Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

401–410 of 789 posts

Re: Passkeys: A shattered dream

#401

Post by sedatk »

skybrian wrote: post #395

I don't trust passkeys, and yet so far, I'm not bothered by them. This is because I use them as an additional way to log in. The other day I noticed that for some reason GitHub couldn't seem to find my Android passkey. Weird. So I logged in using my Yubikey and recreated it. But this would be a lot worse if it were your only way of logging in. Always have multiple authentication methods for important accounts.

You can have multiple passkeys (using different devices or passkey providers) for a single site too. You don't need to fall back to another login mechanism.

Re: Passkeys: A shattered dream

#402

Post by m0dest »

threatofrain wrote: post #99
politelemon wrote: post #32

> At this point I think that Passkeys will fail in the hands of the general consumer population. Actually, I think it might be worse. The predators like Apple/Google have already pounced on passkeys as a consumer capture mechanism, so they'll ensure it doesn't fail.

They're a consumer capture mechanism insofar as password management tools are, and we want users to use those because they make security tolerable. The problem is that it turns out the OS vendor was in the best place to win the password management game.

The lock-in situation with passkeys seems far worse than with password managers, though. There is no "export" option for iCloud passkeys - despite being cloud-synced across your Apple devices.

If you decide to switch from an iPhone to an Android phone, you're looking at an arduous process of enrolling a new passkey for every single site.

Re: Passkeys: A shattered dream

#403

Post by patmorgan23 »

macrael wrote: post #75

Passkeys can't actually replace passwords, right? I will always need a username and password with a website, then can generate a passkey as a separate auth mechanism, which if I lose, I will recover by setting up again using my username and password? I don't get how we can get to a place where passkeys are all, how do you get a passkey on a new device when you only have passkey auth on some other device enabled?

Passkeys change nothing about account recovery. The same process for a forgotten password should be followed for a lost passkey.

Re: Passkeys: A shattered dream

#404

Post by kevinsync »

selykg wrote: post #302
chrisweekly wrote: post #277

Earlier quoted context omitted.

> "and use fingerprint/faceid instead of a password" This is the part that makes absolutely no sense to me. An essential aspect of passwords is that they can be changed. If someone manages to fake the digital representation of my fingerprints or face, what now? Security guru Bruce Schneier has written about this w/ much more eloquence and authority.

The biometric stuff is simply allowing access to the keys. It’s not being used for anything else. Your face or fingerprint being out there isn’t a concern because that’s not, ultimately, the thing being used to generate the keys or anything. It’s an ease of use function. On iOS for instance, as I understand it, these are being stored in iCloud Keychain. Which has a password. The derived key for iCloud Keychain is sto…

Agree. I actually wanted to acquire a biometric signature to do something with it on iOS and was super bummed once I dug in to see how it works -- all Apple exposes is a function that returns true or false hahaha

Re: Passkeys: A shattered dream

#405

Post by vel0city »

Macha wrote: post #358
vel0city wrote: post #301

Earlier quoted context omitted.

You shouldn't ~~necessarily~~ need to "sync" your passkeys across all your devices; each device should have its own passkey. Then if you lose a device (or that one device gets compromised), you revoke the one key and everything else is fine. Similar to SSH keys. No reason to use the same key on all your machines, use a different key from different places. The passkeys on my laptop are different from the passkeys on m…

I use far more sites than I ssh into servers, which makes this much more of a pain. Like, every time I sign up to a site I need to grab all 5+ devices I might ever use and add them to every site, or I can't e.g. log into my D&D game while travelling because I forgot to generate a key on the work laptop? If all my devices are destroyed in a house fire again, I'm locked out of everything? These have been my big concern…

> every time I sign up to a site I need to grab all 5+ devices I might ever use and add them to every site, or I can't e.g. log into my D&D game while travelling because I forgot to generate a key on the work laptop?

You don't need to log in to every app on every device the instant you register a new account. Just make a passkey on a couple of devices that you're likely to have around and you'll probably have what you need when you need it. When I register on a new site that uses passkeys, I might create a key on whatever computer I'm on and a portable authenticator like my phone or my security token.

So, say I'm at home on my deskop, and TotallyCoolService has the option for a passkey. I'll make one on my desktop, and then go ahead and make one on my security token. Later I'm out and I want to check in on TotallyCoolService on my phone. No worries, I just tap my security token to my phone and I'm logged in. Later I'm in the garage working on my motorcycle and want to reference something on TotallyCoolService on my laptop and my USB token is in my backpack inside. No problem, I can sign in with my phone. Now I've got security tokens on most of my common devices and its not like I had to spend time gathering all of them at account creation.

I don't instantly run home to my desktop and log in the moment I sign up for a new site while out and about. But I do go and sign in eventually, even if only to ensure there's a backup key there.

Re: Passkeys: A shattered dream

#406

Post by michaelt »

red_admiral wrote: post #383
michaelt wrote: post #250

Earlier quoted context omitted.

> I’ve avoided passkeys so far because I just don’t have a good mental model of them. OK, so the simplest way to understand is to first know about the previous generation. U2F keys are designed to be used alongside a username and password, as a more secure replacement for phone apps showing 6-digit codes. In U2F the key has a hardware 'secure element' where secrets can't be extracted, even if you plug it into a compr…

Yubikeys absolutely took off in certain corporate, government and tech environments. Just not so much with the general public.

Eh, somewhat. The lost key account recovery story is much better in large organisations, where you have a 24/7 helpdesk that can check your ID badge in person, a HR department with a photocopy of your passport, and suchlike.

But for example if you're using Azure/AD? No U2F + Password allowed, gotta go straight to "passwordless" [1].

So they never took off far enough for Microsoft to support them.

[1] https://learn.microsoft.com/en-us/entra/identity/authenticat...

Re: Passkeys: A shattered dream

#407

Post by caconym_ »

joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

A few weeks ago, I was unable to log in to Google on a new device with my 2FA token (Yubikey) because Google insisted on authenticating with a passkey/resident key, but the token had only been set up with non-resident TOTP or whatever it's called (and had been working properly in this mode for over a year). I was able to log in on another device and register the Yubikey with a passkey/resident key, but it was really scary! There is so much complexity here, and so little visibility and control afforded to users, that I feel very uncomfortable trusting it as my only login method for any moderately important service.

It's possible this was a Mac OS problem, but I don't think it really matters. Either way, this stuff needs to be absolutely rock solid and frictionless if normal people are going to use it safely, and it obviously isn't.

Re: Passkeys: A shattered dream

#409

Post by yonatan8070 »

dfabulich wrote: post #366
joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

People keep trying to answer this question, so I'll try, too, but I'm going to do a better job than anyone else. ;-) Passkeys are randomly generated passwords that are required to be managed by a password manager. All the major password managers support them, including Apple, Google, Microsoft, Mozilla, and 1Password. By requiring the passkey to be managed by a password manager, you get some anti-phishing protection.…

So passkeys are essentially like SSH keys but for web/app logins

Re: Passkeys: A shattered dream

#410

Post by discardedrefuse »

dfabulich wrote: post #366
joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

People keep trying to answer this question, so I'll try, too, but I'm going to do a better job than anyone else. ;-) Passkeys are randomly generated passwords that are required to be managed by a password manager. All the major password managers support them, including Apple, Google, Microsoft, Mozilla, and 1Password. By requiring the passkey to be managed by a password manager, you get some anti-phishing protection.…

> Passkeys can make it harder to switch password managers because the password managers are designed not to let you copy-and-paste a passkey, including from Google's Password Manager to Apple's Password Manager.

This part right here is what I fear the most about Passkeys. I've read too many horror stories of people getting banned from Google (often for no valid reason) and losing access to all of their data. It is absolutely insane to hand over all your passwords to a company like this.

Post reply on HN