Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys will come at a cost

fy.blackhats.net.au

Post reply on HN
Print view View original

171–180 of 600 posts

Re: Passkeys will come at a cost

#171

Post by torstenvl »

dcow wrote: post #165
torstenvl wrote: post #161

I'm not a security or crypto guy at all. I found this very difficult to follow, and I suspect others might too. My questions probably seem weird to someone with enough background context to understand the post, but I am getting wrapped around the axle every sentence or two. > It all comes down to one thing - resident keys. How/why? What's the connection to passkeys or HSMs? > we need to understand what a discoverable…

It's a poorly argued point, agree. Essentially the author is arguing that the ability in the WebAuthN protocol for Relying Parties to be able to specify `rk=required` is considered harmful because it excludes tons of TPM hardware from being able to work as a Passkey wallet/db. I think most people in the comments probably agree. That doesn't excuse all the confusion the author creates by essentially bike-shedding the…

I think the upshot is this:

The hype around passkeys is high enough that basically all authentication layers are requiring passkeys when they're available. This is a problem because passkeys must be stored in the client-side authenticator (password manager, hardware token, whatever), some of which have very limited capacity for storing them.

This is compounded by two problems: (1) Extant standards for storing these keys on hardware tokens don't allow deleting them individually, though this is changing in the newest standard; (2) Many current hardware tokens claim to have huge capacities, but this is based on a different challenge-response mechanism than passkeys. As a result, users will be pressured into using passkeys often, run out of precious passkey space despite thinking they have plenty, and then be forced to forego the benefits moving forward or reset and lose their keys.

Is that more or less accurate?

Re: Passkeys will come at a cost

#172

Post by [deleted] »

wepple wrote: post #113

> Are non-resident keys less secure? The answer provided by the author (TLDR: you'd have to break AES) is far from satisfying to me. With a resident key, the only thing an attacker on an endpoint could ever get is a challenge & a response to that challenge. It's more than nothing, but limits a lot of attacks. With non-resident keys, an attacker can not only do all kinds of offline attacks* against the HMAC and crypto…

[deleted]

Re: Passkeys will come at a cost

#173

Post by wkat4242 »

Ajedi32 wrote: post #27

Is it even a good idea to use physical security keys as passkeys in the first place? Passkeys are meant to be a password _replacement_, and for that you probably want the 2-factor properties afforded by phones or desktops which usually require "something you know" or "something you are" to unlock in addition to the "something you have" afforded by physically possessing them. IMO physical security keys are better left…

> Passkeys are meant to be a password _replacement_, and for that you probably want the 2-factor properties afforded by phones or desktops which usually require "something you know" or "something you are" to unlock in addition to the "something you have" afforded by physically possessing them

Yes because the keys have a PIN just for this usecase. Similar to the ATM card or SIM card you already know

Re: Passkeys will come at a cost

#174

Post by wkat4242 »

Arch-TK wrote: post #160
jauntywundrkind wrote: post #106

Earlier quoted context omitted.

It means though that your secure hardware token has a reliable way where the secrets all self-destruct. That someone can easily do if they get even brief hardware access. For people who have a problem keeping sufficient backups (almost everyone on earth) this seems like a horrific blocker, a show stopper for this entire intiative. I personally think these things absolutely should be able to be exported & backed up se…

You can import onto a yubikey. At least the GPG keys which is basicly all I use it for.

GPG yes. Fido no.

Re: Passkeys will come at a cost

#175

Post by thaumasiotes »

mrtksn wrote: post #169
thaumasiotes wrote: post #166

Earlier quoted context omitted.

I have some experience with people trying to keep track of objects.

Can you describe your experience? I know what you mean but if you describe it, I think we will be able to examine the implications.

All of the following are routine. We will name our example person "Bob".

1. Bob owns an important item. He believes that he knows where it is. He is wrong.

2. Bob owns an important item. He is well aware that he has no idea where it is.

3. Bob owns an important item. He knows where it is. He is right about where it is. Unbeknownst to Bob, other people frequently borrow or otherwise meddle with his item.

4. Bob has taken his important item with him, for security. Unbeknownst to Bob, it fell out of his pocket an hour ago.

5. Bob used to own an important item. When he cleaned his house, he confused it with a different, unimportant item, and he threw it away.

Re: Passkeys will come at a cost

#176

Post by gtvwill »

drdaeman wrote: post #152
gtvwill wrote: post #147

Earlier quoted context omitted.

No I'm buying a USB minimum storage device with a micro controller embedded and potted under some very hard plastics. Very much the same thing. Function different yes, manufacturing when it comes down to it. Exactly the same. I could print wafer for your security key, I could print wafer for your flash memory. IC's arent manufactured differently in security keys to normal IC's. The product is the same silicon just do…

> Stop making them out like they are some wizard stick fancy stuff But they are. Tamper resistance is a thing, and it's different from the engineering perspective. That's why Yubikey and FST-01 are entirely different beasts. Most folks probably don't need tamper resistant hardware, though. I mean, they've been doing fine with sticky notes on a monitor...

Most folks are better off with notebook in the table next to their bed/desk for passwords than anything else. Whens the last time you got broken into at home and someone stole your diary? Whens the last time you read about someone getting breached because they had their passwords written down in a book next to their desk? Pretty much never.

Whens the last time someone got breached storing their PW somewhere digital? well shit probably a dozen happening every second and a few dozen breaches somewhere in the world before your done reading this.

Re: Passkeys will come at a cost

#177

Post by SebastianKra »

runiq wrote: post #48
dathinab wrote: post #16

> rk=required why does that even exist, that shouldn't be an option this stuff is why I have been so worried/skeptical about Passkeys and the people related to it. They have the responsibility to design their protocols to not be a tool well suited for big coperations like Microsoft to seriously mess up security, compatibility and enact all kinds of "bad faith" market practices to kill competition. But instead again a…

I'm pretty sure the goal here is to turn your phone into your passkey, _and nothing else_. Everything written in that article makes sense if you keep that in mind.

No, the idea is to turn _every_ device into your passkey, and also at least one cloud provider of your choice.

Re: Passkeys will come at a cost

#178

Post by recursive »

conradev wrote: post #7
taeric wrote: post #3

Earlier quoted context omitted.

This doesn't really change much, though? My keys can only have 25 resident keys on them, and I also have more than 25 passwords stored in my password manager.

Password managers can store passkeys. I plan on storing passkeys in a password manager for most accounts, and then moving the few that matter to be resident keys. The theoretical advantage here is twofold: - Passwords are not guessable any longer - Password managers don't expose secret material in normal operation, because they sign requests with keys stored in TEEs (i.e. most modern devices have an embedded security…

If you use good passwords, I don't think they're any more guessable than passkeys.

Re: Passkeys will come at a cost

#179

Post by autoexec »

aseipp wrote: post #123
Eduard wrote: post #102

Earlier quoted context omitted.

> Passkeys are unphishable and can't meaningfully leak credentials in the case of a hack, nor can they be reused by design. Let's assume a "passkey device emulator" written in software; quite realistic IMHO for someone to use, considering the cost of hardware authentication devices (phones, YubiKey etc.) If someone using such emulator gets hacked and has their passkey emulator data stolen, is there anything preventin…

The software you're describing is called a "Password Manager", and several do support passkeys already in newer versions. There's no real "emulation." 1Password 8 supports them just fine, your browser has APIs so third-party software can integrate exactly for that. So, the answer to your question is pretty much "exactly the same scenario as your password manager getting leaked", which is basically unsurprising and al…

> when a website operator gets hacked; in that case the only information an attacker gains from your user account is a public key, which isn't of much use.

How is that different from situations where a website gets hacked and all the attacker gets is a well-hashed version of a unique password? In either case it isn't doing the attacker any good.

Re: Passkeys will come at a cost

#180

Post by bmurphy1976 »

cbsmith wrote: post #150
ryandrake wrote: post #119

Earlier quoted context omitted.

> IMHO, the IT systems desperately need to approach human behaviour by working in analogous ways with the real world. Since I'm involved with IT systems I don't struggle most of the time but people who are not that tech savvy are having hard time figuring out daily stuff I'm pretty much the website key master for everyone in my family. Since nobody else is "in computers" they really don't have a clue about what thing…

> The security community really needs to get a grip and start designing systems that are compatible with the extremely low-tech-interest population if we even have a hope of securing systems. If I knew what the solution was I'd be rich. Most of that population seems to do fine managing house keys, car keys, locker keys, etc.

You sure about that? I inherited what feels like 1,000 keys when my in-laws passed away. Who the hell knows what any of them are for, and they sure as hell didn't.
Post reply on HN