Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

121–130 of 789 posts

Re: Passkeys: A shattered dream

#121

Post by kiwijamo »

madeofpalk wrote: post #86
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

I think it is true that you can's export passkeys stored in Apple Keychain. However, the statement is false in two ways: - Apple's iCloud Keychain syncs across devices - Apple has APIs that allow third party apps to create and offer passkeys, presented as a first-class option in Apple's authentication system. I use this to sync my passkeys between my Mac, Windows PC, and iPhone.

How do you sync it to your Windows PC? Is it native Apple-Microsoft sync or does it require e.g. installing an Apple application?

Re: Passkeys: A shattered dream

#122

Post by md_ »

4ad wrote: post #53
MichaelMug wrote: post #45

Earlier quoted context omitted.

> I use iCloud's Passkeys extensively So what happens if you want to migrate away from iCloud for the storage of passkeys?

I can't speak for OP, but for every service that I use passkeys with I enrolled both iCloud Passkeys (for convenience) and several YubiKeys (for portability and backup). This is not different at all from a SSH public/private key combo. You are not supposed to duplicate SSH keys!

Your answer is totally reasonable, but I admit I don't have time for that in most cases.

1. Most services are not Passkey-only--most people are using it as a password alternative (e.g. eBay) or a second-factor alternative. So losing it won't lock me out.

2. A very small number (e.g. Google) let you configure Passkey as your sole second factor. For those, I am indeed careful to do what you do and have duplicates.

I do think this is kind of bad? So the grandparent totally has a point here: services find it hard to do only Passkeys (and thus realize the security benefits).

But, as a user, it's not something I worry about a lot, to be honest.

Re: Passkeys: A shattered dream

#123

Post by bradley13 »

saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

KeepassXC says that it is adding (has added) passkey support. I haven't tested this yet, but if it works, that would avoid platform lock-in. Assuming, of course, that the platforms don't somehow intercept the passkey requests and refuse to allow KeepassXC to do its job.

The big tech companies (Google, Apple, MS) have all become evil.

Re: Passkeys: A shattered dream

#124

Post by bradley13 »

tux3 wrote: post #94
4ad wrote: post #89

Earlier quoted context omitted.

Passkeys are exactly like SSH keys. You should use them exactly like you use SSH keys.

"Exactly" is under a lot of strain here. SSH is nice because you don't have to think about it. Your private key sits in your .ssh folder, and then everything is transparent. You _can_ put an SSH key in a smartcard if you want, but you have to opt-in to this kind of pain. And even if you do, almost all SSH servers will support that login method without issue. Passkeys don't sit in your .passkey folder. Your browser do…

Passkeys ought to be exactly like SSH keys. Unfortunately, they are not.

The attempts to restrict when and how they are stored, and how you can access them - those are going to cause a lot of pain and confusion.

I have all of my SSH keys stored in KeepassXC, which (imho) is a lot more secure than having them hang around in my .ssh directory. Open KeepassXC, and the keys are available. Close it, and they're gone. Synchronizing the KeepassXC-file across devices means that I have access to the keys on all of my devices.

The big companies pushing passkeys are trying very hard to prevent this kind of convenience.

Re: Passkeys: A shattered dream

#125

Post by usrusr »

flup wrote: post #44
md_ wrote: post #2

I use iCloud's Passkeys extensively and have never had saved Passkeys "wiped out". I am not disputing that data loss bugs can happen, but three times for one user sounds pretty weird given the maturity of the ecosystem. The most obvious explanations seem to me to be: a) Apple loses data (presumably not just Passkeys, but also photos, passwords, and other highly noticeable stuff) all the time, and I've been lucky for…

One thing that comes to mind is with the earlier WebAuthn implementations in iOS, before they were stored in iCloud and called passkeys, there was no management interface for stored passkeys and 'clear website data' (to delete cookies etc.) would actually erase all credentials permanently. It was useless this way.

Why useless? Not an authentication scheme to and all other authentication schemes, but certainly a (much) better successor to the login cookie?

Re: Passkeys: A shattered dream

#126

Post by hlandau »

I've never tried to use passkeys, but determined a while ago my hard, non-negotiable, a priori requirements which would have to be met for me to be willing to use them:

1. I can, if I choose, have a passkey in software (no hardware enclave, no captive key, no TPM) even if the security of that sucks:

  => Implication: I can backup and copy a passkey without restriction, e.g.
     putting the key material in an airgapped password safe, and without that
     being visible to a website.

  => Implication: Websites can't discriminate by whether I have a passkey in
     software or have any part in deciding whether I get to backup, copy or
     transfer a passkey.
2. I can disable any attestation functionality to do my part to prevent any online service from making it mandatory.

I haven't looked into this yet, so: do, or can, passkeys, or the contemporary WebAuthn implementations in Firefox or Chrome on Linux, meet my requirements?

Re: Passkeys: A shattered dream

#127

Post by michaelt »

pricechild wrote: post #107
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

Bitwarden (& vaultwarden) also offer passkey which seem to work pretty well. I've not had a problem registering both this and my phone on any site.

If you've already got a password manager, what benefit do you get from passkeys?

Avoiding the risks of short, weak passwords? The risks of reusing passwords across sites? The inconvenience of remembering loads of passwords? The frustration of having to type passwords manually? The risk of getting phished or typing one site's password into a different site? Remembering and typing usernames? The password manager takes care of all that for you already.

And if your objective is to have a second factor just in case your password manager gets compromised? A physical button just in case someone takes over your mouse and keyboard? Or a credential stored in a secure element that's (somewhat) protected even if you use it on a compromised machine? Putting it in a password manager (or OS keyring) removes those advantages.

Re: Passkeys: A shattered dream

#128

Post by bradley13 »

macrael wrote: post #75

Passkeys can't actually replace passwords, right? I will always need a username and password with a website, then can generate a passkey as a separate auth mechanism, which if I lose, I will recover by setting up again using my username and password? I don't get how we can get to a place where passkeys are all, how do you get a passkey on a new device when you only have passkey auth on some other device enabled?

That's not the idea, no. The idea is that - instead of a password - you have a cryptographic key. Like an SSH key. This key is managed for you, so you never have to see it or type it. You ought to be able to either have just a few keys, or else a different key for every service you use.

Unfortunately, the big players are trying to force this (really excellent!) idea into platform dependency. They want to store the keys on physical devices, which (a) eliminated portability and (b) restricts the number of keys you can have. If your device fails, you will also be faced with account-recovery problems.

Great idea, but the implementations are looking...not great.

Re: Passkeys: A shattered dream

#129

Post by donatj »

The problem with passkeys, beyond the painful UX that will scare any casual users away and the fact that they are being wielded as an extreme vendor lock-in mechanism is just that the design and implementation is so over complicated with second system syndrome.

If you’re going to push a replacement for passwords and want it to be universal, it should be EASY to implement. Even if the backing cryptography is complex, the actual handshake / implementation shouldn’t be. TOTP as an example is insanely easy to implement. Password auth of course is as well, despite needing to know what you are doing to get it right. Both can easily be handled entirely without JS.

I should quite frankly be able to just in a standard POST form for registration and be able to call it a day. It doesn’t justify how complex it is to set up.

A fitting password replacement should just be as smooth and easy as ssh. I give a website a public key, I use my private key. I manage my private keys however I see fit. I don’t need a third party involved holding my private keys hostage.

Re: Passkeys: A shattered dream

#130

Post by Filligree »

arianvanp wrote: post #76
macrael wrote: post #75

Passkeys can't actually replace passwords, right? I will always need a username and password with a website, then can generate a passkey as a separate auth mechanism, which if I lose, I will recover by setting up again using my username and password? I don't get how we can get to a place where passkeys are all, how do you get a passkey on a new device when you only have passkey auth on some other device enabled?

They are stored in your platform's password manager. So they're available on all the devices you're logged into. If you're enrolling a new device (say you buy a new android phone) you can scan a QR code from your previous phone go log in.

“My platform”? So, like, the BIOS? What if I want to use both a PC and an iPhone?
Post reply on HN