Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys will come at a cost

fy.blackhats.net.au

Post reply on HN
Print view View original

391–400 of 600 posts

Re: Passkeys will come at a cost

#391

Post by JohnFen »

deltarholamda wrote: post #387
a_random_canuck wrote: post #300

Earlier quoted context omitted.

This does not tell me what a passkey actually _is_. The marketing around passkeys is absolutely infuriating.

I am a pretty technical user, and I would rather become a farmer than move to whatever "passkeys" are. Yubikeys or phones or whatever, I've had too many of these things go bzzzt, go missing, get wet, get broken, etc. If a "passkey" is as reliable as my house key or car key, i.e. I can accidentally put it through a wash/dry cycle, then maybe. Maybe. The nice thing about a username/password combo is I can remember them…

> The nice thing about a username/password combo is I can remember them and use them everywhere.

The "use them everywhere" part, combined with not needing special software or hardware to use them, are the things that will keep passwords central to my authentication world for a very, very long time.

Re: Passkeys will come at a cost

#392

Post by JohnFen »

klabb3 wrote: post #263
sedatk wrote: post #128

Earlier quoted context omitted.

That's indeed scary. Losing your 2nd factor shouldn't block you from accessing your accounts indefinitely . There should at least be one recovery path outside 2FA be it "printed recovery keys", "email recovery", "support channels", or even (despite being fully insecure) SMS maybe with a grace period (like 48 hours). Backing up your 2FA secrets isn't user-friendly at all, and it's even harder after you've started usin…

> Losing your 2nd factor shouldn't block you from accessing your accounts indefinitely. You’re absolutely right and also you don’t have to worry. Everyone who operate auth of any sort will be forced on day one to have reasonable recovery. Nobody is gonna lock customers out because you lost their super-secret private key. In practice, it goes back to email recovery for 98% of services. This will remain true with passk…

> In practice, it goes back to email recovery for 98% of services. This will remain true with passkeys.

My understanding is that passkeys are really intended for the non-technically-skilled users.

So then, how will passkeys succeed with that audience? A high percentage of them already routinely use password recovery mechanisms rather than keeping track of their passwords. That's an established habit. If they can keep doing that, then why wouldn't they?

Re: Passkeys will come at a cost

#393

Post by JohnFen »

jabbany wrote: post #286
stronglikedan wrote: post #212

Earlier quoted context omitted.

> KeePass, which apparently supports them, who knew... Bitwarden, too. I no longer have to worry about not having my phone on me, or even having to take it out of my pocket.

>I no longer have to worry about not having my phone on me, or even having to take it out of my pocket. I mean, I appreciate the convenience but can't help feel like this is cheating... The whole point of 2fa was to verify you had the 2fa device and this basically defeats that.

"Cheating" is an odd way to put it.

Everyone has their own security risk profile. If someone decides that effective 2FA isn't worth it considering their own profile, that's legitimate. It's not "cheating", it's finding ways to work with the system you have in the way that you deem best for you.

Re: Passkeys will come at a cost

#394

Post by JohnFen »

SebastianKra wrote: post #177
runiq wrote: post #48

Earlier quoted context omitted.

I'm pretty sure the goal here is to turn your phone into your passkey, _and nothing else_. Everything written in that article makes sense if you keep that in mind.

No, the idea is to turn _every_ device into your passkey, and also at least one cloud provider of your choice.

And for those of us who choose no cloud providers at all?

Re: Passkeys will come at a cost

#395

Post by skinkestek »

Spooky23 wrote: post #360
mgkimsal wrote: post #349

Earlier quoted context omitted.

Somewhat unrelated, but I got one of those Google Titan fobs. The one time I needed it to work - authenticating from a new-to-me- computer - it just... didn't work. I plugged it in and... nothing. No popups, no reaction at all. Thought it was broken, but it worked back on another computer when I tried it later. No idea how that this future is supposed to be better. Perhaps titans are just duds? A couple yubikey-focus…

My company uses these tokens and buys Yubikey or Titans depending on price. They are pretty similar although Yubi has more features (that we don’t use) I don’t recall having a failure over about 3000 devices. Usually the issue is people lose them. You have to have a system that makes sense to use them successfully. The upthread guy is talking about multiple accounts lost forever, etc. Sounds like a mess. The same pro…

My YubiKey has failed me a number of times. I have had to register it again and again.

Lately there has been less problems but I have no idea why.

Re: Passkeys will come at a cost

#396

Post by gerwim »

LinuxBender wrote: post #386

Given that passkeys are tied to a hardware ID does that mean people will eventually stop using VPN's, given they can potentially be de-cloaked by anything that can talk to their TPM?

Passkeys are not tied to hardware. You can save them in iCloud, Bitwarden and lots of other tools. You can also share them to another device [1]

[1] https://developer.apple.com/passkeys/

Re: Passkeys will come at a cost

#397

Post by LinuxBender »

gerwim wrote: post #396
LinuxBender wrote: post #386

Given that passkeys are tied to a hardware ID does that mean people will eventually stop using VPN's, given they can potentially be de-cloaked by anything that can talk to their TPM?

Passkeys are not tied to hardware. You can save them in iCloud, Bitwarden and lots of other tools. You can also share them to another device [1] [1] https://developer.apple.com/passkeys/

I am factoring friction and laziness into this. Just about everyone excluding apple hardware has a TPM and it's already paid for. Not everyone has iCloud, Bitwarden or other tools. So there is what people can do vs what people will do and I think they will be guided if not now, then eventually into using the TPM since it is already present. People tend to follow the least path of clicks. Windows for example automatically takes ownership of the TPM by default.

People on Apple hardware will probably use iCloud which may be tied to their real identity. This creates a lot more questions for me but that is probably best saved for it's own thread.

Re: Passkeys will come at a cost

#398

Post by tatersolid »

yomlica8 wrote: post #368
tsimionescu wrote: post #305

Earlier quoted context omitted.

This idea of printing out recovery codes seems so deeply out of touch with basically everyone leading a modern digital life that I can't believe serious security experts actually recommend it with a straight face. No one has a printer anymore, and I'm sure as hell not including a trip to a local printshop as a part of signing up to 2FA for some random site (yes, even Gmail).

Can't you just print them to PDF?

And store that PDF where? Inside your Google drive which you can’t access within your t that PDF? On the same device you just lost?

If you suggest “on a thumb drive kept offline” you’ve just recreated all the problems of physical FIDO keys without offering any phishing protection.

Re: Passkeys will come at a cost

#399

Post by NotYourLawyer »

makeitdouble wrote: post #282
NotYourLawyer wrote: post #244

Earlier quoted context omitted.

Whether it’s on-die or a separate chip, flash is just dirt cheap nowadays.

Is it ? Looking at this for instance, we're still around 1 USD per GB for a reliable storage chip: https://www.amazon.com/Kingston-Industrial-32GB-microSDHC-Ad...

How much space does a key take though?

Re: Passkeys will come at a cost

#400

Post by forty »

ericjmorey wrote: post #371
forty wrote: post #327

Earlier quoted context omitted.

Passkeys are not MFA, Passkeys are expected to be used as a single authentication factor.

The passkey security model is designed with the assumption of the passkey ties to a device. Using a password manager that's tied to a centralized service that's accessible from any web browser with an internet connection makes the security model different. It seems to me like a passkey on a password manager is no different than a username and password with NO 2FA security model.

The whole idea of Passkey is that the credentials are syncable. The main implementations of passkey are probably going to be Platforms (Google/Apple/Microsoft) and Password Managers. In both cases the credentials will be syncable and tied to a centralized service.

The main difference with passwords is that passkey are not phishable (since you never send them to the website you authenticate to)

Post reply on HN