Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys will come at a cost

fy.blackhats.net.au

Post reply on HN
Print view View original

181–190 of 600 posts

Re: Passkeys will come at a cost

#181

Post by ekianjo »

cbsmith wrote: post #150
ryandrake wrote: post #119

Earlier quoted context omitted.

> IMHO, the IT systems desperately need to approach human behaviour by working in analogous ways with the real world. Since I'm involved with IT systems I don't struggle most of the time but people who are not that tech savvy are having hard time figuring out daily stuff I'm pretty much the website key master for everyone in my family. Since nobody else is "in computers" they really don't have a clue about what thing…

> The security community really needs to get a grip and start designing systems that are compatible with the extremely low-tech-interest population if we even have a hope of securing systems. If I knew what the solution was I'd be rich. Most of that population seems to do fine managing house keys, car keys, locker keys, etc.

True but online accounts are usually in the dozens for most people so thats definitely more of a burden. Also, its a mental load while physical keys carry the "password" physically.

Re: Passkeys will come at a cost

#182

Post by jabbany »

jeroenhd wrote: post #153
jabbany wrote: post #91

Earlier quoted context omitted.

This is a terrible idea though. I had the misfortune of getting into a cycling accident which broke my phone display (completely lost display output and touch input), and it meant I lost access to all my OTP 2FAs for a couple of days (which is actually kind of scary). I was able to fix it myself by getting parts and going through an ifixit guide (right to repair anyone? ;-), after which I promptly exported my 2FA see…

Using "something you have" as an extension to "something you know" is essentially the point of all of 2FA. That's why backup 2FA methods are essential; if it's not extremely hard to get access to your account(s) after you lose all of your second factors, 2FA is pointless and you could've just sticked to just using passwords. That said, passkeys aren't necessarily second factors; they can be a relatively secure first…

See, this where the metaphor breaks down. At no point was the phone "lost". The 2fa tokens are perfectly safe yet there's no way to get to them... even though you still "have" the things, you can't prove you have it.

Which is why having 2FA _solely_ on a phone (like OP implies) is a bad idea. It's a fragile device that can easily render you unable to prove yoh still have it.

Re: Passkeys will come at a cost

#183

Post by bombolo »

aidenn0 wrote: post #148
jauntywundrkind wrote: post #106

Earlier quoted context omitted.

It means though that your secure hardware token has a reliable way where the secrets all self-destruct. That someone can easily do if they get even brief hardware access. For people who have a problem keeping sufficient backups (almost everyone on earth) this seems like a horrific blocker, a show stopper for this entire intiative. I personally think these things absolutely should be able to be exported & backed up se…

If someone hits my cell-phone with a hammer a few times, it will probably self-destruct all the secrets.

Quite unlikely.

Re: Passkeys will come at a cost

#184

Post by bombolo »

ryandrake wrote: post #119
mrtksn wrote: post #84

Earlier quoted context omitted.

If you think about it, the core problem can be described as "authentication of the biological being with an electronic system". When passwords are used, the authentication interface is a keyboard and you don't have any actual guarantees that the person typing the password is the person who claims to be. The passwords could have been extracted in so many ways because it depends on easily transferable knowledge. Moving…

> IMHO, the IT systems desperately need to approach human behaviour by working in analogous ways with the real world. Since I'm involved with IT systems I don't struggle most of the time but people who are not that tech savvy are having hard time figuring out daily stuff I'm pretty much the website key master for everyone in my family. Since nobody else is "in computers" they really don't have a clue about what thing…

Maybe the netflix password isn't so vital?

Re: Passkeys will come at a cost

#185

Post by makeitdouble »

NotYourLawyer wrote: post #170

> The problem is that security keys with their finite storage and lack of credential management will fill up rapidly. In my password manager I have more than 150 stored passwords. If all of these were to become resident keys I would need to buy at least 5 yubikeys to store all the accounts How it is possible that THIS is the problem in 2023? Storage is cheap, tiny, and capacious. I feel like I’m reading an article fr…

Isn't the physical key a whole computing device with high grade storage ? I can't imagine those using cheap consumer grade off the shelf storage parts.

Re: Passkeys will come at a cost

#186

Post by taeric »

recursive wrote: post #178
conradev wrote: post #7

Earlier quoted context omitted.

Password managers can store passkeys. I plan on storing passkeys in a password manager for most accounts, and then moving the few that matter to be resident keys. The theoretical advantage here is twofold: - Passwords are not guessable any longer - Password managers don't expose secret material in normal operation, because they sign requests with keys stored in TEEs (i.e. most modern devices have an embedded security…

If you use good passwords, I don't think they're any more guessable than passkeys.

I think the difference is that good passwords are still replayable. Such that moving away from bearer style tokens is a win. But if I have no way of controlling the use of individual passkeys, they lose a lot.

Re: Passkeys will come at a cost

#187

Post by DangitBobby »

runiq wrote: post #54
DangitBobby wrote: post #20

Earlier quoted context omitted.

Can you give me a high level description of why passkeys won't work with my current hardware key, and then explain why they went with that implementation instead of one that works with my current hardware key?

`rk=required` means your hardware is required to store each and every derived key, not just the master key, all in the service of you not needing to remember your username anymore. Current security keys can handle a couple dozen derived keys at most, _if_ they can handle any at all. This flies in the face of previous promises where 'every key can handle an unlimited amount of accounts'. In my eyes, this looks like a…

I guess that means passkeys are DoA for me.

Re: Passkeys will come at a cost

#188

Post by macintux »

stephenr wrote: post #138
etothepii wrote: post #126

Earlier quoted context omitted.

I struggle with this on a lot of 2FA. I change my phone every 1 or 2 years when I get an upgrade and the 6 months after I end up having to keep my old phone around to handle the 2FA apps that can't be ported over, it is incredibly annoying. For me allowing a weak 2FA that moves you from the pool of people that can be trawled to the people that need to be specifically targeted is a huge improvement, but my fear of los…

Your 2FA app of choice doesn’t support export/import?

I was forced to create my first ever Microsoft account to be able to back up my Microsoft Authenticator app. I struck a small blow in return by using a very rude email address for it.

Re: Passkeys will come at a cost

#189

Post by wkat4242 »

I love this writeup. It explains a lot I didn't know about passkeys in a way that's easy to understand.

As a total self host enthusiast with a prime interest in hardware tokens (I've been using smart cards to log in for decades) this is really a bad thing. I don't want to be dependent on Google or Apple or Microsoft. Absolutely not.

There's also an extra factor the article doesn't mention: because passkeys are synced there's no need for the website to offer to enroll more than one key which makes using multiple keys difficult (needed for backup purposes)

It finally explains how I can do usernameless work with M365 though on my Yubikeys.

I hope a centralized solution comes out which allows us to use hardware backed tokens but still sync the resident keys using our own servers somehow. I know bitwarden is working on something but that's not good enough, it's not really token backed. It uses a master passphrase which is a big step back IMO.

Re: Passkeys will come at a cost

#190

Post by [deleted] »

prophesi wrote: post #39
politelemon wrote: post #38

Earlier quoted context omitted.

I don't see phones as being very different in terms of also being a physical security key.

I think the key (pun not intended) differences are that phones are something you'll always have on your person, Apple/Google will allow it to sync across devices, and phones require a pin/biometrics to authenticate with them.

[deleted]
Post reply on HN