Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

131–140 of 789 posts

Re: Passkeys: A shattered dream

#131

Post by Filligree »

DecoPerson wrote: post #47
cjk2 wrote: post #17

I still use Keepass (well MacPass) and naively "cache" what I use regularly in Keychain because I completely distrust anyone else handling the keys to my castle. Whenever I get a Passkeys notification it's an irritation as I don't actually see what the supposed benefits of this are and I'm not really interested in changing how I work. Just feels like I'm being dragged into something complex I will never be able to es…

Try Keepassium on iOS. It removed my need to “cache” anything in the keychain.

Do you know how to turn the dratted thing off, by any chance?

Re: Passkeys: A shattered dream

#132

Post by eloeffler »

graton wrote: post #112

As someone who happily uses Yubikeys, I really don't want to use a Passkey. I want to still use a username/password and the Yubikey. Not just username and Yubikey. Google tries to force use of passkey now that if you enroll a Yubikey it will now be a Passkey, instead of a second factor. With no option to disable it. I have to run the Yubikey Manager tool and then disable "FIDO2", so that I can force it only be used a…

You can open your Firefox about:config and set security.webauthn.ctap2 to false.

This will cause a fallback to FIDO/U2F where possible and your browser will appear to not support FIDO2. I've observed this with the default Keycloak flow for Security Tokens. May be a bug, too...

I don't know if this works with Google but if you try it, let me know :)

This needs no restart of Firefox, so you can use it to quickly disable it instead of fully disabling it on your Hardwaretoken.

Re: Passkeys: A shattered dream

#133

Post by mid-kid »

michaelt wrote: post #127
pricechild wrote: post #107

Earlier quoted context omitted.

Bitwarden (& vaultwarden) also offer passkey which seem to work pretty well. I've not had a problem registering both this and my phone on any site.

If you've already got a password manager, what benefit do you get from passkeys? Avoiding the risks of short, weak passwords? The risks of reusing passwords across sites? The inconvenience of remembering loads of passwords? The frustration of having to type passwords manually? The risk of getting phished or typing one site's password into a different site? Remembering and typing usernames? The password manager takes…

Automation.

Password managers should be the default authentication method, and the current hack of having it type text into a password field is both unwieldy and completely avoidable.

Re: Passkeys: A shattered dream

#134

Post by joshstrange »

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up.

I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not integrate well with password less so it’s best to stay where I am until things settle out better.

Re: Passkeys: A shattered dream

#135

Post by posix_monad »

mid-kid wrote: post #133
michaelt wrote: post #127

Earlier quoted context omitted.

If you've already got a password manager, what benefit do you get from passkeys? Avoiding the risks of short, weak passwords? The risks of reusing passwords across sites? The inconvenience of remembering loads of passwords? The frustration of having to type passwords manually? The risk of getting phished or typing one site's password into a different site? Remembering and typing usernames? The password manager takes…

Automation. Password managers should be the default authentication method, and the current hack of having it type text into a password field is both unwieldy and completely avoidable.

Very easy to put the a password into the wrong place when doing it manually.

Re: Passkeys: A shattered dream

#136

Post by echoangle »

_ZeD_ wrote: post #36
echoangle wrote: post #22

Earlier quoted context omitted.

I know that, but I didn’t think it was because of security. I don’t think of the US as particularly dangerous, but maybe my perception is wrong…

I know that US is vast, and there are millions of good places where one could feel safe, but I assure you, from the outside sometimes is seems you live in a mad max alternate universe

I’m from Europe, but I would have no problem going to a tech meeting with some google engineers in Silicon Valley.

Re: Passkeys: A shattered dream

#137

Post by arianvanp »

Filligree wrote: post #130
arianvanp wrote: post #76

Earlier quoted context omitted.

They are stored in your platform's password manager. So they're available on all the devices you're logged into. If you're enrolling a new device (say you buy a new android phone) you can scan a QR code from your previous phone go log in.

“My platform”? So, like, the BIOS? What if I want to use both a PC and an iPhone?

Platform as in "ecosystem". iCloud Keychain, Google Password Manager, Bitwarden, 1Password, your Yubikey. Anything that can store passkeys.

If you want to use both you simply enroll both your PC and your iPhone. There's nothing stopping you from doing this. You can register multiple passkeys from different providers to the same account.

You can also log in to your PC with your iPhone by scanning a QR code. And then afterwards enroll your PC as a secondary passkey.

Re: Passkeys: A shattered dream

#139

Post by echoangle »

bildung wrote: post #72
echoangle wrote: post #22

Earlier quoted context omitted.

I know that, but I didn’t think it was because of security. I don’t think of the US as particularly dangerous, but maybe my perception is wrong…

Homicide rate is 10x the rate of EU and over 30x the rate of Japan: https://independentaustralia.net/politics/politics-display/a... Rape rate is about 3x the rate of EU: https://www.civitas.org.uk/content/files/crime_stats_oecdjan... People killed by police (population adjusted) is about 30x the rate of Germany: https://www.statista.com/statistics/585152/people-shot-to-de... https://polizeischuesse.cilip.de/?p=1&year…

Sure, but those rates are also really low. That’s a bit like saying you’re scared of using your car because a plane is much safer. The chance of getting hurt while visiting a meeting in Silicon Valley is still one in a million.

Re: Passkeys: A shattered dream

#140

Post by arianvanp »

threatofrain wrote: post #98
vouaobrasil wrote: post #96

Passkeys are horrible because the design encourages the need for a smartphone, which is itself a disaster.

Passkeys only encourage the need for a password management tool, which is funny because if everyone had password management tools to begin with then we wouldn't need passkeys.

This is not true.

Passkeys still protect you from additional things that password managers don't protect you against:

1. Your credential can't be phished as it's cryptographically bound to the domain. You could stil be tricked into entering your password and TOTP into a malicious website.

2. Your credential can't be leaked by sloppy servers as it's public key crypto. This makes your security not depend on believing the website your logging into does proper password hashing and doesn't accidentally log password in plaintext.

Post reply on HN