Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

411–420 of 789 posts

Re: Passkeys: A shattered dream

#411

Post by sedatk »

shepherdjerred wrote: post #325

Here's my opposing view: I love Passkeys. I use Firefox as my browser and 1Password as my password manager. On my iPhone, I use 1Password + Firefox. I look at https://passkeys.directory/ every so often and switch my logins from passwords to passkeys. This has included a lot of my common logins like GitHub, Google, and Microsoft. There is a lot of confusing terminology. For some reason sites will say "login with Touch…

I went through passkeys.directory site and it's underwhelming. Too few sites implement it, and many implement it inconsistently:

- PayPal only allows one passkey and don't support logging in with it on Firefox on Windows. You still have to use your password.

- Twitter only offers it if you pay for a subscription.

- Playstation Network doesn't implement usernameless, and still asks for your email to log you in with a passkey.

It seems like we still have some way to go before we figure it all out.

Re: Passkeys: A shattered dream

#412

Post by t0asterb0t »

CogitoCogito wrote: post #392
dfabulich wrote: post #366

Earlier quoted context omitted.

People keep trying to answer this question, so I'll try, too, but I'm going to do a better job than anyone else. ;-) Passkeys are randomly generated passwords that are required to be managed by a password manager. All the major password managers support them, including Apple, Google, Microsoft, Mozilla, and 1Password. By requiring the passkey to be managed by a password manager, you get some anti-phishing protection.…

Do you know if there an open source self-hosted implementation available?

KeePassXC supports passkeys in its latest version: https://keepassxc.org/blog/2024-03-10-2.7.7-released/

Re: Passkeys: A shattered dream

#413

Post by FlxMgdnz »

The solution to most of the author's criticisms lies in not forcibly mixing Passkeys and WebAuthn-based 2FA.

As long as you are satisfied with passkeys being "usernameless" (i.e. discoverable), you can offer a nice login flow with a "Sign in with a passkey" button and Passkey Autofill.

For 2FA use cases, you should provide a second WebAuthn configuration that does not require discoverable credentials, for example, and does not necessarily require user verification.

This allows a user to have both fully-fledged passkeys and, for example, security keys as a second factor to secure username/password-based login. Users can choose what they want to do (create a passkey on e.g. iCloud or add security keys as 2FA without using precious key storage resources on the hardware tokens).

GitHub has done a very solid implementation of that model, and we are working on adopting it to our services and it's looking very good so far.

Re: Passkeys: A shattered dream

#414

Post by Macha »

vel0city wrote: post #405
Macha wrote: post #358

Earlier quoted context omitted.

I use far more sites than I ssh into servers, which makes this much more of a pain. Like, every time I sign up to a site I need to grab all 5+ devices I might ever use and add them to every site, or I can't e.g. log into my D&D game while travelling because I forgot to generate a key on the work laptop? If all my devices are destroyed in a house fire again, I'm locked out of everything? These have been my big concern…

> every time I sign up to a site I need to grab all 5+ devices I might ever use and add them to every site, or I can't e.g. log into my D&D game while travelling because I forgot to generate a key on the work laptop? You don't need to log in to every app on every device the instant you register a new account. Just make a passkey on a couple of devices that you're likely to have around and you'll probably have what yo…

This really doesn't contradict the problem of needing to sort out M sites x N devices, where M can be very large.

Whether you do it eventually or do it straight away. Unless you can predict which devices you will have and which sites you will need access to at any given point, then it degrades to needing everything authenticated just in case.

Re: Passkeys: A shattered dream

#415

Post by red_admiral »

yonatan8070 wrote: post #409
dfabulich wrote: post #366

Earlier quoted context omitted.

People keep trying to answer this question, so I'll try, too, but I'm going to do a better job than anyone else. ;-) Passkeys are randomly generated passwords that are required to be managed by a password manager. All the major password managers support them, including Apple, Google, Microsoft, Mozilla, and 1Password. By requiring the passkey to be managed by a password manager, you get some anti-phishing protection.…

So passkeys are essentially like SSH keys but for web/app logins

... with some of the functionality of SSH keys removed, like being able to use one key for many accounts, or many keys (on many machines) all for the same account.

At least that's how I understand it.

Re: Passkeys: A shattered dream

#416

Post by red_admiral »

dfabulich wrote: post #366
joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

People keep trying to answer this question, so I'll try, too, but I'm going to do a better job than anyone else. ;-) Passkeys are randomly generated passwords that are required to be managed by a password manager. All the major password managers support them, including Apple, Google, Microsoft, Mozilla, and 1Password. By requiring the passkey to be managed by a password manager, you get some anti-phishing protection.…

I'm assuming tech people would also like to know that a passkey is not just "a really long password" but also one that's never sent to the server directly - instead it's used in a challenge/response protocol (like SSH keys). Which requires software, either the browser or an external password manager, to run.

I think that's what you're getting at in paragraph 3?

There's no reason you couldn't have an open source passkey manager that allows you to backup and view the key if you really want to. SSH works just fine that way.

Re: Passkeys: A shattered dream

#417

Post by closeparen »

dfabulich wrote: post #366
joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

People keep trying to answer this question, so I'll try, too, but I'm going to do a better job than anyone else. ;-) Passkeys are randomly generated passwords that are required to be managed by a password manager. All the major password managers support them, including Apple, Google, Microsoft, Mozilla, and 1Password. By requiring the passkey to be managed by a password manager, you get some anti-phishing protection.…

Passkeys are signing a challenge using a captive secret, right? The relying party doesn't get the secret.

Re: Passkeys: A shattered dream

#418

Post by khimaros »

caconym_ wrote: post #398
CogitoCogito wrote: post #392

Earlier quoted context omitted.

Do you know if there an open source self-hosted implementation available?

Bitwarden, which you can self-host (I do this) seems to have at least partial support now, and I know they're working on improving it. However, I'm not sure if their client and server are both fully FOSS.

vaultwarden at the very least is libre

Re: Passkeys: A shattered dream

#419

Post by yunwal »

Timothee wrote: post #313
joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

I’m in the same place. I feel like most of the replies to your comment talk about the technical aspect of it. What’s stopping me is that I don’t have a mental model of the management of the passkeys for the whole lifecycle of my account. Can I use it cross platform? Can I allow someone else to use the same account? What happens if I lose or don’t have access to my phone or laptop? What if I die, can my spouse log in…

> I feel more at risk of losing access to my accounts if I were to switch to passkeys, because I don’t fully grasp their long term lifecycle.

It's my understanding that you can't switch password managers without generating a new passkey for each individual service you use (I'm not an expert here, so someone feel free to correct me). That's already enough for me to not switch.

Post reply on HN