Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys will come at a cost

fy.blackhats.net.au

Post reply on HN
Print view View original

351–360 of 600 posts

Re: Passkeys will come at a cost

#351

Post by mgkimsal »

esperent wrote: post #240
dmix wrote: post #235

This is a bit unrelated to the harder crypto stuff but my mom called me freaking out she couldn’t get into her gmail. It turns out Google auto registered her new android phone with a passkey and made that the default Google login with a confusing passkey based interface (expecting her to know to click the second option to login via password or understand wtf a passkey is was too much IMO). It turns out when it said “…

I have the same problem with Google 2FA. "We sent a notification to your S21". No, I'm holding my S21 in my hand, unlocked. About 1/3 of the time, there's no notification. Or it takes five minutes to arrive. This is only one of many problems I've had with Google recently. I went from haphazardly trying to avoid their products for privacy reasons to now putting max effort into minimizing my Google usage because everyt…

> Hell, I'm an anti-Google evangelist now.

Welcome to the club. I still have a gmail I use for some family and old friends, and there's a lot of history there, but I generally avoid using it unless it's a throwaway now. And... when dealing with clients, I suggest alternatives to GA, google maps, etc. Occasionally they override me, but I'm helping to get alternatives out there.

12-15 years ago, I was using google pay/wallet/something to accept payments for some projects. They just... rebadged it, changed the terms, etc. I couldn't even figure out what it was being changed to entirely, but, they seemed to not give a shit about orgs like mine who were trying to use their products to conduct business, so I gave up.

I've told my stories to many folks in person; I'll get "oh, you didn't understand abc.." or "that's never happened to me - you must have done something wrong". About a quarter of those people later indicate to me that... yep... they've been hit by some weird google bug or issue or deprecation or abandonment that cost them time/money with no real support options, and they then take steps to get off the google train.

I know I still have a ways to go to get anything critical to my life out of google's way, but every month I get a bit closer.

Re: Passkeys will come at a cost

#352

Post by simooooo »

darthwalsh wrote: post #98
RandomBK wrote: post #24

Earlier quoted context omitted.

My hunch is low volume and an enterprise-leaning customer base. Engineers aren't cheap, and those who can build security-sensitive products even less so. When I bought a (single) Yubikey from their website late last year, it was Fedexed to me directly from their Palo Alto downtown office, not some distribution center in the middle of nowhere. That can't be cheap.

If you order a key and it comes from an Amazon warehouse, are you going to be worried about a supply chain attack? Maybe that's a benefit of sending by direct FedEx?

When I bought mine they (current owners) were actively advising against buying from Amazon. But who knows. Probably very unlikely

Re: Passkeys will come at a cost

#353

Post by bombolo »

klabb3 wrote: post #336
bombolo wrote: post #319

Earlier quoted context omitted.

> Nobody is gonna lock customers out because you lost their super-secret private key. https://www.nytimes.com/2022/08/21/technology/google-surveil...

To be fair I said “customers”.

I pay google. Do you think I'd have a different experience?

Re: Passkeys will come at a cost

#354

Post by tzs »

cbsmith wrote: post #156
0cf8612b2e1e wrote: post #35

Earlier quoted context omitted.

> You don't want to ever share the shared secret across devices (or back it up) Hard disagree there. I do not feel comfortable unless I can backup a key. Phones get lost/broken/stolen all the time. Is it less theoretically secure? Sure, whatever, but I am not James Bond.

The usual solution for this is to have multiple keys. It's logically equivalent to having a backup key, but it's more secure because if you lose a key, you can use another key to disable the lost key.

> It's logically equivalent to having a backup key, but it's more secure because if you lose a key, you can use another key to disable the lost key.

That's slightly more convenient but I don't see how it is more secure. With one key that has backups if I lose that key I can use one of the backups to disable that key.

Multiple keys is slightly more convenient in that scenario because with multiple keys I just have to disable the key that was lost, and then make a new key for the device that held that key and install it. With one key on multiple devices I'll have to install the new key on all of them.

Re: Passkeys will come at a cost

#355

Post by jabbany »

GTP wrote: post #342
jabbany wrote: post #91

Earlier quoted context omitted.

This is a terrible idea though. I had the misfortune of getting into a cycling accident which broke my phone display (completely lost display output and touch input), and it meant I lost access to all my OTP 2FAs for a couple of days (which is actually kind of scary). I was able to fix it myself by getting parts and going through an ifixit guide (right to repair anyone? ;-), after which I promptly exported my 2FA see…

Yes, KeePass (and KeepassX and KeePassXC) support generating 2FA codes, but it is generally not a good idea to store those alongside your passwords, as if you do those aren't a 2nd factor anymore. You can mitigate the issue by having an encrypted db only for 2FA codes, but I would still advise having those in a completely separate app anyway.

Yep. That's exactly what I did.

Imported the 2FA seeds into a special new db that's in then put in cold storage (unlike the regular db that gets synced around).

Re: Passkeys will come at a cost

#356

Post by BiteCode_dev »

mgkimsal wrote: post #349
BiteCode_dev wrote: post #316

Earlier quoted context omitted.

After I deleted my personal google accounts, I was left with work google accounts I would have to maintain. I have been bitten by this problem more than once, resulting in: - losing some accounts forever - losing temporarily access to accounts, preventing me to work for some time - forcing me to go through recovery procedures with tedious docs and hostile UI, wasting my work time I eventually found a trick: buy 3 yub…

Somewhat unrelated, but I got one of those Google Titan fobs. The one time I needed it to work - authenticating from a new-to-me- computer - it just... didn't work. I plugged it in and... nothing. No popups, no reaction at all. Thought it was broken, but it worked back on another computer when I tried it later. No idea how that this future is supposed to be better. Perhaps titans are just duds? A couple yubikey-focus…

Yukibey based workflow are finicky. Sometimes, I need to try several times and reload the page or unplug/plug back for it to work. Sometimes, I need to switch key.

It's like arch linux.

Everybody tells there is never a problem with it, because, well, geeks lie.

Doesn't mean it's not useful.

I have a part of the article "Why not tell people to "simply" use pyenv, poetry or anaconda" (https://www.bitecode.dev/p/why-not-tell-people-to-simply-use) talking about this lying problem.

But I probably should make it a separate article, because that's an independent issue in itself.

Re: Passkeys will come at a cost

#357

Post by jabbany »

jeroenhd wrote: post #329
jabbany wrote: post #182

Earlier quoted context omitted.

See, this where the metaphor breaks down. At no point was the phone "lost". The 2fa tokens are perfectly safe yet there's no way to get to them... even though you still "have" the things, you can't prove you have it. Which is why having 2FA _solely_ on a phone (like OP implies) is a bad idea. It's a fragile device that can easily render you unable to prove yoh still have it.

If I break my house key I can know exactly where the broken parts are but I still can't unlock my front door. "Broken" and "lost" are the same things here. Of course you shouldn't rely solely on your phone, that's what the recovery keys any decent website makes you save or print out are for, or the other alternative 2FA options.

> If I break my house key I can know exactly where the broken parts are but I still can't unlock my front door.

This actually isn't true (it's exactly why digital 2FA is different!) If you break a physical key (already much less likely) you can still read the bitting (~ password) off of it. Bring the broken pieces to a competent locksmith and they can originate a new key for you. 2FA doesn't let you do this (intentionally, it's not a bad thing but it does mean recovery is harder).

> recovery keys any decent website makes you save or print out are for

Right, and almost all of the services that I still have on TOTP 2FA are not decently implemented... and do not have the concept of recovery keys (they are actually a somewhat recent inclusion in the setup process)! Sites that are modern enough to have made recovery codes usually also support HW tokens which I would've used instead.

Re: Passkeys will come at a cost

#358

Post by ubermonkey »

I'm honestly still looking or a one-sheet on why I should care about passkeys, and under what circumstances I should adopt them.

I get it. It's a complex topic. When I was younger I would've jumped in and read about it obsessively, but I no longer have the time or motivation to do so.

Is there a good resource that answers this mail?

Re: Passkeys will come at a cost

#359

Post by tzs »

dathinab wrote: post #21
upofadown wrote: post #5

This raises a question for me. Why are hardware keys so limited in storage? How much extra would it cost to have a secure processor that could access a mass storage device also built in to the key. This mass storage device would of course be strongly encrypted by the secure processor with a key that would be erased at the same time everything else is erased.

Because secure tamper resistend storage is expensive. I would even go as far and say from a security POV the best security key is the key which has 0 storage. Because in my experience any protocol which injects and stores a secure token into a security key/enclave/whatever instead of deriving it from shared secrets etc. has serious flaws. Sometimes it's fundamentally security flaws (like TOTP). Sometimes it's complex…

> Because secure tamper resistend storage is expensive

The storage for resident keys would not need to be tamper proof. All that needs to be tamper proof is the processor that operates on unencrypted sensitive data and the storage for the private keys of the device.

The resident keys would be encrypted using a device private key before being saved to mass storage.

Re: Passkeys will come at a cost

#360

Post by Spooky23 »

mgkimsal wrote: post #349
BiteCode_dev wrote: post #316

Earlier quoted context omitted.

After I deleted my personal google accounts, I was left with work google accounts I would have to maintain. I have been bitten by this problem more than once, resulting in: - losing some accounts forever - losing temporarily access to accounts, preventing me to work for some time - forcing me to go through recovery procedures with tedious docs and hostile UI, wasting my work time I eventually found a trick: buy 3 yub…

Somewhat unrelated, but I got one of those Google Titan fobs. The one time I needed it to work - authenticating from a new-to-me- computer - it just... didn't work. I plugged it in and... nothing. No popups, no reaction at all. Thought it was broken, but it worked back on another computer when I tried it later. No idea how that this future is supposed to be better. Perhaps titans are just duds? A couple yubikey-focus…

My company uses these tokens and buys Yubikey or Titans depending on price. They are pretty similar although Yubi has more features (that we don’t use) I don’t recall having a failure over about 3000 devices. Usually the issue is people lose them.

You have to have a system that makes sense to use them successfully. The upthread guy is talking about multiple accounts lost forever, etc. Sounds like a mess.

The same problems exist on other platforms. Ever support challenge response tokens? Lol.

Post reply on HN