Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

91–100 of 789 posts

Re: Passkeys: A shattered dream

#91

Post by IshKebab »

cco wrote: post #3

Oof, the Passkeys ecosystem is incredibly complex. Even as someone that deals with it day in and day out at $CURRENT_CO, it can be a headache. As an exercise from a developer's perspective, try creating a chart of every device type (mobile, desktop etc), browser, and Passkeys platform provider (Apple, Microsoft etc). Then fill out how each behaves across each combination, it is a nightmare! I'm hopeful that we'll see…

Yeah I agree. I am familiar with crypto and public key authentication and password hashing and so on, and I cannot follow all of the terms and use modes. To the average user it's going to be a complete black box. They won't have a clue what's going on.

With passwords it's fairly obvious. Even if you don't know about password hashing, semantically it is the same as how you would obviously expect. Same with password managers. It's obvious what they're doing.

So I think this would fail even if it didn't have all the problems the author mentioned - it's simply too complicated for normal people to understand and trust.

Re: Passkeys: A shattered dream

#92

Post by lambdaone »

JonChesterfield wrote: post #52
echoangle wrote: post #22

Earlier quoted context omitted.

I know that, but I didn’t think it was because of security. I don’t think of the US as particularly dangerous, but maybe my perception is wrong…

It's the guns and the police. People get angry or frightened. It's better for everyone else if they're not carrying a firearms at that point. Policing a nation where everyone is armed means the police are heavily armed and the non-insane ones very frightened all the time. See above.

Worse than that, having a gun doesn't make you safer; it increases the risk to everyone in your household. But I can absolutely understand why fear drives people to own guns -- it's a vicious circle as increased gun ownership drives fear, which in turn drives even more gun purchases...

Re: Passkeys: A shattered dream

#93

Post by ajsnigrutin »

madeofpalk wrote: post #86
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

I think it is true that you can's export passkeys stored in Apple Keychain. However, the statement is false in two ways: - Apple's iCloud Keychain syncs across devices - Apple has APIs that allow third party apps to create and offer passkeys, presented as a first-class option in Apple's authentication system. I use this to sync my passkeys between my Mac, Windows PC, and iPhone.

> - Apple's iCloud Keychain syncs across devices

...as long as you always keep buying apple.

Re: Passkeys: A shattered dream

#94

Post by tux3 »

4ad wrote: post #89
myspy wrote: post #88

I think I'm a tech guy and know my fields. I still have no real clue how passkeys work, how it is better, what it really is. When your security feature is not as simple as - remember a name and a password and store it somewhere safe - it doesn't work. Something about keys that are on devices. But what happens when I use a phone and a pc? How to get access then? Do I need a User/PW for the first time? Or do I need one…

Passkeys are exactly like SSH keys. You should use them exactly like you use SSH keys.

"Exactly" is under a lot of strain here.

SSH is nice because you don't have to think about it. Your private key sits in your .ssh folder, and then everything is transparent. You _can_ put an SSH key in a smartcard if you want, but you have to opt-in to this kind of pain. And even if you do, almost all SSH servers will support that login method without issue.

Passkeys don't sit in your .passkey folder. Your browser doesn't look for passkeys in a standard folder at all. You don't just do passkey-keygen like you would ssh-keygen and forget about it.

Websites might support various combinations of FIDO/U2F/TOTP security keys, your USB security key might support various combination of FIDO2/CTAP/WebAuthn, and the user will be left confused what any of this mess means, why there are so many competing standards, and why they're asked to scan a QR code when they plug in their dongle, and it doesn't just work at all.

Re: Passkeys: A shattered dream

#95

Post by ajsnigrutin »

DyslexicAtheist wrote: post #71
throwawayqqq11 wrote: post #56

Earlier quoted context omitted.

Just you wait for governments to require platforms to only accept gov-signed keys. I was sceptical about something-you-own auth vs. something-you-know auth from the beginning and recieved backlash from my tech peers for it. I hate to be able to go "told you so" on this one. Lets hope im wrong about the government involvement, but i dont think i will.

not to diminish your point, but since at decade or so I'm a more worried about corporate surveillance capitalism than I'm about government surveillance.

With a bit of a change, you can mostly avoid most of those corporations... you lose out on some tech goodies, but you can still live quite normally.

You cannot avoid the government.

Re: Passkeys: A shattered dream

#97

Post by vaylian »

4ad wrote: post #89
myspy wrote: post #88

I think I'm a tech guy and know my fields. I still have no real clue how passkeys work, how it is better, what it really is. When your security feature is not as simple as - remember a name and a password and store it somewhere safe - it doesn't work. Something about keys that are on devices. But what happens when I use a phone and a pc? How to get access then? Do I need a User/PW for the first time? Or do I need one…

Passkeys are exactly like SSH keys. You should use them exactly like you use SSH keys.

What about storing/backupping/managing passkeys versus SSH keys?

Re: Passkeys: A shattered dream

#98

Post by threatofrain »

vouaobrasil wrote: post #96

Passkeys are horrible because the design encourages the need for a smartphone, which is itself a disaster.

Passkeys only encourage the need for a password management tool, which is funny because if everyone had password management tools to begin with then we wouldn't need passkeys.

Re: Passkeys: A shattered dream

#99

Post by threatofrain »

politelemon wrote: post #32

> At this point I think that Passkeys will fail in the hands of the general consumer population. Actually, I think it might be worse. The predators like Apple/Google have already pounced on passkeys as a consumer capture mechanism, so they'll ensure it doesn't fail.

They're a consumer capture mechanism insofar as password management tools are, and we want users to use those because they make security tolerable. The problem is that it turns out the OS vendor was in the best place to win the password management game.
Post reply on HN