Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

151–160 of 789 posts

Re: Passkeys: A shattered dream

#151

Post by planede »

4ad wrote: post #89
myspy wrote: post #88

I think I'm a tech guy and know my fields. I still have no real clue how passkeys work, how it is better, what it really is. When your security feature is not as simple as - remember a name and a password and store it somewhere safe - it doesn't work. Something about keys that are on devices. But what happens when I use a phone and a pc? How to get access then? Do I need a User/PW for the first time? Or do I need one…

Passkeys are exactly like SSH keys. You should use them exactly like you use SSH keys.

For me that means having multiple keys in `authorized_keys` for the same user and never transferring private keys between devices. From what I gathered from the discussion here, this is not a given.

Re: Passkeys: A shattered dream

#152

Post by jchw »

Yeah, unfortunately passkeys are confusing and the UX is generally fucking awful. I hesitate to just blame the tech companies for being greedy, as a result of my experience with passkeys I'm starting to wonder if maybe they've legitimately just lost the skills and knowledge necessary to actually make usable software.

What's most disappointing is, password managers have already solved the problem of syncing credentials securely between multiple devices across different form factors and ecosystems, and they're perfectly usable for providing software passkey support. So of course.. there's no standard API for them to implement it. Instead, vendors are patching the WebAuthn APIs using WebExtensions.

This is sabotage.

Re: Passkeys: A shattered dream

#154

Post by bitlevel »

kiwijamo wrote: post #121
madeofpalk wrote: post #86

Earlier quoted context omitted.

I think it is true that you can's export passkeys stored in Apple Keychain. However, the statement is false in two ways: - Apple's iCloud Keychain syncs across devices - Apple has APIs that allow third party apps to create and offer passkeys, presented as a first-class option in Apple's authentication system. I use this to sync my passkeys between my Mac, Windows PC, and iPhone.

How do you sync it to your Windows PC? Is it native Apple-Microsoft sync or does it require e.g. installing an Apple application?

I would also like to know how this is achieved.

Re: Passkeys: A shattered dream

#155

Post by FdbkHb »

michaelt wrote: post #149
nurumaik wrote: post #103

Why couldn't passkeys just be a user-friendly wrapper around assymetric key pairs tech people already using?

They kind of are, except... 1. SSH keys, as they're normally used, let you be tracked between hosts. That's fine for SSH, because nobody's trying to SSH into their Grindr account. But for web login stuff you want a different key pair for every site. 2. Adds a bunch of 'attestation' features that corporate types think they need. 3. Tries to make it so an attacker who gets access to your machine can't make a copy of th…

> With barely any setup, Google/Microsoft/Apple will keep a backup copy, in case you lose your phone.

Not Microsoft. Their implementation has no synchronisation feature and provides no way to back it up or transfer to another device either. You lose the computer you lose the passkey.

Their implementation is very daft and goes counter to the point of passkeys since you will need a less secure way of authentication to remain enabled on the accounts you use a Windows Hello passkey for, for the sake of being able to recover those accounts.

Remember, the best security schemes are only as secure as the least secure scheme that is available to access the account. If you're still on an account that can be recovered by sending a 2fa code to email or SMS/texting then you have achieved nothing.

Re: Passkeys: A shattered dream

#156

Post by wiktor-k »

test20201 wrote: post #119
vbezhenar wrote: post #37

Earlier quoted context omitted.

It does not. Not for Linux, anyway.

It is because desktop linux does not have passkey interface built into the OS. There needs to be TPM, systemd, etc need to talk altogether.

Linux most definitely has a TPM interface, it's called /dev/tpmrm0 and plenty of libraries for accessing it (eg. https://github.com/parallaxsecond/rust-tss-esapi/ full disclosure: I'm co-maintaining it). Systemd is not needed for that.

Re: Passkeys: A shattered dream

#157

Post by wiktor-k »

arch-choot wrote: post #77
_nalply wrote: post #43

I can't help feeling this... In an adverse world software and electronic data is too ephemeral to entrust with authentication and authorization. What if we had something solid like a Yubikey, but: - credit card sized - completely airgapped - standardized - controlled by a non-profit association - hard- and software open sourced - built-in camera to scan data - built-in display to show data - configuration mode: scan…

If you ignore the last 6 points about cameras and displays, then this is kinda what "Smartcards" are, I think? https://en.wikipedia.org/wiki/OpenPGP_card In fact the Estonian Id-Card is one of these if I'm not mistaken

Just to clarify Estonian Id-Card most certainly implements the PIV applet while Yubikeys implement both PIV and the OpenPGP Card (the latter has a benefit of natively supporting ed25519: https://github.com/wiktor-k/age-plugin-openpgp-card).

Re: Passkeys: A shattered dream

#158

Post by jasonjayr »

cassianoleal wrote: post #78
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

I agree. So far I think KeePassXC is the only one that allows you to export your Passkeys. I believe Bitwarden are working on it as well. That said, it's unclear whether this will provide any portability of passkeys between providers.

... and they are getting warned about that feature existing: https://news.ycombinator.com/item?id=39698502

Re: Passkeys: A shattered dream

#159

Post by cuu508 »

4ad wrote: post #65
Nextgrid wrote: post #41

Earlier quoted context omitted.

Big problem with this is that enrolling the secondary passkey requires the authenticator to be present. This is super inconvenient and risky as it always requires both authenticators to be present at the same machine/physical location, exposing both to local, physical threats (faulty USB ports on your machine frying anything you plug in? Congrats, you've now fried your main and any backup authenticators before you re…

This is why you need to enrol the secondary passkey at the same time you enrol the first one, not later when you might not have the authenticator present. In reality websites should not allow setting up a single passkey.

Enrolling both at the same time still requires both authenticators to be present at the same machine/physical location.

Re: Passkeys: A shattered dream

#160

Post by e12e »

4ad wrote: post #65
Nextgrid wrote: post #41

Earlier quoted context omitted.

Big problem with this is that enrolling the secondary passkey requires the authenticator to be present. This is super inconvenient and risky as it always requires both authenticators to be present at the same machine/physical location, exposing both to local, physical threats (faulty USB ports on your machine frying anything you plug in? Congrats, you've now fried your main and any backup authenticators before you re…

This is why you need to enrol the secondary passkey at the same time you enrol the first one, not later when you might not have the authenticator present. In reality websites should not allow setting up a single passkey.

Problem remains when you lose one, and need to block and enroll a new backup?
Post reply on HN