Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys will come at a cost

fy.blackhats.net.au

Post reply on HN
Print view View original

381–390 of 600 posts

Re: Passkeys will come at a cost

#381

Post by runeks »

dwaite wrote: post #268
torstenvl wrote: post #161

I'm not a security or crypto guy at all. I found this very difficult to follow, and I suspect others might too. My questions probably seem weird to someone with enough background context to understand the post, but I am getting wrapped around the axle every sentence or two. > It all comes down to one thing - resident keys. How/why? What's the connection to passkeys or HSMs? > we need to understand what a discoverable…

I believe the primary point is that WebAuthn is being pushed to use a "passkey" model where each site creates a credential that consumes storage. Displayable site and user account names, a user record handle, and the private key all take up storage, along with a few other items. A mobile phone could store 10 thousand passkeys without breaking a sweat. Modern hardware keys might only be able to store 25 total in avail…

> The problem with this argument IMHO is that a lot of sites take a policy of not revealing if an account exists or not.

They don't, really. Because they have to prevent me from registering an account with the same identifier (username/email) as someone else, thus revealing whether an account exists or not. So the fact that the password recovery page doesn't reveal it makes no difference for someone who wants to know.

Re: Passkeys will come at a cost

#382

Post by thrashh »

jabbany wrote: post #143
thrashh wrote: post #122

Earlier quoted context omitted.

Knowing ahead of that problem, you can plan a solution though? Everything I have is cloud-synced and even if I lose my phone right now in a random country, I definitely know how I can recover all my 2FA tokens and logins from a random terminal (or preferably a new boxed phone) -- I DO have to remember some passcodes which I otherwise never use but that's not too hard. If Google or Apple implements this, they can desi…

> I DO have to remember some passcodes which I otherwise never use but that's not too hard. Right, but you're giving up a lot of security to do this, since it implies with these rare passcodes someone else could also bootstrap your logins. With HW tokens, you don't have to worry about recovery passcodes being leaked/hacked (the recommended procedure today is to print out the recovery codes and destroy digital copies)…

You can lose hardware tokens in the same way you lose a phone? Then you’re just as screwed?

This isn’t a hardware token versus passkey problem. It’s a problem period if you store a piece of vital data on a physical device. You can lose it, period.

The only way to restore that piece of vital data is to have a backup. To have it restorable from any connected part of the world with complete loss of your personal artifacts, either you need an very trusted intermediary that you can contact or you need to store it somewhere Internet-accessible, preferably encrypted with a key that you can remember.

It’s an information problem.

Re: Passkeys will come at a cost

#383

Post by Izkata »

wholinator2 wrote: post #337
Barrin92 wrote: post #317

Earlier quoted context omitted.

>Then the whole "answer some questions" dance starts. Google literally does provide you with backup codes that they tell you to keep offline available, which is pretty common practice for any 2FA scheme.

What? I've never been given backup codes, nor any notification that such a thing even existed.

I'm pretty sure they've existed since before TOTP was an option (I created mine in 2012, which was before I used any two-factor at least), but you have to go into your account settings to enable them:

https://myaccount.google.com/security

"Backup codes" is in the "How you sign in to Google" section.

Re: Passkeys will come at a cost

#384

Post by superkuh »

8organicbits wrote: post #163
superkuh wrote: post #94

HTTPS only like this blackhats.net.au site comes at a cost too. If there's a browser/server SSL mismatch the text becomes completely unavailable. While if it was an HTTP+HTTPS site I could simply visit the HTTP endpoint. Instead to protect against hypothetical downgrade attacks they've made their content inaccessible and effectively DoS themselves for a small fraction of visitors.

> small fraction of visitors This site won't work on Windows 7 / Chrome 69 as it only supports TLS 1.3 [1]. I believe 5% of the web can't connect [2]. But the text on the site is for technically minded people and the content includes commands you should run and security configuration. Tampering of the content could be quite harmful. [1] https://www.ssllabs.com/ssltest/analyze.html?d=fy.blackhats.... [2] https://caniu…

Tampering with the contents is quite unlikely. And anyone visiting a security site as a technically minded person probably has javascript disabled initially.

Requiring HTTPS only for this is like requiring people wear bulletproof vests to visit your backyard BBQ. There is no doubt they are "safer". But it's also pretty silly.

Re: Passkeys will come at a cost

#385

Post by NikolaNovak »

fuzztester wrote: post #321
a_random_canuck wrote: post #300

Earlier quoted context omitted.

This does not tell me what a passkey actually _is_. The marketing around passkeys is absolutely infuriating.

>This does not tell me what a passkey actually _is_. Right! And that is why I submitted this on HN: ELI5 Passkeys, Please: https://news.ycombinator.com/item?id=36715358

I would've hoped for more replies, given how excited and exciteable Hacker News is about passkeys :-/

Re: Passkeys will come at a cost

#387

Post by deltarholamda »

a_random_canuck wrote: post #300
ptravers wrote: post #225

Earlier quoted context omitted.

passkeys are really defined by the FIDO Alliance Based on FIDO standards, passkeys are a replacement for passwords that provide faster, easier, and more secure sign-ins to websites and apps across a user’s devices. Unlike passwords, passkeys are always strong and phishing-resistant. [1] https://fidoalliance.org/passkeys/

This does not tell me what a passkey actually _is_. The marketing around passkeys is absolutely infuriating.

I am a pretty technical user, and I would rather become a farmer than move to whatever "passkeys" are. Yubikeys or phones or whatever, I've had too many of these things go bzzzt, go missing, get wet, get broken, etc.

If a "passkey" is as reliable as my house key or car key, i.e. I can accidentally put it through a wash/dry cycle, then maybe. Maybe.

The nice thing about a username/password combo is I can remember them and use them everywhere. It's really straightforward. Whatever gimcrack method people use to implement "passkeys," does it work everywhere? Guaranteed?

I get it that there are some use cases where you need to have a hardware device, a passcode, a PIN and the blood of a left-handed virgin before you can access something, but those are edge cases. I almost never say this, but seriously, it would be easier and less troublesome to "educate users on the utility of passphrases instead of short passwords" than to make passkeys a thing.

Re: Passkeys will come at a cost

#388

Post by slaymaker1907 »

dmix wrote: post #235

This is a bit unrelated to the harder crypto stuff but my mom called me freaking out she couldn’t get into her gmail. It turns out Google auto registered her new android phone with a passkey and made that the default Google login with a confusing passkey based interface (expecting her to know to click the second option to login via password or understand wtf a passkey is was too much IMO). It turns out when it said “…

Honestly, I think if you’re using 2FA, you should also have 2 different ways to provide a 2nd factor (like TOTP or notification to your phone).

Re: Passkeys will come at a cost

#389

Post by t-3 »

I've never used one so have no idea, but do these security keys really have so little available storage space that they can only hold a few hundred passkeys, and if so, why?
Post reply on HN