Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

161–170 of 789 posts

Re: Passkeys: A shattered dream

#161

Post by troupo »

saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

> The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in.

On MacOS you cannot enable passkeys (or using TouchID with them?) without enabling iCloud Keychain.

I'm fine with iCloud Keychain. But to enable it, you have to enable "autofill form password" which enables it in Safari. Disabling it in Safari disables the global setting and disables iCloud Keychain.

WTF.

https://twitter.com/dmitriid/status/1782787035637375050

Re: Passkeys: A shattered dream

#162

Post by G3rn0ti »

Hm. The main criticism is you get locked into a cloud platform storing your private key(s) when using „passkeys“. This can be convenient as you can use your favorite smart phone to authenticate everywhere or even choose to rely on local TPM storage on your laptop or PC through MS Windows. This trades convenience with the risk of a vendor lock-in. But AFAIU the FIDO2 protocol you are free to use a dedicated USB key storage instead to store your private key (protected by a PIN or passphrase) on your own. This a bit less convenient but gives you peace of mind if you hate MS/ABC/Apple.

Re: Passkeys: A shattered dream

#164

Post by jorvi »

michaelt wrote: post #127
pricechild wrote: post #107

Earlier quoted context omitted.

Bitwarden (& vaultwarden) also offer passkey which seem to work pretty well. I've not had a problem registering both this and my phone on any site.

If you've already got a password manager, what benefit do you get from passkeys? Avoiding the risks of short, weak passwords? The risks of reusing passwords across sites? The inconvenience of remembering loads of passwords? The frustration of having to type passwords manually? The risk of getting phished or typing one site's password into a different site? Remembering and typing usernames? The password manager takes…

Passkeys can’t be phished, or shoulder peeped, or entered on a malicious domain. And for the layman, it means they can’t forget their password.

Technically the place where you store your passkeys can be hacked into, but there is no technology that protects against that. You could give a tech layman 5FA and he’ll give all 5 factors to the nice man on the phone call.

Re: Passkeys: A shattered dream

#165

Post by tux3 »

G3rn0ti wrote: post #162

Hm. The main criticism is you get locked into a cloud platform storing your private key(s) when using „passkeys“. This can be convenient as you can use your favorite smart phone to authenticate everywhere or even choose to rely on local TPM storage on your laptop or PC through MS Windows. This trades convenience with the risk of a vendor lock-in. But AFAIU the FIDO2 protocol you are free to use a dedicated USB key st…

>you are free to use a dedicated USB key storage instead to store your private key

As long as the server supports the device/protocol/options you want, and doesn't enforce attestation against a small list of enterprise vendors.

For instance Microsoft Azure AD's Entra ID authentication service, the one that keeps changing name, has a hardcoded list which you can consult here: https://learn.microsoft.com/en-us/entra/identity/authenticat...

In theory there's no vendor lock-in. As long as Azure adds your vendor to the Azure-approved list, and as long as every other provider refrains from making their own list.

For the Apple/Google ecosystems specifically, it's also important to keep the compatibility matrix for each service in mind. For instance with Azure again: https://learn.microsoft.com/en-us/entra/identity/authenticat...

In theory any FIDO2 implementation could work with any service that accepts passkeys. In practice, compatibility matrices and allowlists are the reality.

Re: Passkeys: A shattered dream

#166

Post by dudeinjapan »

At TableCheck we rolled our own passkeys SP implementation primarily for our internal users, so they can access admin-level accounts without passwords.

Personally I love the convenience of passkeys (coupled with 1Password pw manager), however, for whatever reason it doesn’t “feel” like Passkeys replace passwords but rather they complement them. I treat Passkeys as ephemeral—it is lovely when they work, but sometimes I still need to fallback to trusty ol’ password login.

Re: Passkeys: A shattered dream

#167

Post by whereismyacc »

gehsty wrote: post #50
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

I thought passkeys were shared across Apple keychain (like passwords?) so you make a passkey on iPhone your iPad can use it.

Are they not private keys that shouldn't be synced across devices? I thought icloud facilitated automatic creation of passkeys for each device, not actually sharing the same passkey across devices?

Re: Passkeys: A shattered dream

#169

Post by masklinn »

jorvi wrote: post #164
michaelt wrote: post #127

Earlier quoted context omitted.

If you've already got a password manager, what benefit do you get from passkeys? Avoiding the risks of short, weak passwords? The risks of reusing passwords across sites? The inconvenience of remembering loads of passwords? The frustration of having to type passwords manually? The risk of getting phished or typing one site's password into a different site? Remembering and typing usernames? The password manager takes…

Passkeys can’t be phished, or shoulder peeped, or entered on a malicious domain. And for the layman, it means they can’t forget their password. Technically the place where you store your passkeys can be hacked into, but there is no technology that protects against that. You could give a tech layman 5FA and he’ll give all 5 factors to the nice man on the phone call.

> Passkeys can’t be phished, or shoulder peeped, or entered on a malicious domain. And for the layman, it means they can’t forget their password.

Neither can passwords if you’re using a password manager to handle them.

So again, if you’ve already got a password manager, and would put your passkeys in a password manager, what is the benefit of passkeys?

Re: Passkeys: A shattered dream

#170

Post by cassianoleal »

Tempest1981 wrote: post #110
cassianoleal wrote: post #78

Earlier quoted context omitted.

I agree. So far I think KeePassXC is the only one that allows you to export your Passkeys. I believe Bitwarden are working on it as well. That said, it's unclear whether this will provide any portability of passkeys between providers.

Once you export your passkeys, is there anything that can import them?

I assume each provider will have the ability to import as well as export. The question is whether you can do that across providers. That's not too different from the status quo for passwords and other fields though.
Post reply on HN