Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

171–180 of 789 posts

Re: Passkeys: A shattered dream

#171

Post by masklinn »

javawizard wrote: post #143
michaelt wrote: post #127

Earlier quoted context omitted.

If you've already got a password manager, what benefit do you get from passkeys? Avoiding the risks of short, weak passwords? The risks of reusing passwords across sites? The inconvenience of remembering loads of passwords? The frustration of having to type passwords manually? The risk of getting phished or typing one site's password into a different site? Remembering and typing usernames? The password manager takes…

The risk of your password getting stolen in between your browser and whatever hash algorithm the service you're authenticating with puts your password through before storing/verifying it. That's the benefit you get from passkeys that no password manager will otherwise be able to give you.

If your TLS connection has been MITM’d, you have much bigger problems than your unique randomly generated password being sniffed out.

Re: Passkeys: A shattered dream

#172

Post by whereismyacc »

cyborgx7 wrote: post #108
4ad wrote: post #89

Earlier quoted context omitted.

Passkeys are exactly like SSH keys. You should use them exactly like you use SSH keys.

If they are exactly like SSH keys, then why not just keep using SSH keys. Clearly, there is something else to them.

SSH keys are clearly not a feasible authentication method for non-technical users. Passkeys are here to replace passwords, not ssh keys.

Re: Passkeys: A shattered dream

#174

Post by whereismyacc »

bradley13 wrote: post #128
macrael wrote: post #75

Passkeys can't actually replace passwords, right? I will always need a username and password with a website, then can generate a passkey as a separate auth mechanism, which if I lose, I will recover by setting up again using my username and password? I don't get how we can get to a place where passkeys are all, how do you get a passkey on a new device when you only have passkey auth on some other device enabled?

That's not the idea, no. The idea is that - instead of a password - you have a cryptographic key. Like an SSH key. This key is managed for you, so you never have to see it or type it. You ought to be able to either have just a few keys, or else a different key for every service you use. Unfortunately, the big players are trying to force this (really excellent!) idea into platform dependency. They want to store the ke…

Wouldn't transferring the keys around just massively increase the attack surface? There's a security reason why we want them stored on-device and never moved, right?

Re: Passkeys: A shattered dream

#175

Post by PaulHoule »

Nextgrid wrote: post #41
sevanteri wrote: post #26

Earlier quoted context omitted.

This is why services need to support multiple passkeys per user just like they should support multiple 2FA methods...

Big problem with this is that enrolling the secondary passkey requires the authenticator to be present. This is super inconvenient and risky as it always requires both authenticators to be present at the same machine/physical location, exposing both to local, physical threats (faulty USB ports on your machine frying anything you plug in? Congrats, you've now fried your main and any backup authenticators before you re…

It always struck me that 2FA is a corporate suicide pact. Some percentage of users are going to lose their keys per year so your user base is going to decay like a radioactive element.

Re: Passkeys: A shattered dream

#176

Post by sooheon »

madeofpalk wrote: post #86
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

I think it is true that you can's export passkeys stored in Apple Keychain. However, the statement is false in two ways: - Apple's iCloud Keychain syncs across devices - Apple has APIs that allow third party apps to create and offer passkeys, presented as a first-class option in Apple's authentication system. I use this to sync my passkeys between my Mac, Windows PC, and iPhone.

I had to turn off apple passwords/credit card autofill because it clashes with 1password - how donI enable the 1st class integration?

Re: Passkeys: A shattered dream

#177

Post by crabbone »

Somewhat related: last New Year the company I work for gave us, the employees, presents. Something I assumed to be a USB disk. Couple weeks ago I had to migrate from my old personal laptop to the desktop I finally put together and needed a USB key to put an OS on the new computer.

I recalled I had what I thought was a spare USB key... plugged it in only to discover it wasn't a USB disk. Wasted some time trying to figure out what it was only to discover it was some form of electronic key. Not sure how exactly it works... but, of course, Linux had no drivers for it, so it couldn't even recognize the device.

I tried to think about any possible uses I could want from it and whether it's worth the effort of trying to find an out-of-kernel driver for it... and after some time pondering this idea, I realized I have no use for this thing. There's no scenario in which I would like to have a device to perform this function. So, bundled it with the broken pieces of my old laptop and together they went to the garbage dump.

Passkey would be virtually the same thing. I cannot imagine what problem does it solve, no matter how it works. Everything about this idea seems like a bad idea. So, I'm kind of happy it's a shattered dream now. Better late then never, I guess.

Re: Passkeys: A shattered dream

#179

Post by tucnak »

vaylian wrote: post #59

> But of course, thought leaders exist, and Apple hadn't defined what a Passkey was. One of those thought leaders took to the FIDO conference stage and announced "Passkeys are resident keys", at the same time as the unleashed a passkeys dev website (I won't link to it out of principal). I'm trying to follow the developments in the 2-factor-auth space and this was one thing that confused me a lot. I've read a lot of h…

> I really like the idea of generating keys on the fly based on the domain name that I'm authenticating against.

You could do it on a USB cryptoprocessor, and securely, too. https://tillitis.se/

Re: Passkeys: A shattered dream

#180

Post by JoBrad »

sevanteri wrote: post #26
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

This is why services need to support multiple passkeys per user just like they should support multiple 2FA methods...

The services that I use passkeys for (MS, AWS) do. I have separate passkeys for 2 browsers and on my phone.
Post reply on HN