Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

351–360 of 789 posts

Re: Passkeys: A shattered dream

#351

Post by cuu508 »

vel0city wrote: post #311
abadpoli wrote: post #309

Earlier quoted context omitted.

Great in theory, but in practice there are still a frustrating amount of websites and services that put a low upper limit (usually just one or two) of the number of keys you can enroll. This effectively makes it impossible to do what you’re saying. It sucks.

I hear this a lot but it hasn't generally been my experience. The only site I've personally come across that supports webauthn/passkeys but doesn't support multiple is the AWS management page. Which I essentially bypass by just configuring SSO and using an IdP which does support it. Every other site I've come across that supports these things supports multiple. What common sites support only one or two?

AWS now supports multiple MFA devices per account.

Re: Passkeys: A shattered dream

#352

Post by vel0city »

nottorp wrote: post #238
threatofrain wrote: post #98

Earlier quoted context omitted.

Passkeys only encourage the need for a password management tool, which is funny because if everyone had password management tools to begin with then we wouldn't need passkeys.

> Passkeys only encourage the need for a password management tool The dependency on a password management tool. Be it Yubikey or Apple secure enclave or whatever, it's a shit piece of hardware that will eventually break. Have fun replacing all your credentials at the same time when your phone dies.

> Have fun replacing all your credentials at the same time when your phone dies.

I won't have to, because I've got passkeys on my desktop, my laptop, on my security token, etc. Losing one device won't lock me out.

Re: Passkeys: A shattered dream

#353

Post by vel0city »

cuu508 wrote: post #351
vel0city wrote: post #311

Earlier quoted context omitted.

I hear this a lot but it hasn't generally been my experience. The only site I've personally come across that supports webauthn/passkeys but doesn't support multiple is the AWS management page. Which I essentially bypass by just configuring SSO and using an IdP which does support it. Every other site I've come across that supports these things supports multiple. What common sites support only one or two?

AWS now supports multiple MFA devices per account.

That's awesome to hear, thanks for sharing!

Re: Passkeys: A shattered dream

#354

Post by formerly_proven »

> Within enterprise there still is a place for attested security keys where you can control the whole experience to avoid the vendor lockin parts. It still has rough edges though.

Just use PKI / X.509 with hybrid smartcards for enterprise use cases. Sure, it’s “legacy” and you need an PKI expert to set it up, but it actually works and is genuinely platform-, vendor- and protocol-agnostic. FIDO is smelly poo poo in comparison.

Also, smartcards had usernameless for 30 years.

Edit: actually we’ve been here before. Remember the tag? Platforms (browsers) could generate a key pair for you, store the private key in their key store (I think actually supported smartcards as well), and forward the public key to the server for enrollment. The server then sent the signed certificate back. That’s pretty much exactly passkeys. This was somewhat widely used for “high security” applications at its peak, circa 2007.

Similar problems like passkeys caused issues, it was difficult for users to get their keys and back them up, most people were just one hard drive crash away from loosing access.

Re: Passkeys: A shattered dream

#356

Post by nindalf »

stetrain wrote: post #275
joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

You can store passkeys in a password manager as well: https://1password.com/product/passkeys The super simple explanation is: SSH keys for websites. You have a unique private key for each website account stored on your device, in a local password manager, or in a cloud synced password manager (iCloud account, Google account, 1Password, etc). The website only gets the public key, so unlike password auth your secret is…

How do the private keys get synced across my devices? What's the default in the Apple, Google and Microsoft ecosystems? Devices get lost after all.

Re: Passkeys: A shattered dream

#357

Post by taeric »

chrisweekly wrote: post #277
michaelt wrote: post #250

Earlier quoted context omitted.

> I’ve avoided passkeys so far because I just don’t have a good mental model of them. OK, so the simplest way to understand is to first know about the previous generation. U2F keys are designed to be used alongside a username and password, as a more secure replacement for phone apps showing 6-digit codes. In U2F the key has a hardware 'secure element' where secrets can't be extracted, even if you plug it into a compr…

> "and use fingerprint/faceid instead of a password" This is the part that makes absolutely no sense to me. An essential aspect of passwords is that they can be changed. If someone manages to fake the digital representation of my fingerprints or face, what now? Security guru Bruce Schneier has written about this w/ much more eloquence and authority.

Your fingerprint/faceid/whatever is used to access the passkey. It is not the passkey. To that end, yes, if you are worried about clandestine access to your phone (if that is your passkey), then you probably don't want to allow access using fingerprint/faceid. And if someone can copy your passkey off of your phone, you are again compromised.

Re: Passkeys: A shattered dream

#358

Post by Macha »

vel0city wrote: post #301
rcarmo wrote: post #297

Earlier quoted context omitted.

It's still not a great multi-platform/multi-device story. I use multiple machines regularly (and I've migrated away from 1Password to the KeePass ecosystem, by the way) so syncing passkeys from my Mac(s) to my iPad, to my Fedora machines and my Windows working environment is simply not happening any way I look at it. Passkeys are great for consumers who use one or two devices (or browsers - I also switch browsers fre…

You shouldn't ~~necessarily~~ need to "sync" your passkeys across all your devices; each device should have its own passkey. Then if you lose a device (or that one device gets compromised), you revoke the one key and everything else is fine. Similar to SSH keys. No reason to use the same key on all your machines, use a different key from different places. The passkeys on my laptop are different from the passkeys on m…

I use far more sites than I ssh into servers, which makes this much more of a pain. Like, every time I sign up to a site I need to grab all 5+ devices I might ever use and add them to every site, or I can't e.g. log into my D&D game while travelling because I forgot to generate a key on the work laptop? If all my devices are destroyed in a house fire again, I'm locked out of everything? These have been my big concerns.

Re: Passkeys: A shattered dream

#359

Post by ryandrake »

michaelt wrote: post #250
joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

> I’ve avoided passkeys so far because I just don’t have a good mental model of them. OK, so the simplest way to understand is to first know about the previous generation. U2F keys are designed to be used alongside a username and password, as a more secure replacement for phone apps showing 6-digit codes. In U2F the key has a hardware 'secure element' where secrets can't be extracted, even if you plug it into a compr…

[deleted]

Re: Passkeys: A shattered dream

#360

Post by packetlost »

troyvit wrote: post #327
packetlost wrote: post #305

Earlier quoted context omitted.

>> Passkeys can’t be phished, ..., or entered on a malicious domain. > Neither can passwords if you're using a password manager to handle them. This is absolutely not true, it depends heavily on usage patterns of the password manager and its features. Not all are browser extensions that autofill, and even if they did, sites change their domains for auth occasionally that break this functionality (or more often, signu…

> Passkeys have no easy way to extract the private key and do not request to enter the private key to authenticate. Sure the do. All somebody needs is the password to your password manager. It's a single point of failure and by putting your passkeys in there to you've made it even more vulnerable. Do you put a passkey on your password manager that exists outside of that ecosystem? Once you have that why not just use…

> Sure the do. All somebody needs is the password to your password manager. It's a single point of failure and by putting your passkeys in there to you've made it even more vulnerable.

Not more vulnerable than if they were just using password. You're still missing my point, password managers do not give you the ability to just copy-paste the private key of a passkey into a form field, unlike passwords. Some don't give you access to it at all (*cough* Apple *cough*). Sure you can get the private key if you have access to the password managers vault, but that's not what's being talked about. Common usage patterns matter immensely in security. At the end of the day, the attack surface for passkey-based authentication is smaller than password-based authentication, which is a step in the right direction.

> The parent wasn't giving security advice. They were asking a valid question.

The parent made a blatantly false and dangerous statement and then followed it up with a question. Did we read the same comment?

Post reply on HN