Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys are now enabled by default for Google users

blog.google

Post reply on HN
Print view View original

481–490 of 684 posts

Re: Passkeys are now enabled by default for Google users

#481

Post by zappb »

metafunctor wrote: post #390
selcuka wrote: post #386

Earlier quoted context omitted.

There are workarounds, but that doesn't mean that passkeys is a half-baked technology. The real, simple solution would be a way to write down the passkey, similar to an SSH private key.

A main idea of passkeys is that the private keys are bound to hardware and cannot be copied. Using the private key is subject to biometric authentication. This eliminates a whole category of issues where the private key could get stolen. So no, writing down the SSH private key is not the solution. The solution is to trust multiple private keys, each stored within tamperproof hardware. This is also why, as a service p…

What kinds of services would benefit from this level of security? I could see it being useful in corporate contexts (like locking down which machines are allowed to remotely control other machines), but not as much from a general consumer point of view.

Re: Passkeys are now enabled by default for Google users

#482

Post by bobbylarrybobby »

darknavi wrote: post #296
jxcl wrote: post #286

Earlier quoted context omitted.

Currently, none of the big players in the passkey space support exporting or importing of passkeys, because the spec for doing this securely has not been agreed upon, and nobody wants to allow plaintext export of passkeys. See a recent post in the 1Password passkey AMA about this subject: https://old.reddit.com/r/1Password/comments/16to6x7/hey_redd... Re. your point about 1Password going down: Your passwords and pass…

> nobody wants to allow plaintext export of passkeys. While noble, why? 1Password exports a plaintext file that has all of the credentials in plaintext already.

Given all of the horror stories (some real, some hypothetical) told in this thread, it seems that one of the major side effects of passkeys — if not the primary purpose — is to keep you locked into whatever you used to create your passkey. Plaintext export would ameliorate that.

Re: Passkeys are now enabled by default for Google users

#483

Post by Bu9818 »

If I'm allowed to use a software implementation (like with TOTP) so that my private keys can be stored in for e.g. a KeePassXC database so that I can back it up by having multiple copies, then I'm okay with it. Is it possible for sites to deny certain webauthn providers (ignoring scenarios like attestation forcing you to use a locked down system where you can't run keepassxc)?

Hopefully Tor Browser can turn on security.webauth.webauthn in a safe way before sites force it to be used, too.

Re: Passkeys are now enabled by default for Google users

#484

Post by artursapek »

FireBeyond wrote: post #445
bombcar wrote: post #439

Earlier quoted context omitted.

Yes. You go an add secondary passkey when logged in on another device. Or with another tubikey. But not all setups support this. Some only allow one. Obvious issues abound.

> But not all setups support this. Some only allow one. Obvious issues abound. I'd go as far as to say "most setups don't support this. Most only allow one". The services I've seen so far that support multiple passkeys are in the minority.

I can't stand services that only support a single U2F key (cough AWS cough)

Re: Passkeys are now enabled by default for Google users

#485

Post by depereo »

eduction wrote: post #433
brundolf wrote: post #382

Earlier quoted context omitted.

Honestly, if they'd just give me the option to write it down (or take a picture or whatever) and manually restore it by typing it in if I need to, that would just about solve the issue

I like this idea of authenticating yourself by typing things in.

Seems like it'd be a little annoying to pick different things to type in for each service, maybe we could manage those, but still have a primary 'thing to type in' to the 'thing to type in' manager, which would then handle choosing and typing the various things into the various authentication boxes.

Re: Passkeys are now enabled by default for Google users

#486

Post by arzig »

ungamedplayer wrote: post #472
0cf8612b2e1e wrote: post #410

Earlier quoted context omitted.

It sounds like I am up the creek if all of my devices are gone. With a bank, if I lose paperwork, they will have a process in place for me to prove my identity. BigTech will shrug if my phone-locked passkey becomes inaccessible.

I recently watched a movie called the circle with Emma Watson where they want to tie the account with a corporation as a means of Id to register to vote. Imagine leaving identity to a corporate who simply shrugs off all but legal threats. It's terrifying and I reckon we are in our way there

I strongly recommend the book. It’s considerably better and gets into the dystopia better.

Re: Passkeys are now enabled by default for Google users

#487

Post by joshuamorton »

FireBeyond wrote: post #445
bombcar wrote: post #439

Earlier quoted context omitted.

Yes. You go an add secondary passkey when logged in on another device. Or with another tubikey. But not all setups support this. Some only allow one. Obvious issues abound.

> But not all setups support this. Some only allow one. Obvious issues abound. I'd go as far as to say "most setups don't support this. Most only allow one". The services I've seen so far that support multiple passkeys are in the minority.

Passkeys and u2f keys aren't the same. Systems must support multiple passkeys, otherwise you could only access the service from a single device, since passkeys are usually tied to a particular piece of hardware.

Re: Passkeys are now enabled by default for Google users

#488

Post by joshuamorton »

brnt wrote: post #442
metafunctor wrote: post #390

Earlier quoted context omitted.

A main idea of passkeys is that the private keys are bound to hardware and cannot be copied. Using the private key is subject to biometric authentication. This eliminates a whole category of issues where the private key could get stolen. So no, writing down the SSH private key is not the solution. The solution is to trust multiple private keys, each stored within tamperproof hardware. This is also why, as a service p…

Why is a piece of paper not a piece of hardware? We do this for TOTP too as a last resort, nothing wrong with that.

Totp is phishable. Passkeys aren't phishable. At the point where the user can access the private keys phishing is once again a concern.

If I can't access my pk, I cannot be phished. As soon as you allow me to copy my key (instead of creating many, which should be acceptable) I can be phished again.

Re: Passkeys are now enabled by default for Google users

#489

Post by qudat »

cpuguy83 wrote: post #446
jiggawatts wrote: post #339

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except … that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets lik…

This is just bad and uninformed advice. Adding a passkey to an account is like adding a yubikey to an account (experience wise). You can (typically) add multiple keys to your account. It's also not all or nothing. You can (in every service I've setup) still have a password and an even a TOTP.

There is no way adding multiple keys to your account is more work than a password manager. Just use a password manager and retain full control over your secrets.

Re: Passkeys are now enabled by default for Google users

#490

Post by vel0city »

FireBeyond wrote: post #445
bombcar wrote: post #439

Earlier quoted context omitted.

Yes. You go an add secondary passkey when logged in on another device. Or with another tubikey. But not all setups support this. Some only allow one. Obvious issues abound.

> But not all setups support this. Some only allow one. Obvious issues abound. I'd go as far as to say "most setups don't support this. Most only allow one". The services I've seen so far that support multiple passkeys are in the minority.

The majority of sites I've used that supported U2F/passkeys/yubikeys/webauthn support multiple. In fact the vast majority I've used supported multiple, only a few outliers only supported one.
Post reply on HN