boxes. I don't care if your password or passkey is right. Your not getting in.

The pincode>push button on yubikeys is part of this. Your IP, your device ID, your TPM trusted data paths, the time of day your trying to make access, the frequency of it, the country of origin, the target your trying to get into, the wifi you are accessing this via....are all part of this. Stop being so old school about security and propping it up off one point of failure.

Now this bit is going to be the real hard biscuit to bite for alot of folks, but Yes I get that its harder in web because you probably don't have the physical end of things under enough control that you can use those for your security checks/metrics as they are under user control, but maybe don't store super piss off secret data that needs to stay secret in systems like that. If your web app gets to X level of personal data/could be involved in X level of harm to society or its users if breached. Don't let people sign up without mfa, hardware keys and so on. Force users to detail more info about their fixed locations and regular usage areas and judge their access security on that.

tldr I dont care if your PW is compromised its 1/X keys needed. I assume its compromised. I dont assume all other X keys are tho.

Re: Passkeys will come at a cost

#147

Post by gtvwill »

kccqzy wrote: post #32
goalieca wrote: post #25

A private key for curve p256 is 32-bytes. Let's say we have associated metadata (hostname, whatever) and round that up to 1KiB per key. A typical user has around 200 accounts but let's give room for 1000 since powerusers love hardware keys. That's 1000 x 1KiB = 1MiB. This is totally within our technical capabilities. It's not uncommon for small radio coprocessors to have more storage on die. Even old school SIM cards…

You aren't buying a USB mass storage device when buying a security key. Completely different product, different requirements.

No I'm buying a USB minimum storage device with a micro controller embedded and potted under some very hard plastics. Very much the same thing. Function different yes, manufacturing when it comes down to it. Exactly the same. I could print wafer for your security key, I could print wafer for your flash memory. IC's arent manufactured differently in security keys to normal IC's. The product is the same silicon just doped differently to make a different ic/circuit. its a small computer in a USB. it does a limited function. Stop making them out like they are some wizard stick fancy stuff. You can setup a ESP32 as a security key if you want.

Re: Passkeys will come at a cost

#148

Post by aidenn0 »

jauntywundrkind wrote: post #106
the_snooze wrote: post #33

Earlier quoted context omitted.

When I use a Yubikey for passwordless authentication (FIDO2), it challenges me for a PIN before asking me to touch the device. If I give it too many incorrect PINs, the Yubikey locks up and requires a device reset, which invalidates all previous registrations to use that key for authentication. It doesn't seem like a big deal if someone steals my hardware token. https://support.yubico.com/hc/en-us/articles/4402836718…

It means though that your secure hardware token has a reliable way where the secrets all self-destruct. That someone can easily do if they get even brief hardware access. For people who have a problem keeping sufficient backups (almost everyone on earth) this seems like a horrific blocker, a show stopper for this entire intiative. I personally think these things absolutely should be able to be exported & backed up se…

If someone hits my cell-phone with a hammer a few times, it will probably self-destruct all the secrets.

Re: Passkeys will come at a cost

#149

Post by drdaeman »

cameldrv wrote: post #121
zaroth wrote: post #58

They really just can’t get out of their own way in screwing this stuff up… Resident keys allow the browser to query the secure element for a list of usernames for a domain. It’s a nice feature, but you have to setup the protocol to reliably fallback to non-resident keys on secure elements that are space constrained. But then they came up with these resident key “preferred” and “discouraged” keywords which are sent by…

What I don't get is why can't the browser just maintain a list of accounts that it knows work with the non-resident key? The username is not secret information, so why does it need to be held in the key?

Because a key could be used with a brand new browser on an OS or machine that you've never used before.

And the problem is that it's not usernames, they're IDs, not intended for humans, so manually typing those is not exactly a good idea.

Re: Passkeys will come at a cost

#150

Post by cbsmith »

ryandrake wrote: post #119
mrtksn wrote: post #84

Earlier quoted context omitted.

If you think about it, the core problem can be described as "authentication of the biological being with an electronic system". When passwords are used, the authentication interface is a keyboard and you don't have any actual guarantees that the person typing the password is the person who claims to be. The passwords could have been extracted in so many ways because it depends on easily transferable knowledge. Moving…

> IMHO, the IT systems desperately need to approach human behaviour by working in analogous ways with the real world. Since I'm involved with IT systems I don't struggle most of the time but people who are not that tech savvy are having hard time figuring out daily stuff I'm pretty much the website key master for everyone in my family. Since nobody else is "in computers" they really don't have a clue about what thing…

> The security community really needs to get a grip and start designing systems that are compatible with the extremely low-tech-interest population if we even have a hope of securing systems. If I knew what the solution was I'd be rich.

Most of that population seems to do fine managing house keys, car keys, locker keys, etc.

Post reply on HN