Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys will come at a cost

fy.blackhats.net.au

Post reply on HN
Print view View original

401–410 of 600 posts

Re: Passkeys will come at a cost

#401

Post by thrashh »

tatersolid wrote: post #398
yomlica8 wrote: post #368

Earlier quoted context omitted.

Can't you just print them to PDF?

And store that PDF where? Inside your Google drive which you can’t access within your t that PDF? On the same device you just lost? If you suggest “on a thumb drive kept offline” you’ve just recreated all the problems of physical FIDO keys without offering any phishing protection.

You could just store them in a separate password manager like BitWarden? Or even encrypted in a separate Dropbox account?

Ultimately if you want to be able to recover your identity from anywhere in the world with absolutely nothing on you except cash (to buy a new device and service), you have to store this data somewhere. And you wouldn’t store this data in the same place that you’re trying to recover because that’s not very useful.

Is it without risk? No, but there is no risk-less way to be able to recover a piece of data once you lose all your possessions somewhere random in the world because the only thing you have left that you can still use is what you know.

Re: Passkeys will come at a cost

#402

Post by cbsmith »

foobiekr wrote: post #295
cbsmith wrote: post #156

Earlier quoted context omitted.

The usual solution for this is to have multiple keys. It's logically equivalent to having a backup key, but it's more secure because if you lose a key, you can use another key to disable the lost key.

The problem is you don’t actually know these keys do or do not work until you need them to. This is not a trivial failure mode for many systems.

The same is true for physical keys for cars, houses, lockers, etc., which is why people have an intuition to test out keys to make sure that they work.

Re: Passkeys will come at a cost

#403

Post by cbsmith »

qudat wrote: post #340
cbsmith wrote: post #279

Earlier quoted context omitted.

> People are constantly losing their keys prolly about as much as people reuse the same password for multiple services. But when they lose their keys, they have a pretty clear mental model of the security risk and how to mitigate it.

What happens when you lose your passkey?

Exactly.

Re: Passkeys will come at a cost

#404

Post by cbsmith »

bombolo wrote: post #288
cbsmith wrote: post #280

Earlier quoted context omitted.

...and there are, and they're remarkably similar to what you do with Yubikeys: you have extra keys, and when you lose one, you uses the other to get in, and then you invalidate the old keys (although in the physical world, this means getting a new lock and a new set of keys, instead of just getting one new key and removing the lost key as a valid key).

Except you'd have to invalidate a yubikey on countless websites.

I mean, if you're using a key to get in to countless physical things, then you have the same problem.

Re: Passkeys will come at a cost

#405

Post by cbsmith »

nucleardog wrote: post #246
cbsmith wrote: post #150

Earlier quoted context omitted.

> The security community really needs to get a grip and start designing systems that are compatible with the extremely low-tech-interest population if we even have a hope of securing systems. If I knew what the solution was I'd be rich. Most of that population seems to do fine managing house keys, car keys, locker keys, etc.

Because they don’t really have any other choice. You get a key with the lock. Even if they all happen to be the same blank, it’s substantial work and expense to get them all keyed alike for most people. Maybe that’s our solution right there—when you register for a service instead of relying on users to select a secure, unique password we should generate a “correct horse battery staple” and only support rerolls, not s…

> Because they don’t really have any other choice. You get a key with the lock. Even if they all happen to be the same blank, it’s substantial work and expense to get them all keyed alike for most people.

You have lots of other choices. You could use combination locks, time locks, biometric security measures, paired keys, etc. The simple key-based lock seems to be particularly simple and accessible to consumers.

Re: Passkeys will come at a cost

#406

Post by danShumway »

livueta wrote: post #95
jabbany wrote: post #91

Earlier quoted context omitted.

This is a terrible idea though. I had the misfortune of getting into a cycling accident which broke my phone display (completely lost display output and touch input), and it meant I lost access to all my OTP 2FAs for a couple of days (which is actually kind of scary). I was able to fix it myself by getting parts and going through an ifixit guide (right to repair anyone? ;-), after which I promptly exported my 2FA see…

Maybe I'm getting tinfoil-y here, but I think the horribleness is the point: consider how eager Apple in particular is to get people fully enmeshed in their services ecosystem. You're a lot less likely to try to roll your own backup, or otherwise exit the walled garden, if doing so means your entire auth story is irredeemably fucked. The thing that strikes me about this whole story is that during a lot of the initial…

I'm pretty nervous about Passkeys for exactly these reasons, and I'm still not at the point where I feel comfortable advocating for them, but I'm forced to admit that if anything, Apple has (so far) arguably done the best job of any of the major tech companies at discouraging vendor lock-in with Passkeys.

Blocking attestation requirements, opening up 3rd-party providers earlier, and (I'm not sure if it's released yet) committing to search. I even saw recently that they're releasing Chrome/Edge extensions for Windows to sync keys.

Do I trust it? Ehhh... I still can't generate passkeys on Linux as far as I know, so I'm definitely not going to be using them any time soon no matter what. There are still articles like this pointing out abusable features that I'm not sure should even exist in the first place. And it's honestly just going to be a while for me to get over the weird amount of advocacy that so drastically misunderstands what portability even is in the first place (no, 1Password does not make passkeys portable, standardized export/import formats as a requirement for certification make passkeys portable).

But I think the signs are that Apple is caring a lot more about avoiding vendor lock-in than Google/Microsoft are right now, which is a very weird thing for me to say.

Re: Passkeys will come at a cost

#407

Post by jabbany »

JohnFen wrote: post #393
jabbany wrote: post #286

Earlier quoted context omitted.

>I no longer have to worry about not having my phone on me, or even having to take it out of my pocket. I mean, I appreciate the convenience but can't help feel like this is cheating... The whole point of 2fa was to verify you had the 2fa device and this basically defeats that.

"Cheating" is an odd way to put it. Everyone has their own security risk profile. If someone decides that effective 2FA isn't worth it considering their own profile, that's legitimate. It's not "cheating", it's finding ways to work with the system you have in the way that you deem best for you.

In that case, why bother with 2FA though...?

I use some services that support 2FA that I don't have 2FA enabled on because I don't care if those accounts get hacked/leaked...

Re: Passkeys will come at a cost

#408

Post by JohnFen »

jabbany wrote: post #407
JohnFen wrote: post #393

Earlier quoted context omitted.

"Cheating" is an odd way to put it. Everyone has their own security risk profile. If someone decides that effective 2FA isn't worth it considering their own profile, that's legitimate. It's not "cheating", it's finding ways to work with the system you have in the way that you deem best for you.

In that case, why bother with 2FA though...? I use some services that support 2FA that I don't have 2FA enabled on because I don't care if those accounts get hacked/leaked...

Some services require 2FA/MFA whether you personally want it or not.

Re: Passkeys will come at a cost

#409

Post by cbsmith »

bmurphy1976 wrote: post #180
cbsmith wrote: post #150

Earlier quoted context omitted.

> The security community really needs to get a grip and start designing systems that are compatible with the extremely low-tech-interest population if we even have a hope of securing systems. If I knew what the solution was I'd be rich. Most of that population seems to do fine managing house keys, car keys, locker keys, etc.

You sure about that? I inherited what feels like 1,000 keys when my in-laws passed away. Who the hell knows what any of them are for, and they sure as hell didn't.

...and from this you're concluding that keys are a broken technology?

It doesn't seem realistic to expect to build a tool that nobody misuses.

Re: Passkeys will come at a cost

#410

Post by cbsmith »

tzs wrote: post #354
cbsmith wrote: post #156

Earlier quoted context omitted.

The usual solution for this is to have multiple keys. It's logically equivalent to having a backup key, but it's more secure because if you lose a key, you can use another key to disable the lost key.

> It's logically equivalent to having a backup key, but it's more secure because if you lose a key, you can use another key to disable the lost key. That's slightly more convenient but I don't see how it is more secure. With one key that has backups if I lose that key I can use one of the backups to disable that key. Multiple keys is slightly more convenient in that scenario because with multiple keys I just have to…

Convenience is a key aspect of security, but consider the scenario where you have to replace all your locks while you issue a new key... you have to keep the extant key valid for a longer period of time.
Post reply on HN