Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

321–330 of 789 posts

Re: Passkeys: A shattered dream

#321

Post by flkiwi »

pimlottc wrote: post #318
joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

Nice to hear I'm not the only one. Part of the problem is that it's always presented post-login when I'm already in the middle of doing something. And my password manager works well, so I don't see a clear benefit and I'm not really motivated to investigate vague claims.

I agree, plus the added abrasion from passkeys being implemented inconsistently and seemingly in a way that promotes vendor lock-in. Do I need a different passkey for my iPhone and an android tablet? Do I need a different passkey between iOS devices? Why does this service allow me to use a passkey in Bitwarden, but that service doesn't? These are all questions I've never had to ask about a complex password in a password manager.

Re: Passkeys: A shattered dream

#322

Post by troyvit »

saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

I've had a link to OnlyKey's user guide bookmarked for about a year[1]. They're an open hardware company that offers a key. Despite that I still can't be bothered to go through with it. The article we're talking about includes many of the reasons.

I feel bad for the author. They put a lot of their heart into something that could have been awesome.

[1] https://docs.onlykey.io/usersguide.html

Re: Passkeys: A shattered dream

#323

Post by rcarmo »

vel0city wrote: post #301
rcarmo wrote: post #297

Earlier quoted context omitted.

It's still not a great multi-platform/multi-device story. I use multiple machines regularly (and I've migrated away from 1Password to the KeePass ecosystem, by the way) so syncing passkeys from my Mac(s) to my iPad, to my Fedora machines and my Windows working environment is simply not happening any way I look at it. Passkeys are great for consumers who use one or two devices (or browsers - I also switch browsers fre…

You shouldn't ~~necessarily~~ need to "sync" your passkeys across all your devices; each device should have its own passkey. Then if you lose a device (or that one device gets compromised), you revoke the one key and everything else is fine. Similar to SSH keys. No reason to use the same key on all your machines, use a different key from different places. The passkeys on my laptop are different from the passkeys on m…

Actually, I much prefer to use the same SSH key for deployments from any of my machines, so that example doesn't really work for me (I do have multiple keys).

Re: Passkeys: A shattered dream

#324

Post by madeofpalk »

kiwijamo wrote: post #121
madeofpalk wrote: post #86

Earlier quoted context omitted.

I think it is true that you can's export passkeys stored in Apple Keychain. However, the statement is false in two ways: - Apple's iCloud Keychain syncs across devices - Apple has APIs that allow third party apps to create and offer passkeys, presented as a first-class option in Apple's authentication system. I use this to sync my passkeys between my Mac, Windows PC, and iPhone.

How do you sync it to your Windows PC? Is it native Apple-Microsoft sync or does it require e.g. installing an Apple application?

1Password

Re: Passkeys: A shattered dream

#325

Post by shepherdjerred »

Here's my opposing view: I love Passkeys.

I use Firefox as my browser and 1Password as my password manager. On my iPhone, I use 1Password + Firefox.

I look at https://passkeys.directory/ every so often and switch my logins from passwords to passkeys. This has included a lot of my common logins like GitHub, Google, and Microsoft.

There is a lot of confusing terminology. For some reason sites will say "login with Touch ID" or "login with Windows Hello" instead of "login with Passkey".

Aside from that quirk, I love it. 1Password syncs my passkeys between devices. I can use them both on my laptop and my phone. It would be inconvenient if I needed to login to a shared computer e.g. at a library or friend's house, but I don't do that often enough to care (though of course some people do, which is totally valid).

Re: Passkeys: A shattered dream

#326

Post by shepherdjerred »

macrael wrote: post #75

Passkeys can't actually replace passwords, right? I will always need a username and password with a website, then can generate a passkey as a separate auth mechanism, which if I lose, I will recover by setting up again using my username and password? I don't get how we can get to a place where passkeys are all, how do you get a passkey on a new device when you only have passkey auth on some other device enabled?

It depends on the implementation. Some sites use it to replace both 2FA and passwords, some use it for just 2FA.

> how do you get a passkey on a new device when you only have passkey auth on some other device enabled?

You'd use a sync service like a password manager.

Re: Passkeys: A shattered dream

#327

Post by troyvit »

packetlost wrote: post #305
masklinn wrote: post #169

Earlier quoted context omitted.

> Passkeys can’t be phished, or shoulder peeped, or entered on a malicious domain. And for the layman, it means they can’t forget their password. Neither can passwords if you’re using a password manager to handle them. So again, if you’ve already got a password manager, and would put your passkeys in a password manager, what is the benefit of passkeys?

>> Passkeys can’t be phished, ..., or entered on a malicious domain. > Neither can passwords if you're using a password manager to handle them. This is absolutely not true, it depends heavily on usage patterns of the password manager and its features. Not all are browser extensions that autofill, and even if they did, sites change their domains for auth occasionally that break this functionality (or more often, signu…

> Passkeys have no easy way to extract the private key and do not request to enter the private key to authenticate.

Sure the do. All somebody needs is the password to your password manager. It's a single point of failure and by putting your passkeys in there to you've made it even more vulnerable.

Do you put a passkey on your password manager that exists outside of that ecosystem? Once you have that why not just use it for everything?

The parent wasn't giving security advice. They were asking a valid question.

Re: Passkeys: A shattered dream

#328

Post by shepherdjerred »

whereismyacc wrote: post #174
bradley13 wrote: post #128

Earlier quoted context omitted.

That's not the idea, no. The idea is that - instead of a password - you have a cryptographic key. Like an SSH key. This key is managed for you, so you never have to see it or type it. You ought to be able to either have just a few keys, or else a different key for every service you use. Unfortunately, the big players are trying to force this (really excellent!) idea into platform dependency. They want to store the ke…

Wouldn't transferring the keys around just massively increase the attack surface? There's a security reason why we want them stored on-device and never moved, right?

Think of all of the password leaks you've heard of. How many were due to syncing password vs password reuse, poor site security (e.g. storing in plaintext, weak encryption, etc.)

I'm not saying syncing is 100% secure (nothing is), but for most people it's not the main attack surface to be concerned about.

Re: Passkeys: A shattered dream

#329

Post by gruez »

Twisell wrote: post #291
gruez wrote: post #219

Earlier quoted context omitted.

>2) In the second case when one service is breached you'd still have to manage rotation of public key somehow Why would you need to rotate your keys? If they're storing passwords/hashes it makes sense to rotate because they might be able to brute force the hashes on a GPU cluster, but you're not going to be able to brute force a randomly generated public key.

If I have any fear that the associated private key have leaked. For instance if my off-site encrypted backup is stolen. I sure would want to rotate my private key because my secret would be only as safe as the encryption method at the time the backup was stolen. I'm still not entirely sold on the "quantum will break any current crypto" but better safe than sorry.

>If I have any fear that the associated private key have leaked. For instance if my off-site encrypted backup is stolen.

That sounds like a totally separate threat compared to "when one service is breached". In your last comment you were talking about your password manager being hacked, but in the post before that you were talking about the service (ie. the website you're using) being hacked?

Also, while I do agree that if your your password manager database were hacked you would need to rotate both passwords and passkeys, but I would hope that occurs far less frequently than some random service you use getting hacked.

Re: Passkeys: A shattered dream

#330

Post by lo0dot0 »

tssva wrote: post #193
bitlevel wrote: post #154

Earlier quoted context omitted.

I would also like to know how this is achieved.

Apple’s iCloud for Windows includes an iCloud Password app which allows accessing and managing your keychain stored passwords on Windows. They also have a browser extension for Chrome and Edge which does autofilling in those browsers on Windows. I haven’t used them in a long time so I don’t know if they have added passkey support to them yet.

How do you sync to an Android phone?
Post reply on HN