Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

491–500 of 789 posts

Re: Passkeys: A shattered dream

#491

Post by xcrunner529 »

lapcat wrote: post #243
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

> If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. That's not true. Passkeys actually require iCloud Keychain, which is obnoxious, because you can't use the OS passkey support without using iCloud. And you can't even manually export passkeys from iCloud Keychain, which is totally opaque. So it is still platform lock-in, just not i…

So use a password manager still (1P). You can have multiple passkeys for different devices or keychains but no entering passwords or credentials. Still an improvement and far less vulnerable.

Re: Passkeys: A shattered dream

#492

Post by latchkey »

I just went through the dance of logging out of all my google accounts and then logging back into them. While I was doing that, I added passkeys as a security layer.

Using bitwarden, it adds them in just fine. But, if you go and try to log into a Google account with Brave, it tries to use the Brave system builtin instead of the Bitwarden one. Presenting a dialog too.

As an end user, I don't know if it is bitwarden, brave or google screwing this up and I can't be bothered to figure it out, so it is back to just using passwords and 2FA...

Re: Passkeys: A shattered dream

#493

Post by mdaniel »

noname120 wrote: post #484
mdaniel wrote: post #472

Earlier quoted context omitted.

Well then their enshitification just continues with their unending quest for burning every user-centric bridge they ever built. Goddamn To answer your question, "bamboo menu, Copy Item JSON" which I believe is turned on due to my "Preferences, Advanced, Show debugging tools" being checked. I actually did try the $(op item get --format=json $its_uuid) first but figured there was some sekrit env var or --fields some_ho…

Wow I confirm that this option appears once I enable the developer options. Don't say it too loud though — I'm sure 1Password will remove it if they notice that it slipped past their view because of just dumping the JSON object.

I wrote the initial .opvault import into KeePassXC and briefly considered going after their local .com cache file (hidden in a very obtuse place, of course) since it seems to be using their same opdata01 https://support.1password.com/cs/opvault-design/#opdata01> encoding, at least when last I looked, but then suspected that the audience who would have already paid for 1P but wanted to switch would use 1PUX. Seems maybe that does need more consideration

    $ cd ~/Library/Group Containers/2BUA8C4S2C.com.1password/Library/Application Support/1Password/Data
    $ sqlite3 -readonly 1password.sqlite
    sqlite> .tables
    account_objects   creation_drafts   item_overviews    ssh_pubkeys
    accounts          deleted_accounts  item_usage        users
    autofill          editing_drafts    kanon_autofill
    collection_map    feature_flags     objects
    config            item_details      search_weighting

Re: Passkeys: A shattered dream

#494

Post by cchance »

latchkey wrote: post #492

I just went through the dance of logging out of all my google accounts and then logging back into them. While I was doing that, I added passkeys as a security layer. Using bitwarden, it adds them in just fine. But, if you go and try to log into a Google account with Brave, it tries to use the Brave system builtin instead of the Bitwarden one. Presenting a dialog too. As an end user, I don't know if it is bitwarden, b…

Just add a passkey for brave too

Re: Passkeys: A shattered dream

#495

Post by gclawes »

latchkey wrote: post #492

I just went through the dance of logging out of all my google accounts and then logging back into them. While I was doing that, I added passkeys as a security layer. Using bitwarden, it adds them in just fine. But, if you go and try to log into a Google account with Brave, it tries to use the Brave system builtin instead of the Bitwarden one. Presenting a dialog too. As an end user, I don't know if it is bitwarden, b…

For what it's worth, 1Password Passkeys works fine in this use case. I suspect it may be a subtlety in how BitWarden works.

Re: Passkeys: A shattered dream

#496

Post by latchkey »

cchance wrote: post #494
latchkey wrote: post #492

I just went through the dance of logging out of all my google accounts and then logging back into them. While I was doing that, I added passkeys as a security layer. Using bitwarden, it adds them in just fine. But, if you go and try to log into a Google account with Brave, it tries to use the Brave system builtin instead of the Bitwarden one. Presenting a dialog too. As an end user, I don't know if it is bitwarden, b…

Just add a passkey for brave too

No, I don't want to be tied to a single browser for my passkey, what happens if I want to log into a site on my phone using safari or chrome? I also don't want it tied to my apple keychain. What if I want to share my passkey with my partner?

Re: Passkeys: A shattered dream

#497

Post by riedel »

joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

Totally agree. I have used fido2 and webauthn before and I liked it. Particularly with a hardware key the mental model is quite straightforward. Now with that Microsoft, Google and syncing business I am left totally confused. Why the hell should alI store a private key in some cloud?? What happens if that provider decides to terminate my account, if it gets pressured to release the key? Also how does this all work with Windows Hello and other things in between??? I know a bit of crypto and security protocola but the passkey concept and possible attack vectors totally escape me.

Re: Passkeys: A shattered dream

#498

Post by latchkey »

gclawes wrote: post #495
latchkey wrote: post #492

I just went through the dance of logging out of all my google accounts and then logging back into them. While I was doing that, I added passkeys as a security layer. Using bitwarden, it adds them in just fine. But, if you go and try to log into a Google account with Brave, it tries to use the Brave system builtin instead of the Bitwarden one. Presenting a dialog too. As an end user, I don't know if it is bitwarden, b…

For what it's worth, 1Password Passkeys works fine in this use case. I suspect it may be a subtlety in how BitWarden works.

Good to know, if it is bitwarden, then I guess I'll expect a fix in the future.

Re: Passkeys: A shattered dream

#499

Post by noahtallen »

SkyPuncher wrote: post #367
victor106 wrote: post #365

Earlier quoted context omitted.

> But they don't have the right to extract something from your brain. Most folks store passwords in password managers and don't use their brains to retrieve them.

But my password manager locks….requiring something stored in my brain.

Which is exactly where your passkeys can be stored too. Put them in a password manager like 1Password, disable biometrics, and law enforcement would have to enter a password to access them

Re: Passkeys: A shattered dream

#500

Post by jjav »

nivenhuh wrote: post #483

For folks who don't know how passkeys work at a technical level, take a look at this implementation guide: https://webauthn.guide/ I don't get the passkey hate -- moving to public key challenge for authentication is a strong step forward for web security. Each browser / OS safeguards & backs up the private key (and even if that's lost, you can still reset your auth credentials using a normal "forgot password" flow).

> I don't get the passkey hate

The linked article does a quite good job explaining why hating passkeys make sense.

Here's a key quote, but I do recommend reading the whole article.

> Since then Passkeys are now seen as a way to capture users and audiences into a platform. What better way to encourage long term entrapment of users then by locking all their credentials into your platform, and even better, credentials that can't be extracted or exported in any capacity.

Post reply on HN