Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

261–270 of 789 posts

Re: Passkeys: A shattered dream

#261

Post by pseudo0 »

thesuperbigfrog wrote: post #245
pseudo0 wrote: post #224

Earlier quoted context omitted.

The TL;DR version in my opinion is that passkeys are quite similar to a SSH key pair, like one you'd use on GitHub. Basically you generate a key pair, the server stores the public key, and the client stores the private key. When you want to authenticate, the server sends a challenge, you sign it with your private key, and send it back. The main debate is over how to manage those keys after generation. - Backups: It d…

The big problem is that most passkey providers do not support actually giving users their passkeys. As the article stated: "I want you to remember this quote and it's implications. Users should be able to use any device they choose without penalty." As you've pointed out: >> Backups: It depends. It seems like the big players (Google, Apple) are pushing an implementation where your passkeys are backed up either in the…

Agreed, they unfortunately seem to have gone the vendor lock-in route. The big players don't have export utilities for passkeys, despite it being technically feasible and pretty straightforward to implement. That's a pretty major gap in the spec, there should be a standard export/import format, and vendors should be required to implement it in order to be compliant.

It's probably possible to extract passkeys from a rooted Android device, but it would definitely be out of the grasp of 99% of users. I have not looked into it in detail, but I'd expect a Frida script hooking the keystore decryption function would get the raw data, then it would be a question of interpreting whatever proprietary format Google is using for their password manager.

Re: Passkeys: A shattered dream

#262

Post by afavour »

michaelt wrote: post #127
pricechild wrote: post #107

Earlier quoted context omitted.

Bitwarden (& vaultwarden) also offer passkey which seem to work pretty well. I've not had a problem registering both this and my phone on any site.

If you've already got a password manager, what benefit do you get from passkeys? Avoiding the risks of short, weak passwords? The risks of reusing passwords across sites? The inconvenience of remembering loads of passwords? The frustration of having to type passwords manually? The risk of getting phished or typing one site's password into a different site? Remembering and typing usernames? The password manager takes…

The actual implementation of password managers is really messy. Browser extensions that try to guess which field may or may not contain your username, copy the 2FA code to the clipboard in the hopes that you’ll easily be able to paste it on the next page… passkeys offering a standardized API to provide this information makes it worth considering alone IMO, even without considering the extra security compared to plaintext password.

Re: Passkeys: A shattered dream

#263

Post by postalrat »

fauigerzigerk wrote: post #241
triblemaster wrote: post #202

Earlier quoted context omitted.

A physical device which is not your computer stores some secret information which can authenticate you. This can be passwords, passkeys, GPG keys, your retina etc. The physical device can be password protected. So you have two step authentication: 1. your physical device 2. your password to that device Phones are currently being promoted for various reasons, but I believe something like Yubikeys or other FIDO2 fobs w…

What I find rather confusing is what happens on each device. There appear to be multiple places where passkeys can get stored (iCloud Keychain, Google account, Chrome profile, Bitwarden, ...?) and depending on where it's stored it may or may not get synced to various other devices, browsers and apps. So my problem is that I keep forgetting which device, browser or app I used when I created a particular passkey. I'm n…

Many places let you enter and name multiple passkeys. So you as your keychain one and name it "keychain". And also add phone and call it "whatever phone" then use either.

Personally I only use devices that don't sync and can't be copied for security reasons.

Re: Passkeys: A shattered dream

#264

Post by acheron »

dboreham wrote: post #258
acheron wrote: post #254

Earlier quoted context omitted.

Yeah I’m not sure what’s going on either. Is this just a rebranding of mutual-auth SSL client certs?

Kind of. With the sharp edges filed off. There's no CA though. The web site provisions and authorizes the client's key at onboarding.

ohh, I see. that's clearer than any other explanation I've seen, thanks.

Re: Passkeys: A shattered dream

#265

Post by vluft »

ezfe wrote: post #221
hlandau wrote: post #126

I've never tried to use passkeys, but determined a while ago my hard, non-negotiable, a priori requirements which would have to be met for me to be willing to use them: 1. I can, if I choose, have a passkey in software (no hardware enclave, no captive key, no TPM) even if the security of that sucks: => Implication: I can backup and copy a passkey without restriction, e.g. putting the key material in an airgapped pass…

1Password includes Passkeys in archive/exports of the 1Password database. Safari developers have stated that it is a planned feature to support Passkey exporting (but not currently supported) including between apps. I'm not aware of any restrictions at this time on your second point. I also haven't seen any examples of attestation and Passkeys being used in practice.

> 1Password includes Passkeys in archive/exports of the 1Password database.

They explicitly do not.

Re: Passkeys: A shattered dream

#266

Post by orbisvicis »

AlexandrB wrote: post #208
crote wrote: post #196

Earlier quoted context omitted.

This isn't a viable option in practice, because Passkeys use "Resident Keys". This means the credential needs to be stored on the Yubikey - which has a limited number of key slots. Need to log in to more than 25 (I believe) websites? Tough luck!

It didn't have to be this way, but the hype train won over practical considerations: https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-tu...

Why couldn't a non-resident security key send it's public key as username? And the response contains the actual username and private key.

Re: Passkeys: A shattered dream

#267

Post by nightski »

barnabee wrote: post #255
makeitdouble wrote: post #242

Earlier quoted context omitted.

Could you expand on how to trick a password manager to enter the password on a fake domain ? I'd see having the user add the domain themselves, or get the user to copy/past the password themselves on some other form. But the phishing is not happening on the password manager side, and these use cases still exist even after you chose passkeys (i.e. I'd still need to somewhat log into Google's auth from my Nest hub for…

It happens to me very regularly that a password in my password manager is needed on a different domain. Maybe the logon process is at id.domain.com and password is pinned to domain.com, or maybe the password was created at signup.domain.com and so it doesn't pop up on domain.com, or you have to log in to a hotel's site with the password from their reward scheme (different domain), etc... In any case users are trained…

At least on Bitwarden you can just edit the domain if that comes up a lot for you (or even add multiple domains to a password). I'd rather do that than copy/paste on a regular basis. Honestly I can't say I ever copy/paste.

Re: Passkeys: A shattered dream

#268

Post by jerf »

pseudo0 wrote: post #261
thesuperbigfrog wrote: post #245

Earlier quoted context omitted.

The big problem is that most passkey providers do not support actually giving users their passkeys. As the article stated: "I want you to remember this quote and it's implications. Users should be able to use any device they choose without penalty." As you've pointed out: >> Backups: It depends. It seems like the big players (Google, Apple) are pushing an implementation where your passkeys are backed up either in the…

Agreed, they unfortunately seem to have gone the vendor lock-in route. The big players don't have export utilities for passkeys, despite it being technically feasible and pretty straightforward to implement. That's a pretty major gap in the spec, there should be a standard export/import format, and vendors should be required to implement it in order to be compliant. It's probably possible to extract passkeys from a r…

This has always been my objection to them, as a user, as they have been presented. As an employee, I don't care. Businesses have sufficient relationships and mechanisms to self-serve any issues that come up, like lost keys. But as a user, I do not. It is a drop-dead requirement for me for any authentication material that I have some way of backing it up and modifying it in case of compromise.

Besides, give the Silicon Valley venture capitalists and Harvard MBA bros a whiff of the possibility of full control over something as important as your primary authentication material and before you can whisper Richard Stallman they're out having a happy Bacchanalia toasting the name of Portunus [1], whom I will now resurrect out of our ancient past to name him the God of Platform Lockin, and us users aren't going to get a word in edgewise over the debauchery and slides projecting Total Addressable Markets.

Fortunately it seems they all got a little too drunk with power this time, but honestly it's only a matter of time before they arrange another Portunus summoning lock-in party again. This target is irresistible and the annoyance people have with passwords is too good an angle to pass up.

[1]: https://en.wikipedia.org/wiki/Portunus_(mythology) And yes, I am aware of the stream-crossing between Bacchus and another god here. But who knows what a Portunalia even is any more?

Re: Passkeys: A shattered dream

#269

Post by dogman144 »

brabel wrote: post #206
macrael wrote: post #75

Passkeys can't actually replace passwords, right? I will always need a username and password with a website, then can generate a passkey as a separate auth mechanism, which if I lose, I will recover by setting up again using my username and password? I don't get how we can get to a place where passkeys are all, how do you get a passkey on a new device when you only have passkey auth on some other device enabled?

They can, and hopefully will. To get a new passkey on another device, the provider needs to allow you to prove you have possession of your other device first. They can do that by sending you a one-time code, for example, when you authenticate using your existing device, which you can then type in the new device, and that lets you associate your new device-generated key with your existing account. With iCloud, you don…

There’s more to phishing threat models than strictly credential theft, as you seem to imply.

If passkeys are around, phishing will certainly still exist, and shift to dropping malware on endpoints or w/e vs going after logins

Re: Passkeys: A shattered dream

#270

Post by cyborgx7 »

whereismyacc wrote: post #172
cyborgx7 wrote: post #108

Earlier quoted context omitted.

If they are exactly like SSH keys, then why not just keep using SSH keys. Clearly, there is something else to them.

SSH keys are clearly not a feasible authentication method for non-technical users. Passkeys are here to replace passwords, not ssh keys.

I understand this, but the person who responded said Passkeys are exactly the same as SSH and used the same, when asked what they are. If that was true, then we would just teach non-technical users to use SSH Keys.
Post reply on HN