Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

271–280 of 789 posts

Re: Passkeys: A shattered dream

#271

Post by teeray »

saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

This is why I’m not interested in passkeys unless I can use it with my password manager (which I probably can at this point). It would also be nice to see the spec for these specifically address lock-in and provide anti-lock-in measures.

Re: Passkeys: A shattered dream

#272

Post by Aeolun »

brabel wrote: post #186
masklinn wrote: post #169

Earlier quoted context omitted.

> Passkeys can’t be phished, or shoulder peeped, or entered on a malicious domain. And for the layman, it means they can’t forget their password. Neither can passwords if you’re using a password manager to handle them. So again, if you’ve already got a password manager, and would put your passkeys in a password manager, what is the benefit of passkeys?

You're wrong, with password managers you can definitely be phished. Unless it's literally impossible to extract the password to enter it manually, but I don't think password managers make that impossible (and if it's possible, users will do it). With passkeys it's literally impossible.

> With passkeys it's literally impossible.

I dunno about you. But I like being able to get my passwords out of the password manager. How is not being able to do so a feature?

Re: Passkeys: A shattered dream

#273

Post by tomschlick »

teeray wrote: post #271
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

This is why I’m not interested in passkeys unless I can use it with my password manager (which I probably can at this point). It would also be nice to see the spec for these specifically address lock-in and provide anti-lock-in measures.

Not sure what your password manager is, but 1Password supports them and its a pretty smooth experience.

Re: Passkeys: A shattered dream

#274

Post by navigate8310 »

crote wrote: post #196
triblemaster wrote: post #182

Earlier quoted context omitted.

You can always use passkeys like Yubikey or others which are much more multi-platform.

This isn't a viable option in practice, because Passkeys use "Resident Keys". This means the credential needs to be stored on the Yubikey - which has a limited number of key slots. Need to log in to more than 25 (I believe) websites? Tough luck!

You could use YubiKey to unlock Bitwarden that can practically store unlimited keys

Re: Passkeys: A shattered dream

#275

Post by stetrain »

joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

You can store passkeys in a password manager as well:

https://1password.com/product/passkeys

The super simple explanation is: SSH keys for websites.

You have a unique private key for each website account stored on your device, in a local password manager, or in a cloud synced password manager (iCloud account, Google account, 1Password, etc).

The website only gets the public key, so unlike password auth your secret is never given to the website.

When accessing that website, the website can send a challenge which your browser answers using your private key associated with that specific domain.

(I'm not a passkey expert and there are a lot more technical details to this, but this is my 10,000ft mental model of what's going on)

Re: Passkeys: A shattered dream

#276

Post by makeitdouble »

barnabee wrote: post #255
makeitdouble wrote: post #242

Earlier quoted context omitted.

Could you expand on how to trick a password manager to enter the password on a fake domain ? I'd see having the user add the domain themselves, or get the user to copy/past the password themselves on some other form. But the phishing is not happening on the password manager side, and these use cases still exist even after you chose passkeys (i.e. I'd still need to somewhat log into Google's auth from my Nest hub for…

It happens to me very regularly that a password in my password manager is needed on a different domain. Maybe the logon process is at id.domain.com and password is pinned to domain.com, or maybe the password was created at signup.domain.com and so it doesn't pop up on domain.com, or you have to log in to a hotel's site with the password from their reward scheme (different domain), etc... In any case users are trained…

I'm totally with you.

These issues won't be solved unless passkeys work absolutely everywhere the user has to authenticate. Logon required or weird and funky domains is currently due to service providers being a mess themselves (I'm looking at you, Microsoft). So should we expect them to miraculously get their act together and have each of these system flawlessly work with their passkey auth. from now on ?

That's where I think we're stuck with that class of issue for as long as there are multiple auth systems, passkeys or not.

Re: Passkeys: A shattered dream

#277

Post by chrisweekly »

michaelt wrote: post #250
joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

> I’ve avoided passkeys so far because I just don’t have a good mental model of them. OK, so the simplest way to understand is to first know about the previous generation. U2F keys are designed to be used alongside a username and password, as a more secure replacement for phone apps showing 6-digit codes. In U2F the key has a hardware 'secure element' where secrets can't be extracted, even if you plug it into a compr…

> "and use fingerprint/faceid instead of a password"

This is the part that makes absolutely no sense to me. An essential aspect of passwords is that they can be changed. If someone manages to fake the digital representation of my fingerprints or face, what now? Security guru Bruce Schneier has written about this w/ much more eloquence and authority.

Re: Passkeys: A shattered dream

#278

Post by jdiff »

sevanteri wrote: post #26
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

This is why services need to support multiple passkeys per user just like they should support multiple 2FA methods...

Do they typically not? My only contact with passkeys has been the 2FA service (Duo) at my place of work, and I've got a passkey on my phone and laptop, as well as OTP push notifications, OTP SMS, or recovery code from IT. It's particularly handy with the Chromeboxes hooked into the big presentation displays since I can scan a QR code with my phone to use the passkey stashed inside it.

Re: Passkeys: A shattered dream

#279

Post by AnonC »

stavros wrote: post #148
4ad wrote: post #68

Earlier quoted context omitted.

If you use a software-based password manager, passkeys are indistinguishable from passwords both from a UX perspective and a security perspective. If you store passkeys in hardware, then yes, passkeys are more secure, but you lose portability.

This is wrong, as a MITM or keylogger can't steal a passkey, while they can steal a password.

Since the passkey is the private key in the private-public pair, if it’s stored on a password manager it can definitely be stolen by malware (if you could have a key logger, you could have something else too). The only solution is to have the passkey (actually private key) reside in hardware or be protected by dedicated hardware.

Re: Passkeys: A shattered dream

#280

Post by knallfrosch »

cosmosgenius wrote: post #146
cosmosgenius wrote: post #145

I wanted to use Passkeys from the initial spec stage. The UX seemed far more superior (the closest I think is passwordless via email). But the more I wanted to use Passkeys are more scary it got, basically the gut feeling of losing control. If we could use something akin of derived, reproduceable-ish (???) Passkeys maybe then. As of right now it feels wrong.

(derived, reproduceable-ish) sounds like a security horror O_o.

You can set up a new Ledger (crypto wallet) and deterministically recover your keys using a sheet with 24 words written on it.

I've got my sheet in my gun safe, but you can also hide it anywhere in your house.

Post reply on HN