Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

471–480 of 789 posts

Re: Passkeys: A shattered dream

#471

Post by Xelynega »

red_admiral wrote: post #415
yonatan8070 wrote: post #409

Earlier quoted context omitted.

So passkeys are essentially like SSH keys but for web/app logins

... with some of the functionality of SSH keys removed, like being able to use one key for many accounts, or many keys (on many machines) all for the same account. At least that's how I understand it.

Unless I'm missing something these are nothing like SSH keys. They would be closer to regular password auth with SSH where you store the password in a file that's only readable by SSH.

SSH keys are asymmetric such that I can make a public half available publicly and then use that to generate signatures of any challenge the server sends.

With passkeys either the server needs to store the value raw(making it susceptible to data breaches or malicious actors), or store the hashed value(making it impossible to do a challenge-response, and making it susceptible to MITM/replay attacks).

It seems to be all the downsides of SSH keys(aka losing it having implications), with none of the upsides, plus additional downsides(hardware devices can only generate 25 unique ones instead of using 1 and sending the public to all services with confidence it hasn't exposed any private info).

Re: Passkeys: A shattered dream

#472

Post by mdaniel »

noname120 wrote: post #452
mdaniel wrote: post #422

Earlier quoted context omitted.

untrue, 1Password stores the private key just like any other key material, and one can export it or get the private key from the bamboo menu "passkey": { "type": "webauthn", "createdAt": 1696352105, "privateKey": "eyJrdHkiOiJ...", "userHandle": "cafebabeDeadBeef..." },

Where did you see that? This comment just 4 months ago from 1Password says that exporting isn't possible: https://www.reddit.com/r/1Password/comments/18m4iph/comment/... And I haven't seen any announcements in the opposite direction. ———— Edit: so I just checked and I can confirm that it's not possible to export passkeys from 1Password. Neither of the two available export options include passkeys. > • 1PUX A 1Passwor…

Well then their enshitification just continues with their unending quest for burning every user-centric bridge they ever built. Goddamn

To answer your question, "bamboo menu, Copy Item JSON" which I believe is turned on due to my "Preferences, Advanced, Show debugging tools" being checked. I actually did try the $(op item get --format=json $its_uuid) first but figured there was some sekrit env var or --fields some_horseshit that I needed to dig up and it was more energy than I wanted to spend for a HN comment

So, OT1H, what I send was half true - they are available for export but only after some hoop jumping and seemingly not in the official export packaging, which I suppose almost guarantees they will not "round trip" back into a Vault in any kind of disaster recovery scenario

It seems those 1Password jokers just get great thrills out of ensuring that anytime I have something to praise them for they ensure they have some user hostile stupidity ready and waiting to drive people away

Re: Passkeys: A shattered dream

#473

Post by kxrm »

Xelynega wrote: post #465
red_admiral wrote: post #416

Earlier quoted context omitted.

I'm assuming tech people would also like to know that a passkey is not just "a really long password" but also one that's never sent to the server directly - instead it's used in a challenge/response protocol (like SSH keys). Which requires software, either the browser or an external password manager, to run. I think that's what you're getting at in paragraph 3? There's no reason you couldn't have an open source passk…

It's up to the server whether it uses it in challenge-response or not. That's application-specific behaviour that's past the definition of passkeys themselves. The reason you couldn't have an open source passkey manager that allows backup is that it wouldn't be a "passkey manager" then, just a password manager. To be a passkey it seems to require that it can't be exported/viewed other than by the website it was creat…

> even by the user

Perhaps this is something I shouldn't be feeling, but this bothers me and I do not know why.

I can see that you might not want it exposed to the user to prevent social engineering but at the same time, if I can't view then I don't feel like I actually own it. Is there a mechanism that might exist to help me not feel this way? I am totally new to passkeys as a concept as well, but I understand the larger goal.

Re: Passkeys: A shattered dream

#475

Post by iknowstuff »

torstenvl wrote: post #462
dfabulich wrote: post #366

Earlier quoted context omitted.

People keep trying to answer this question, so I'll try, too, but I'm going to do a better job than anyone else. ;-) Passkeys are randomly generated passwords that are required to be managed by a password manager. All the major password managers support them, including Apple, Google, Microsoft, Mozilla, and 1Password. By requiring the passkey to be managed by a password manager, you get some anti-phishing protection.…

> there's no social-engineering technique someone can use to get you to copy and paste your passkey to an enemy This is a deep, fundamental flaw in passkeys. It's just another example of enshittification disguised as denying end-user control "for their own good." There is no for-profit organization anywhere that I trust more than I trust myself, and there's no threat model where it's more likely I'll be socially engi…

Then use a password manager that allows it

Re: Passkeys: A shattered dream

#476

Post by kiwijamo »

tssva wrote: post #455
lo0dot0 wrote: post #330

Earlier quoted context omitted.

How do you sync to an Android phone?

I don't sync anywhere because I don't use the Apple keychain for my passwords. No idea if there is a solution for Android but the original claim was syncing between your devices was only possible if you stayed strictly with the Apple ecosystem. This is not accurate since you can sync to Windows even if you can't sync to Android.

However the Windows sync is only possible due to Apple providing an app for use in Windows which suggests its still within the Apple ecosystem. Apple could on a whim decide to discontinue their app for Windows.

Re: Passkeys: A shattered dream

#477

Post by iknowstuff »

CogitoCogito wrote: post #392
dfabulich wrote: post #366

Earlier quoted context omitted.

People keep trying to answer this question, so I'll try, too, but I'm going to do a better job than anyone else. ;-) Passkeys are randomly generated passwords that are required to be managed by a password manager. All the major password managers support them, including Apple, Google, Microsoft, Mozilla, and 1Password. By requiring the passkey to be managed by a password manager, you get some anti-phishing protection.…

Do you know if there an open source self-hosted implementation available?

Strongbox for iOS/macOS. Uses the keepass file format

Re: Passkeys: A shattered dream

#478

Post by sodality2 »

kxrm wrote: post #473
Xelynega wrote: post #465

Earlier quoted context omitted.

It's up to the server whether it uses it in challenge-response or not. That's application-specific behaviour that's past the definition of passkeys themselves. The reason you couldn't have an open source passkey manager that allows backup is that it wouldn't be a "passkey manager" then, just a password manager. To be a passkey it seems to require that it can't be exported/viewed other than by the website it was creat…

> even by the user Perhaps this is something I shouldn't be feeling, but this bothers me and I do not know why. I can see that you might not want it exposed to the user to prevent social engineering but at the same time, if I can't view then I don't feel like I actually own it. Is there a mechanism that might exist to help me not feel this way? I am totally new to passkeys as a concept as well, but I understand the l…

Personally it bothers me, and I don't want to feel any different. If I can't back it up or share it, it's not something I want to use. It's different than something like TOTP where even though I can't functionally hand-calculate it, I can still move the secret anywhere I want

Re: Passkeys: A shattered dream

#479

Post by zie »

caconym_ wrote: post #398
CogitoCogito wrote: post #392

Earlier quoted context omitted.

Do you know if there an open source self-hosted implementation available?

Bitwarden, which you can self-host (I do this) seems to have at least partial support now, and I know they're working on improving it. However, I'm not sure if their client and server are both fully FOSS.

They are, but you have(?) to have a license to run the OSS server code.

https://github.com/bitwarden/server

Like the other commenter mentioned, vault warden is the independent server version that doesn't require any of that.

Re: Passkeys: A shattered dream

#480

Post by vel0city »

Spivak wrote: post #466
vel0city wrote: post #316

Earlier quoted context omitted.

> ssh keys prevent phishing with IdentitiesOnly There has been a pretty insane number of times I've asked someone for their SSH public key and I get a response of ---- BEGIN RSA PRIVATE KEY ----. From people employed in tech jobs. Now imagine someone who barely understands how to use a computer, they're an easy target to get their identity phished.

I don't think the answer to these problems building system that treats users the same as an attacker when it comes to accessing and backing up their own private keys. Because at the end of the day the ability to export your private keys and store them somewhere securely is the account recovery of last resort. Passkeys aren't HSMs -- the fact that you can sync them via your iCloud or Google account should dispel any s…

> Because at the end of the day the ability to export your private keys and store them somewhere securely is the account recovery of last resort.

Or just have multiple passkeys for the same account. It doesn't matter if I lose the passkeys on my laptop because I've got other passkeys to those accounts on several other devices.

> Passkeys aren't HSMs -- the fact that you can sync them via your iCloud or Google account should dispel any such nonsense

Resident keys practically are HSMs, aren't they? None of my passkeys are backed up to a Google or iCloud account.

> If a warning message on export "Never share this with anyone. Even someone you trust. Even your IT department. There is no reason anyone but you should have access to this key.

In those conversations with people who should be experts I usually made a point to tell them send me the public key and told them to never share the private. They still sent the public. People have been told to never share passwords either but I still often hear "yeah my password for this is blahblah123..." when asking for help.

Post reply on HN