Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

301–310 of 789 posts

Re: Passkeys: A shattered dream

#301

Post by vel0city »

rcarmo wrote: post #297
stetrain wrote: post #275

Earlier quoted context omitted.

You can store passkeys in a password manager as well: https://1password.com/product/passkeys The super simple explanation is: SSH keys for websites. You have a unique private key for each website account stored on your device, in a local password manager, or in a cloud synced password manager (iCloud account, Google account, 1Password, etc). The website only gets the public key, so unlike password auth your secret is…

It's still not a great multi-platform/multi-device story. I use multiple machines regularly (and I've migrated away from 1Password to the KeePass ecosystem, by the way) so syncing passkeys from my Mac(s) to my iPad, to my Fedora machines and my Windows working environment is simply not happening any way I look at it. Passkeys are great for consumers who use one or two devices (or browsers - I also switch browsers fre…

You shouldn't ~~necessarily~~ need to "sync" your passkeys across all your devices; each device should have its own passkey. Then if you lose a device (or that one device gets compromised), you revoke the one key and everything else is fine.

Similar to SSH keys. No reason to use the same key on all your machines, use a different key from different places.

The passkeys on my laptop are different from the passkeys on my desktop which are different from the passkeys on my phone which are different from the passkeys on my main yubikey which are different from the passkeys on my backup yubikey.

Edited due to acknowledging people may choose a variety of alternative workflows.

Re: Passkeys: A shattered dream

#302

Post by selykg »

chrisweekly wrote: post #277
michaelt wrote: post #250

Earlier quoted context omitted.

> I’ve avoided passkeys so far because I just don’t have a good mental model of them. OK, so the simplest way to understand is to first know about the previous generation. U2F keys are designed to be used alongside a username and password, as a more secure replacement for phone apps showing 6-digit codes. In U2F the key has a hardware 'secure element' where secrets can't be extracted, even if you plug it into a compr…

> "and use fingerprint/faceid instead of a password" This is the part that makes absolutely no sense to me. An essential aspect of passwords is that they can be changed. If someone manages to fake the digital representation of my fingerprints or face, what now? Security guru Bruce Schneier has written about this w/ much more eloquence and authority.

The biometric stuff is simply allowing access to the keys. It’s not being used for anything else.

Your face or fingerprint being out there isn’t a concern because that’s not, ultimately, the thing being used to generate the keys or anything.

It’s an ease of use function.

On iOS for instance, as I understand it, these are being stored in iCloud Keychain. Which has a password. The derived key for iCloud Keychain is stored in such a way that the system has access if you allow biometrics to be used.

Biometrics then simply allow access, in essence, not part of the encryption process. The password for iCloud Keychain is necessary to add those items on a new device. Your biometrics aren’t stored by Apple anywhere other than in the device.

Honestly I am blown away how few people on this site understand how this stuff works. It’s fascinating and I’m surprised more people aren’t interested in understanding it. But so many people assume the biometrics are being used in the encryption process and that if your face is somehow stolen your whole life is doomed. These features have been on Apple devices for what.. a decade almost at this point? More? The process for Face ID is the same as Touch ID. Developers make zero distinction between the two in code, as that whole process is passed off to the system and effectively results in a bool value (or access to the secure item requested). At no point does a developer ever get your biometrics data.

I don’t know how Android or Windows do it but it is similar enough I suspect.

The FUD around passkeys feels like some sort of propaganda campaign to discredit it.

Re: Passkeys: A shattered dream

#303

Post by triblemaster »

makeitdouble wrote: post #259
triblemaster wrote: post #210

Earlier quoted context omitted.

https://news.ycombinator.com/item?id=40168230 See this and let me know if it makes more sense.

I understand passkeys as authentication through a private/public key generated by the client when creating the credential, with the private key staying client side and the public key kept server side, with some more details around it to make the whole thing discoverable/automatable. To me the best explanation was just to go to the passkeys.io site, the subject is complicated enough that analogies tend to introduce a…

Good idea. I didn't know of that site.

Re: Passkeys: A shattered dream

#304

Post by tzs »

knallfrosch wrote: post #211
javawizard wrote: post #143

Earlier quoted context omitted.

The risk of your password getting stolen in between your browser and whatever hash algorithm the service you're authenticating with puts your password through before storing/verifying it. That's the benefit you get from passkeys that no password manager will otherwise be able to give you.

If they control the information flow can't they simply steal the passkey too?

No, because they never see anything that needs to be kept secret.

Passwords are based on symmetric cryptography. When you log in to a site using a password you give the site your password in plain text, hopefully over an encrypted communication channel such as HTTPS so that no one between you and the site can see the password.

The site then takes that plain text password and decides if it matches the plain text password you gave them when you created the account or most recently changed your password. If the site is following good security practices they aren't actually storing a copy of the password in plain text. They will store a hash of it and compare a hash of the password you just send to see if the hashes match.

Passkeys are based on asymmetric cryptography, also known as public-key cryptography. When you set up an account at a site to use passkeys your device generates a public key and a matching private key. The site is given the public key and your device keeps the private key.

When you want to log in later the site sends your device some data, your device does a computation on that data that involves the private key and sends the result to the site. The site can recognize that whatever did that computation had access to the private key that corresponds to the public key the site has on file.

Re: Passkeys: A shattered dream

#305

Post by packetlost »

masklinn wrote: post #169
jorvi wrote: post #164

Earlier quoted context omitted.

Passkeys can’t be phished, or shoulder peeped, or entered on a malicious domain. And for the layman, it means they can’t forget their password. Technically the place where you store your passkeys can be hacked into, but there is no technology that protects against that. You could give a tech layman 5FA and he’ll give all 5 factors to the nice man on the phone call.

> Passkeys can’t be phished, or shoulder peeped, or entered on a malicious domain. And for the layman, it means they can’t forget their password. Neither can passwords if you’re using a password manager to handle them. So again, if you’ve already got a password manager, and would put your passkeys in a password manager, what is the benefit of passkeys?

>> Passkeys can’t be phished, ..., or entered on a malicious domain. > Neither can passwords if you're using a password manager to handle them.

This is absolutely not true, it depends heavily on usage patterns of the password manager and its features. Not all are browser extensions that autofill, and even if they did, sites change their domains for auth occasionally that break this functionality (or more often, signup is on a different domain from auth) meaning you must manually copy-paste your password somewhat often if you don't meticulously, and manually, maintain your domain list for a credential. The average person is *not* going to do that, they're going to go "huh, it broke again" and copy paste their randomly generated password.

Please, do not give security advice you are not equipped to handle.

Re: Passkeys: A shattered dream

#306

Post by throwaway48476 »

mavhc wrote: post #244
cuu508 wrote: post #230

Earlier quoted context omitted.

It is like a key to start your car, except you can register it with multiple cars. And it has 25 or so "slots" for car registrations. If you lose the key, you cannot order a copy from the car manufacturer. You also cannot make a copy yourself. But you can (usually) register multiple keys with the same car. You do this by plugging two keys into the same car, and the car learns both keys belong to the same owner. You j…

That is how you add new keys to my car, have 2 existing keys present to add a third

What happens if you lose one and buy another?

Re: Passkeys: A shattered dream

#307

Post by triblemaster »

vbezhenar wrote: post #231
triblemaster wrote: post #202

Earlier quoted context omitted.

A physical device which is not your computer stores some secret information which can authenticate you. This can be passwords, passkeys, GPG keys, your retina etc. The physical device can be password protected. So you have two step authentication: 1. your physical device 2. your password to that device Phones are currently being promoted for various reasons, but I believe something like Yubikeys or other FIDO2 fobs w…

Safari on macOS uses passkeys without phone. So unless you consider security chip inside macbook a separate device, that's not true, that's just one of modes.

Security chip inside macbook is a separate device for authentication purposes if it needs to be unlocked and cannot be bypassed by the OS.

Re: Passkeys: A shattered dream

#308

Post by vel0city »

c0wb0yc0d3r wrote: post #298
throwaway48476 wrote: post #294

Earlier quoted context omitted.

The unstated value of a USB key is the functional similarity to metal keys for ordinary people.

This is exactly how I describe them to many as well. I just wish there was a USB key with the durability of a metal key.

Somewhat personal ancedote, but I've had pretty good experiences with Yubikeys. I've had one on my daily keychain for over a decade now. Its been run through clothes washing machines too many times to count, I've left it out in rainstorms, its been baked in the sun on hot summer days multiple times, its been dropped in pools, its been run over by a car, I've dropped it some pretty significant heights while hiking. It is still working just fine. That and a PNY 16GB metal keychain flash drive have taken a ton of abuse and are still working just fine. Other than a higher melting point or ability to take high energy RF I don't imagine there is much more abuse a traditional metal key would have compared to what I've done to my Yubikey.

Re: Passkeys: A shattered dream

#309

Post by abadpoli »

vel0city wrote: post #301
rcarmo wrote: post #297

Earlier quoted context omitted.

It's still not a great multi-platform/multi-device story. I use multiple machines regularly (and I've migrated away from 1Password to the KeePass ecosystem, by the way) so syncing passkeys from my Mac(s) to my iPad, to my Fedora machines and my Windows working environment is simply not happening any way I look at it. Passkeys are great for consumers who use one or two devices (or browsers - I also switch browsers fre…

You shouldn't ~~necessarily~~ need to "sync" your passkeys across all your devices; each device should have its own passkey. Then if you lose a device (or that one device gets compromised), you revoke the one key and everything else is fine. Similar to SSH keys. No reason to use the same key on all your machines, use a different key from different places. The passkeys on my laptop are different from the passkeys on m…

Great in theory, but in practice there are still a frustrating amount of websites and services that put a low upper limit (usually just one or two) of the number of keys you can enroll.

This effectively makes it impossible to do what you’re saying. It sucks.

Re: Passkeys: A shattered dream

#310

Post by NoMoreNicksLeft »

michaelt wrote: post #250
joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

> I’ve avoided passkeys so far because I just don’t have a good mental model of them. OK, so the simplest way to understand is to first know about the previous generation. U2F keys are designed to be used alongside a username and password, as a more secure replacement for phone apps showing 6-digit codes. In U2F the key has a hardware 'secure element' where secrets can't be extracted, even if you plug it into a compr…

This sounds, to me, like a really bad and convoluted way of storing pub/priv in a password manager, and hoping the software implementation gets it right when it's trying to manage these things for me because I'm too dumb to manage passwords and too hobbled by bad IT policies that want to change my passwords every 4 weeks.
Post reply on HN