Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

421–430 of 789 posts

Re: Passkeys: A shattered dream

#421

Post by mac-mc »

dfabulich wrote: post #366
joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

People keep trying to answer this question, so I'll try, too, but I'm going to do a better job than anyone else. ;-) Passkeys are randomly generated passwords that are required to be managed by a password manager. All the major password managers support them, including Apple, Google, Microsoft, Mozilla, and 1Password. By requiring the passkey to be managed by a password manager, you get some anti-phishing protection.…

> By requiring the passkey to be managed by a password manager, you get some anti-phishing protection. A passkey includes metadata, including the website domain that created it, and the password managers simply won't provide the passkey to the wrong domain.

There are so many apps that don't get this right. Make a login on the website, store it in 1password, and then try to login in their mobile app and it doesn't show up as a password because the associated URL is mismatched on the mobile app. Like mybank.com and auth.mybankmobileapi.com

Re: Passkeys: A shattered dream

#422

Post by mdaniel »

cassianoleal wrote: post #78
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

I agree. So far I think KeePassXC is the only one that allows you to export your Passkeys. I believe Bitwarden are working on it as well. That said, it's unclear whether this will provide any portability of passkeys between providers.

untrue, 1Password stores the private key just like any other key material, and one can export it or get the private key from the bamboo menu

    "passkey": {
      "type": "webauthn",
      "createdAt": 1696352105,
      "privateKey": "eyJrdHkiOiJ...",
      "userHandle": "cafebabeDeadBeef..."
    },

Re: Passkeys: A shattered dream

#423

Post by Spunkie »

red_trumpet wrote: post #168
4ad wrote: post #113

Earlier quoted context omitted.

It's the same, you should not store or backup SSH Keys.

I have to store them on my disc, in order to use them tomorrow.

Oddly enough you don't. We've been storing our ssh keys(ed25519-sk) as resident keys for years now without issue.

So basically we've been storing ssh keys directly on yubikeys the same way passkeys are stored since before passkeys were a thing.

It seemed a clearly superior option compared to letting ssh private keys roam around on random computers.

Re: Passkeys: A shattered dream

#424

Post by germinator »

klabb3 wrote: post #207
vanburen wrote: post #82

Usernameless always seemed like an optimization too far to me. I think it's totally reasonable, and probably a good thing for users having to use their username at login. Especially as it reminds them what username they are using for that service. I could totally see a situation where a user uses a Usernameless passkey for years to access a service and for some reason loses access to the Usernameless passkey, and the…

> Usernameless always seemed like an optimization too far to me. I think it depends on the service. But aside from the occasional forum or social site, usernames are just an extra step. I don’t want or need one for banking/administration/ordering a product. For better or worse, email is usually a better identifier, assuming you already need one for other reasons (like you say recovery is typically needed). > Especial…

> email is usually a better identifier, assuming you already need one for other reasons (like you say recovery is typically needed).

If you remember which one you signed up with, and it wasn't your work email from two jobs ago.

Re: Passkeys: A shattered dream

#425

Post by tptacek »

joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

The problem Passkeys (and FIDO2 and WebAuthn and U2F) solve is phishing. The core concept is mutual authentication: not just you to the service, but the service to your authenticator.

Re: Passkeys: A shattered dream

#426

Post by chrisweekly »

vel0city wrote: post #299
chrisweekly wrote: post #277

Earlier quoted context omitted.

> "and use fingerprint/faceid instead of a password" This is the part that makes absolutely no sense to me. An essential aspect of passwords is that they can be changed. If someone manages to fake the digital representation of my fingerprints or face, what now? Security guru Bruce Schneier has written about this w/ much more eloquence and authority.

The fingerprint/faceid is just a local proof to unlock the actual asymmetric encryption key. It is not your actual identifier to the remote server. So if you need to redo your auth, you just rekey and stash the new key in your authenticator (or have your authenticator originate the key material and never expose it to main memory at all). Think an SSH key protected by a passphrase. Your passphrase isn't the thing that…

thanks, that does help.

Re: Passkeys: A shattered dream

#427

Post by yunwal »

whymauri wrote: post #378
victor106 wrote: post #365

Earlier quoted context omitted.

> But they don't have the right to extract something from your brain. Most folks store passwords in password managers and don't use their brains to retrieve them.

password managers are growing, but I'm not sure that 'most' people use them. Maybe 'most' software engineers or techies, but the average person probably has no idea what a password manager is.

Depends what you consider a password manager. "Word doc with all my passwords in it" is effectively a password manager in this context

Re: Passkeys: A shattered dream

#428

Post by pixl97 »

selykg wrote: post #302
chrisweekly wrote: post #277

Earlier quoted context omitted.

> "and use fingerprint/faceid instead of a password" This is the part that makes absolutely no sense to me. An essential aspect of passwords is that they can be changed. If someone manages to fake the digital representation of my fingerprints or face, what now? Security guru Bruce Schneier has written about this w/ much more eloquence and authority.

The biometric stuff is simply allowing access to the keys. It’s not being used for anything else. Your face or fingerprint being out there isn’t a concern because that’s not, ultimately, the thing being used to generate the keys or anything. It’s an ease of use function. On iOS for instance, as I understand it, these are being stored in iCloud Keychain. Which has a password. The derived key for iCloud Keychain is sto…

"A pass key is an ssh key with more steps for the user to fuck up and get locked out of their account"

I mean there is plenty of FUD, but at the end of the day it's not terribly exciting technology.

Re: Passkeys: A shattered dream

#429

Post by toomuchtodo »

yonatan8070 wrote: post #409
dfabulich wrote: post #366

Earlier quoted context omitted.

People keep trying to answer this question, so I'll try, too, but I'm going to do a better job than anyone else. ;-) Passkeys are randomly generated passwords that are required to be managed by a password manager. All the major password managers support them, including Apple, Google, Microsoft, Mozilla, and 1Password. By requiring the passkey to be managed by a password manager, you get some anti-phishing protection.…

So passkeys are essentially like SSH keys but for web/app logins

They are a pleasant and improved UX for the equivalent of X.509 PKI primitives.

https://en.wikipedia.org/wiki/X.509

Re: Passkeys: A shattered dream

#430

Post by Spunkie »

bradley13 wrote: post #124
tux3 wrote: post #94

Earlier quoted context omitted.

"Exactly" is under a lot of strain here. SSH is nice because you don't have to think about it. Your private key sits in your .ssh folder, and then everything is transparent. You _can_ put an SSH key in a smartcard if you want, but you have to opt-in to this kind of pain. And even if you do, almost all SSH servers will support that login method without issue. Passkeys don't sit in your .passkey folder. Your browser do…

Passkeys ought to be exactly like SSH keys. Unfortunately, they are not. The attempts to restrict when and how they are stored, and how you can access them - those are going to cause a lot of pain and confusion. I have all of my SSH keys stored in KeepassXC, which (imho) is a lot more secure than having them hang around in my .ssh directory. Open KeepassXC, and the keys are available. Close it, and they're gone. Sync…

I would say the exact opposite, traditional ssh key management should eventually give way to resident keys. Aka, treating them just like passkeys.

We've been storing ssh keys directly on our yubikeys since before passkeys were a thing.

Not only is it clearly more secure it's also been a usability lift. Plugin your yubikey, start an ssh agent, and run ssh-add -K to get all your resident keys added to your current session.

Post reply on HN