Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

311–320 of 789 posts

Re: Passkeys: A shattered dream

#311

Post by vel0city »

abadpoli wrote: post #309
vel0city wrote: post #301

Earlier quoted context omitted.

You shouldn't ~~necessarily~~ need to "sync" your passkeys across all your devices; each device should have its own passkey. Then if you lose a device (or that one device gets compromised), you revoke the one key and everything else is fine. Similar to SSH keys. No reason to use the same key on all your machines, use a different key from different places. The passkeys on my laptop are different from the passkeys on m…

Great in theory, but in practice there are still a frustrating amount of websites and services that put a low upper limit (usually just one or two) of the number of keys you can enroll. This effectively makes it impossible to do what you’re saying. It sucks.

I hear this a lot but it hasn't generally been my experience. The only site I've personally come across that supports webauthn/passkeys but doesn't support multiple is the AWS management page. Which I essentially bypass by just configuring SSO and using an IdP which does support it.

Every other site I've come across that supports these things supports multiple. What common sites support only one or two?

Re: Passkeys: A shattered dream

#312

Post by SAI_Peregrinus »

pseudo0 wrote: post #224
jve wrote: post #195

Earlier quoted context omitted.

Well that doesn't help understand: How passkeys can be backed up? Where/how they are stored? What if I loose my phone, computer? How can I login to some app using pc/mobile? I haven't been into passkeys as you see, but some easy login like that leaves me with a lot of questions.

The TL;DR version in my opinion is that passkeys are quite similar to a SSH key pair, like one you'd use on GitHub. Basically you generate a key pair, the server stores the public key, and the client stores the private key. When you want to authenticate, the server sends a challenge, you sign it with your private key, and send it back. The main debate is over how to manage those keys after generation. - Backups: It d…

> The private keys can't actually be stored in the HSM though, because you need to be able to back them up.

Every actual HSM I've ever used allows some sort of encrypted export. But actual HSMs are expensive and PKCS#11 is a terrible API so they suck to use.

Re: Passkeys: A shattered dream

#313

Post by Timothee »

joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

I’m in the same place.

I feel like most of the replies to your comment talk about the technical aspect of it.

What’s stopping me is that I don’t have a mental model of the management of the passkeys for the whole lifecycle of my account. Can I use it cross platform? Can I allow someone else to use the same account? What happens if I lose or don’t have access to my phone or laptop? What if I die, can my spouse log in my accounts?

With username/password, it’s very clear what I need. I could write it on paper and give it to someone and it’d work. I feel more at risk of losing access to my accounts if I were to switch to passkeys, because I don’t fully grasp their long term lifecycle.

Re: Passkeys: A shattered dream

#314

Post by droopyEyelids »

frizlab wrote: post #104

My biggest issue with passkey is not passkey itself, which, when it works, is great, but more the implementation of it done on most websites. Use a passkey on https://www.passkeys.io and it works great! On google too. But use it on PayPal, it does not anymore. Who’s to blame?

Paypal has a really obnoxious failed implementation of passkeys where if you have totp configured, their login flow takes you to TOTP after your passkey auth.

If you want your passkey to “just work” you have to turn off TOTP. But thats a bad idea because passkeys are an alternate method of auth with paypal, not a replacement for passwords. So then you are left with the option of a password only sign in (no TOTP) or a passkey.

Re: Passkeys: A shattered dream

#315

Post by arianvanp »

jchw wrote: post #228
arianvanp wrote: post #212

Earlier quoted context omitted.

FWIW: MacOS and iOS allow third party password managers to ingrate directly into AuthenticationServices and list passkeys in the native passkey UI through a "Credential Provider" extension. And it's documented how: https://developer.apple.com/documentation/authenticationserv... This is the same Credential Provider API they already have to integrate with to show the password autofill in iOS so there is already _some_…

> 1Password _could_ just integrate with the native UI. But they chose not to. This however means shipping a native app which is a lot more heavy-weight than shipping a web extension. I mean, I kind of understand this; they're going to have to do the WebExtension either way, since there's no standard API across platforms.

On the other hand. They already integrate with this API for their iOS app as it's the only way to do password autocomplete on iOS. Why not extend that use to MacOS?

Re: Passkeys: A shattered dream

#316

Post by vel0city »

Spivak wrote: post #239
brabel wrote: post #191

Earlier quoted context omitted.

They shouldn't be exactly like SSH keys. With SSH keys, you can go and copy/paste your private keys on a scammer's website because they asked you nicely. People will totally do it as they don't understand what they're doing. The main thing with passkeys, and key dongles in general, is that you simply can't do that as the keys are inaccessible and you can only prove possession of a key when asked by a domain you've ex…

There's a big difference between "can't just hit the copy button and paste in the key" and "can't export the key as part of a backup." Physically preventing users from ever accessing their own keys is an absurd user-hostile proposition. Even more absurd when the they're software keys stored in a database the user can decrypt. The FIDO alliance is just ensuring that password managers will require 3rd party backup tool…

> ssh keys prevent phishing with IdentitiesOnly

There has been a pretty insane number of times I've asked someone for their SSH public key and I get a response of ---- BEGIN RSA PRIVATE KEY ----. From people employed in tech jobs. Now imagine someone who barely understands how to use a computer, they're an easy target to get their identity phished.

Re: Passkeys: A shattered dream

#317

Post by NoMoreNicksLeft »

vel0city wrote: post #301
rcarmo wrote: post #297

Earlier quoted context omitted.

It's still not a great multi-platform/multi-device story. I use multiple machines regularly (and I've migrated away from 1Password to the KeePass ecosystem, by the way) so syncing passkeys from my Mac(s) to my iPad, to my Fedora machines and my Windows working environment is simply not happening any way I look at it. Passkeys are great for consumers who use one or two devices (or browsers - I also switch browsers fre…

You shouldn't ~~necessarily~~ need to "sync" your passkeys across all your devices; each device should have its own passkey. Then if you lose a device (or that one device gets compromised), you revoke the one key and everything else is fine. Similar to SSH keys. No reason to use the same key on all your machines, use a different key from different places. The passkeys on my laptop are different from the passkeys on m…

> You shouldn't necessarily "sync" your passkeys across all your devices; each device should have its own passkey. Then if you lose a device (or that one device gets compromised), you revoke the one key and everything else is fine.

If he's storing his passkey in his password manager, it wouldn't matter that he lost the device. They can't get to it, it's AES-somebigassnumber-ed up the wazoo. If the passkey is cached outside of the password manager, then passkeys are a horrible idea, where you have to "go home and call the 800 numbers to cancel the credit cards", and worse still, people with few devices might end up in circumstances where they have no valid devices left to bootstrap access.

I am resigned to the fact that I will die with humanity never having solved the problem of passwords adequately, but being that I will live another two decades minimum, I will get to see two more of the stupidest possible non-solutions.

Re: Passkeys: A shattered dream

#318

Post by pimlottc »

joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

Nice to hear I'm not the only one. Part of the problem is that it's always presented post-login when I'm already in the middle of doing something. And my password manager works well, so I don't see a clear benefit and I'm not really motivated to investigate vague claims.

Re: Passkeys: A shattered dream

#319

Post by jchw »

arianvanp wrote: post #315
jchw wrote: post #228

Earlier quoted context omitted.

> 1Password _could_ just integrate with the native UI. But they chose not to. This however means shipping a native app which is a lot more heavy-weight than shipping a web extension. I mean, I kind of understand this; they're going to have to do the WebExtension either way, since there's no standard API across platforms.

On the other hand. They already integrate with this API for their iOS app as it's the only way to do password autocomplete on iOS. Why not extend that use to MacOS?

Maybe they will eventually, but the macOS app is a cross-platform Electron app, isn't it? I'm guessing none of the code is shared.

Re: Passkeys: A shattered dream

#320

Post by cgeier »

vel0city wrote: post #301
rcarmo wrote: post #297

Earlier quoted context omitted.

It's still not a great multi-platform/multi-device story. I use multiple machines regularly (and I've migrated away from 1Password to the KeePass ecosystem, by the way) so syncing passkeys from my Mac(s) to my iPad, to my Fedora machines and my Windows working environment is simply not happening any way I look at it. Passkeys are great for consumers who use one or two devices (or browsers - I also switch browsers fre…

You shouldn't ~~necessarily~~ need to "sync" your passkeys across all your devices; each device should have its own passkey. Then if you lose a device (or that one device gets compromised), you revoke the one key and everything else is fine. Similar to SSH keys. No reason to use the same key on all your machines, use a different key from different places. The passkeys on my laptop are different from the passkeys on m…

How do I then get the passkey for my second device accepted by the service? Do I mail the public part to myself and insert it from my first device?
Post reply on HN