Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys will come at a cost

fy.blackhats.net.au

Post reply on HN
Print view View original

291–300 of 600 posts

Re: Passkeys will come at a cost

#291

Post by Aeolun »

joshgachnang wrote: post #82
gruez wrote: post #17

Earlier quoted context omitted.

Why should I be forced to upgrade? Non-resident keys also eliminate weak passwords and password reuse. Using resident keys only add marginal improvement (ie. you can plug in a key and the service knows which account it belongs to), and that doesn't seem like a good justification to deprecate all the existing authenticators in use today.

Maybe not for us, but for the vast majority of users, they'd pick not having to remember a username OR password for sure.

It’s also make pickpocketing a lot more lucrative if you can grab someone’s wallet and have immediate access to their bank account.

Re: Passkeys will come at a cost

#292

Post by tedk-42 »

Yeah there's a cost. The cost is on the consumer who's being sold bullet proof vests to goto the supermarket because there's fear being created about random shootings that could happen and than you need these high tech security things to keep you safe.

This type of security e-wang crap is only suitable for highly sensitive confidential data (secret / top secret level stuff) and most consumers get little benefit from it.

Why? Because you've already handed over your data to a lot of places knowingly and unknowingly who are more likely to leak it than you ever will.

Re: Passkeys will come at a cost

#293

Post by gre345t34 »

dcow wrote: post #217
throwaway892238 wrote: post #194

Earlier quoted context omitted.

Password managers have already made passwords obsolete. I literally don't know any of my passwords except my master one. Passkeys are an insanely overcomplicated solution we don't really need. Browsers just need a simple HATEOAS API for password managers to hook into, and web apps expose some HTML that triggers the browser. The password manager can then determine how to authenticate the user (however the user wants!)…

> Passkeys are an insanely overcomplicated solution we don't really need. This is simply not true. WebAuthN is not overcomplicated needlessly (I wouldn't even call it over complicated, it's literally just a signed challenge/response dance). It improves on Passwords+2FA in a few notable ways: 1. It prevents shared secrets from traversing the wire. 2. It naturally enforces that users are all using secure authentication…

Primary issue with FIDO is not the specs themselves but the extremely confusing nomenclature that FIDO put zero effort into clarifying.

Re: Passkeys will come at a cost

#294

Post by gre345t34 »

NoZebra120vClip wrote: post #281
heavyset_go wrote: post #274

Earlier quoted context omitted.

You can use the Yubico Authenticator app's WebAuthn feature on the desktop to see resident credentials on their Security Key product, same thing with Chrome/Chromium's security key settings pane.

Nope. I have Windows Yubico Authenticator v5.1.0, and with the Security Key plugged in, all screens blank. In Chrome 114.0.5735.199 on Windows 10 Pro, there is no "security key settings pane". The closest thing available is "Privacy and Security -> Security -> Manage phones (control which phones you use as security keys.)" However, in terms of resident credentials, I thank the GP and I stand corrected, because Yubico…

CTAP1 is only used for talking to old U2F keys.

Additionally, U2F/CTAP1 does not support resident keys anyway (IIRC).

Re: Passkeys will come at a cost

#295

Post by foobiekr »

cbsmith wrote: post #156
0cf8612b2e1e wrote: post #35

Earlier quoted context omitted.

> You don't want to ever share the shared secret across devices (or back it up) Hard disagree there. I do not feel comfortable unless I can backup a key. Phones get lost/broken/stolen all the time. Is it less theoretically secure? Sure, whatever, but I am not James Bond.

The usual solution for this is to have multiple keys. It's logically equivalent to having a backup key, but it's more secure because if you lose a key, you can use another key to disable the lost key.

The problem is you don’t actually know these keys do or do not work until you need them to. This is not a trivial failure mode for many systems.

Re: Passkeys will come at a cost

#296

Post by j16sdiz »

rcxdude wrote: post #86
0cf8612b2e1e wrote: post #35

Earlier quoted context omitted.

> You don't want to ever share the shared secret across devices (or back it up) Hard disagree there. I do not feel comfortable unless I can backup a key. Phones get lost/broken/stolen all the time. Is it less theoretically secure? Sure, whatever, but I am not James Bond.

The point is you would have a different key on different devices, each of which can access your account. This gives you a backup, in fact a better one, because if one is comprimised and locked out you can still use the others. The main challenge is automating this process so you can properly mirror your keyring across multiple devices, which I don't think there's a standard solution to. So it would be a manual proces…

> The point is you would have a different key on different devices, each of which can access your account.

How would you sign up a new service under this scheme?

Enroll with one device, swap the hardware key, and enroll with the other key?

What if two device are not in the same physical location?

Re: Passkeys will come at a cost

#297

Post by forty »

I understand that this person is not happy that a feature that is designed to make billions of users safer, might make life annoying for the handful of people who are using a hardware security key when they use that feature :)

Re: Passkeys will come at a cost

#298

Post by forty »

Possible solution: use your hardware security key to login to your password manager and use the password manager for Passkey login.

(Disclosure: I work for a PM which implements Passkeys)

Re: Passkeys will come at a cost

#299

Post by Roark66 »

dmix wrote: post #235

This is a bit unrelated to the harder crypto stuff but my mom called me freaking out she couldn’t get into her gmail. It turns out Google auto registered her new android phone with a passkey and made that the default Google login with a confusing passkey based interface (expecting her to know to click the second option to login via password or understand wtf a passkey is was too much IMO). It turns out when it said “…

Exactly, I'm seriously considering taking my business off google's ecosystem because of the unwanted "we've sent a notification to your phone" confirmation requirement. I could understand if they did that if I suddenly tried to login from the other side of the world, or let's say I always use Linux and suddenly my browser identifies as windows etc. But if you're running a privacy focused browsers (ungoogled chromium) it happens every single time you're trying to authenticate. From the same IP.

What if my phone is dead? What if I lost it and I'm trying to recover location service credentials by sending a password reset to my email and I can't login? Then the whole "answer some questions" dance starts. If a hidden and unaccountable algorithm decides you running ungoogled chromium on Linux is suspicious and you happen to misremember an answer to some question it might ask (what percentage of available storage are you currently using?) good luck gaining access. BTW, I a paying user of Google.

Re: Passkeys will come at a cost

#300

Post by a_random_canuck »

ptravers wrote: post #225
microtonal wrote: post #52

Since Apple didn't actually define it, this left a void for our thought leaders to answer that question for users hungry to know "what indeed is a passkey?". I have always understood that Apple defined a Passkey to be a key pair that is synced through iCloud Keychain. Even their WWDC 2021 presentation distinguishes passkeys to be different than security keys because they are "always with you" (the device sync aspect)…

passkeys are really defined by the FIDO Alliance Based on FIDO standards, passkeys are a replacement for passwords that provide faster, easier, and more secure sign-ins to websites and apps across a user’s devices. Unlike passwords, passkeys are always strong and phishing-resistant. [1] https://fidoalliance.org/passkeys/

This does not tell me what a passkey actually _is_.

The marketing around passkeys is absolutely infuriating.

Post reply on HN