Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys will come at a cost

fy.blackhats.net.au

Post reply on HN
Print view View original

311–320 of 600 posts

Re: Passkeys will come at a cost

#311

Post by bombolo »

Roark66 wrote: post #299
dmix wrote: post #235

This is a bit unrelated to the harder crypto stuff but my mom called me freaking out she couldn’t get into her gmail. It turns out Google auto registered her new android phone with a passkey and made that the default Google login with a confusing passkey based interface (expecting her to know to click the second option to login via password or understand wtf a passkey is was too much IMO). It turns out when it said “…

Exactly, I'm seriously considering taking my business off google's ecosystem because of the unwanted "we've sent a notification to your phone" confirmation requirement. I could understand if they did that if I suddenly tried to login from the other side of the world, or let's say I always use Linux and suddenly my browser identifies as windows etc. But if you're running a privacy focused browsers (ungoogled chromium)…

> What if my phone is dead?

You get to have a fresh start at life!

Re: Passkeys will come at a cost

#312

Post by silon42 »

runiq wrote: post #48
dathinab wrote: post #16

> rk=required why does that even exist, that shouldn't be an option this stuff is why I have been so worried/skeptical about Passkeys and the people related to it. They have the responsibility to design their protocols to not be a tool well suited for big coperations like Microsoft to seriously mess up security, compatibility and enact all kinds of "bad faith" market practices to kill competition. But instead again a…

I'm pretty sure the goal here is to turn your phone into your passkey, _and nothing else_. Everything written in that article makes sense if you keep that in mind.

I fully expect to lose access to all accounts where this is a requirement...

I also missed the "Linux" authenticator section.

Re: Passkeys will come at a cost

#313

Post by leokennis »

Dumb question, but how much more would a YubiKey or something cost if they added a marginal amount of storage so it could hold an almost infinite amount of these keys? I’d imagine something like 32 Mb would allow you to already store 1000’s of keys.

Re: Passkeys will come at a cost

#314

Post by slau »

forty wrote: post #298

Possible solution: use your hardware security key to login to your password manager and use the password manager for Passkey login. (Disclosure: I work for a PM which implements Passkeys)

I don't want to store passkeys in my password manager, the same way that I don't want my TOTPs to be stored in my password manager.

If my 1P/LastPass/BitWarden gets hacked/compromised/pwned by someone across the globe, they still can't compromise my critical services because they don't have my hardware token. I just have to rotate all of my passwords.

If you store everything in your password manager, you've just turned your 2FA/MFA into 1FA.

This is also why you shouldn't copy SSH private keys around, just because "it's easier to only have one fingerprint". Generate one private key per device. This is somewhat mitigated by `-sk` type keys, though. (SK SSH keys are still basically unusable because they are not recognised by a significant amount of versions of SSH, including the default MacOS SSH client).

Re: Passkeys will come at a cost

#315

Post by aktuel »

FrozenSynapse wrote: post #309
aktuel wrote: post #308

Why not simply allow users to specify any public ssh key as an authentication factor? And create a UI around that? Why do we need to create more and more new security crap that no sane person understands?

And how many sane persons will understand what a public ssh key is?

I admit sane is a relative term.

All I care about is that the keys are ssh keys and the protocol is ssh auth. Then do with that what you will. Store the keys in the cloud if you must. When a user creates an account on a site the browser gives the user a choice to either select an existing identity or create a new one. All very straight forward. You don't have to mention anything about ssh, RSA or ssh. Nobody is forced to learn what ssh means or how it works.

Re: Passkeys will come at a cost

#316

Post by BiteCode_dev »

Roark66 wrote: post #299
dmix wrote: post #235

This is a bit unrelated to the harder crypto stuff but my mom called me freaking out she couldn’t get into her gmail. It turns out Google auto registered her new android phone with a passkey and made that the default Google login with a confusing passkey based interface (expecting her to know to click the second option to login via password or understand wtf a passkey is was too much IMO). It turns out when it said “…

Exactly, I'm seriously considering taking my business off google's ecosystem because of the unwanted "we've sent a notification to your phone" confirmation requirement. I could understand if they did that if I suddenly tried to login from the other side of the world, or let's say I always use Linux and suddenly my browser identifies as windows etc. But if you're running a privacy focused browsers (ungoogled chromium)…

After I deleted my personal google accounts, I was left with work google accounts I would have to maintain.

I have been bitten by this problem more than once, resulting in:

- losing some accounts forever

- losing temporarily access to accounts, preventing me to work for some time

- forcing me to go through recovery procedures with tedious docs and hostile UI, wasting my work time

I eventually found a trick: buy 3 yubikeys, attach each of them to all your accounts, have one on my key ring, one in my desk, one in my bag.

Now, the only thing google ever ask is the yubikey, no matter where I connect from, and I always have one on me. It doesn't require a smarphone, a phone number or an email.

I'm still trying to get rid of as many google accounts as I can, though. Personally, I'm very caution about any dependency on google services, and professionally, adamant to avoid dependency as much as it's reasonably possible.

I used to be a google fan 20 years ago. Between the bad user support, the privacy invasion, the decreasing search quality, the monopolistic practices, the censorship, the DMCA situation, the product cancellations, the term of use / price switcheroo and those shenanigans, they are consistently destroying my faith in them.

But they will not pay the price for it. First, they have enough money to make mistake for a long time without even noticing. Second, they will pull off a Microsoft PR stunt in 15 years, and everybody will forget and forgive.

Re: Passkeys will come at a cost

#317

Post by Barrin92 »

Roark66 wrote: post #299
dmix wrote: post #235

This is a bit unrelated to the harder crypto stuff but my mom called me freaking out she couldn’t get into her gmail. It turns out Google auto registered her new android phone with a passkey and made that the default Google login with a confusing passkey based interface (expecting her to know to click the second option to login via password or understand wtf a passkey is was too much IMO). It turns out when it said “…

Exactly, I'm seriously considering taking my business off google's ecosystem because of the unwanted "we've sent a notification to your phone" confirmation requirement. I could understand if they did that if I suddenly tried to login from the other side of the world, or let's say I always use Linux and suddenly my browser identifies as windows etc. But if you're running a privacy focused browsers (ungoogled chromium)…

>Then the whole "answer some questions" dance starts.

Google literally does provide you with backup codes that they tell you to keep offline available, which is pretty common practice for any 2FA scheme.

Re: Passkeys will come at a cost

#318

Post by nelox »

a_random_canuck wrote: post #300
ptravers wrote: post #225

Earlier quoted context omitted.

passkeys are really defined by the FIDO Alliance Based on FIDO standards, passkeys are a replacement for passwords that provide faster, easier, and more secure sign-ins to websites and apps across a user’s devices. Unlike passwords, passkeys are always strong and phishing-resistant. [1] https://fidoalliance.org/passkeys/

This does not tell me what a passkey actually _is_. The marketing around passkeys is absolutely infuriating.

I agree!

> This does not tell me what a passkey actually _is_.

FAQ's [sic] - Passkey - What is a Passkey?

https://fidoalliance.org/passkeys/#faq

Third paragraph, second sentence

> "The cryptographic keys are used from end-user devices (computers, phones, or security keys) that are used for secure user authentication."

"The cyptopgraphic keys" is casually mentioned here with an implied reference to being passkeys. It never explicitly states passkeys are, in fact, "cyptopgraphic keys".

Very poor communication indeed.

Re: Passkeys will come at a cost

#319

Post by bombolo »

klabb3 wrote: post #263
sedatk wrote: post #128

Earlier quoted context omitted.

That's indeed scary. Losing your 2nd factor shouldn't block you from accessing your accounts indefinitely . There should at least be one recovery path outside 2FA be it "printed recovery keys", "email recovery", "support channels", or even (despite being fully insecure) SMS maybe with a grace period (like 48 hours). Backing up your 2FA secrets isn't user-friendly at all, and it's even harder after you've started usin…

> Losing your 2nd factor shouldn't block you from accessing your accounts indefinitely. You’re absolutely right and also you don’t have to worry. Everyone who operate auth of any sort will be forced on day one to have reasonable recovery. Nobody is gonna lock customers out because you lost their super-secret private key. In practice, it goes back to email recovery for 98% of services. This will remain true with passk…

> Nobody is gonna lock customers out because you lost their super-secret private key.

https://www.nytimes.com/2022/08/21/technology/google-surveil...

Re: Passkeys will come at a cost

#320

Post by bombolo »

tsimionescu wrote: post #305
jabbany wrote: post #143

Earlier quoted context omitted.

> I DO have to remember some passcodes which I otherwise never use but that's not too hard. Right, but you're giving up a lot of security to do this, since it implies with these rare passcodes someone else could also bootstrap your logins. With HW tokens, you don't have to worry about recovery passcodes being leaked/hacked (the recommended procedure today is to print out the recovery codes and destroy digital copies)…

This idea of printing out recovery codes seems so deeply out of touch with basically everyone leading a modern digital life that I can't believe serious security experts actually recommend it with a straight face. No one has a printer anymore, and I'm sure as hell not including a trip to a local printshop as a part of signing up to 2FA for some random site (yes, even Gmail).

Print the recovery codes! For security!

Of course to do that I need to go to a public library where I have no idea if they keep copies, and where someone might mistakenly take them from the printer, which is very far away from the computer you must use to print.

Post reply on HN