Passkeys: A shattered dream • Hacker News Board

Re: Passkeys: A shattered dream

#141

Post by javawizard » Fri, Apr 26, 2024, 10:10 AM UTC

4ad wrote: post #68

jf wrote: post #63

Earlier quoted context omitted.

If you’re asking in earnest: For the majority of users, Passkeys offer a pragmatic alternative to passwords that is far superior in terms of security. For you, based on what I’ve read in your comments, I would say that Passkeys are the first workable alternative to passwords. They are built on WebAuthn which (roughly summarized) was the standard developed by Google and Yubico in direct response to the Operation Auora…

If you use a software-based password manager, passkeys are indistinguishable from passwords both from a UX perspective and a security perspective. If you store passkeys in hardware, then yes, passkeys are more secure, but you lose portability.

> If you use a software-based password manager, passkeys are indistinguishable from passwords both from a UX perspective and a security perspective.

That's not correct. Passkeys use public-key cryptography and a challenge-response authentication mechanism, so an adversary in possession of a read-only copy of the database of the service you're trying to authenticate with won't be able to authenticate as you - which is very much a security improvement over passwords, even when both are stored in a password manager.

Re: Passkeys: A shattered dream

#142

Post by stavros » Fri, Apr 26, 2024, 10:15 AM UTC

graton wrote: post #112

As someone who happily uses Yubikeys, I really don't want to use a Passkey. I want to still use a username/password and the Yubikey. Not just username and Yubikey. Google tries to force use of passkey now that if you enroll a Yubikey it will now be a Passkey, instead of a second factor. With no option to disable it. I have to run the Yubikey Manager tool and then disable "FIDO2", so that I can force it only be used a…

> I want to still use a username/password and the Yubikey.

Why?

Re: Passkeys: A shattered dream

#143

Post by javawizard » Fri, Apr 26, 2024, 10:15 AM UTC

michaelt wrote: post #127

pricechild wrote: post #107

Earlier quoted context omitted.

Bitwarden (& vaultwarden) also offer passkey which seem to work pretty well. I've not had a problem registering both this and my phone on any site.

If you've already got a password manager, what benefit do you get from passkeys? Avoiding the risks of short, weak passwords? The risks of reusing passwords across sites? The inconvenience of remembering loads of passwords? The frustration of having to type passwords manually? The risk of getting phished or typing one site's password into a different site? Remembering and typing usernames? The password manager takes…

The risk of your password getting stolen in between your browser and whatever hash algorithm the service you're authenticating with puts your password through before storing/verifying it.

That's the benefit you get from passkeys that no password manager will otherwise be able to give you.

Re: Passkeys: A shattered dream

#144

Post by stavros » Fri, Apr 26, 2024, 10:16 AM UTC

saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

Store your passkeys in BitWarden.

Re: Passkeys: A shattered dream

#145

Post by cosmosgenius » Fri, Apr 26, 2024, 10:18 AM UTC

I wanted to use Passkeys from the initial spec stage. The UX seemed far more superior (the closest I think is passwordless via email).

But the more I wanted to use Passkeys are more scary it got, basically the gut feeling of losing control.

If we could use something akin of derived, reproduceable-ish (???) Passkeys maybe then.

As of right now it feels wrong.

Re: Passkeys: A shattered dream

#146

Post by cosmosgenius » Fri, Apr 26, 2024, 10:20 AM UTC

cosmosgenius wrote: post #145

I wanted to use Passkeys from the initial spec stage. The UX seemed far more superior (the closest I think is passwordless via email). But the more I wanted to use Passkeys are more scary it got, basically the gut feeling of losing control. If we could use something akin of derived, reproduceable-ish (???) Passkeys maybe then. As of right now it feels wrong.

(derived, reproduceable-ish) sounds like a security horror O_o.

Re: Passkeys: A shattered dream

#147

Post by vbezhenar » Fri, Apr 26, 2024, 10:20 AM UTC

larsnystrom wrote: post #118

frizlab wrote: post #104

My biggest issue with passkey is not passkey itself, which, when it works, is great, but more the implementation of it done on most websites. Use a passkey on https://www.passkeys.io and it works great! On google too. But use it on PayPal, it does not anymore. Who’s to blame?

I've added a few passkeys to 1Password. It works pretty well on github.com, and sometimes on google.com. But apparently, passkeys.io bypasses 1Password and asks the OS for passkeys? So passkeys.io doesn't actually work for me, unless I want to store the passkey in the OS keychain. Which I don't, because I don't want to be locked into that. How can it be that the website decides which password manager I should use to…

My assumption is that there's no proper browser API for third-party passkeys, so this extension probably monkey-patches website JavaScript which is not reliable.

Re: Passkeys: A shattered dream

#148

Post by stavros » Fri, Apr 26, 2024, 10:24 AM UTC

4ad wrote: post #68

jf wrote: post #63

Earlier quoted context omitted.

If you’re asking in earnest: For the majority of users, Passkeys offer a pragmatic alternative to passwords that is far superior in terms of security. For you, based on what I’ve read in your comments, I would say that Passkeys are the first workable alternative to passwords. They are built on WebAuthn which (roughly summarized) was the standard developed by Google and Yubico in direct response to the Operation Auora…

If you use a software-based password manager, passkeys are indistinguishable from passwords both from a UX perspective and a security perspective. If you store passkeys in hardware, then yes, passkeys are more secure, but you lose portability.

This is wrong, as a MITM or keylogger can't steal a passkey, while they can steal a password.

Re: Passkeys: A shattered dream

#149

Post by michaelt » Fri, Apr 26, 2024, 10:24 AM UTC

nurumaik wrote: post #103

Why couldn't passkeys just be a user-friendly wrapper around assymetric key pairs tech people already using?

They kind of are, except...

1. SSH keys, as they're normally used, let you be tracked between hosts. That's fine for SSH, because nobody's trying to SSH into their Grindr account. But for web login stuff you want a different key pair for every site.

2. Adds a bunch of 'attestation' features that corporate types think they need.

3. Tries to make it so an attacker who gets access to your machine can't make a copy of the credential. The success of this is implementation-dependent.

4. With barely any setup, Google/Microsoft/Apple will keep a backup copy, in case you lose your phone. This is useful for non-technical people.

Re: Passkeys: A shattered dream

#150

Post by JTyQZSnP3cQGa8B » Fri, Apr 26, 2024, 10:25 AM UTC

stavros wrote: post #144

saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

Store your passkeys in BitWarden.

I love Bitwarden but they still don’t support that on mobile phones.