Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

501–510 of 789 posts

Re: Passkeys: A shattered dream

#501

Post by Double_a_92 »

saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

As I understood it, that's exactly the purpose and not an issue. You are supposed to create a new passkey on each device you have. The fact that they can roam around within e.g. the Apple ecosystem is just some added function that Apple offers.

Re: Passkeys: A shattered dream

#502

Post by Double_a_92 »

sevanteri wrote: post #26
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

This is why services need to support multiple passkeys per user just like they should support multiple 2FA methods...

Yes, this is crucial. So far all the services that I use do though.

Re: Passkeys: A shattered dream

#503

Post by wayeq »

tunesmith wrote: post #362

Every time I see a long inscrutable discussion about Passkeys, I see a weird avoidance of the "something you know" part of security. Here in the US, courts and law enforcement have every right to get your username, fingerprint, retina scan, face ID, whatever. But they don't have the right to extract something from your brain. Unless I'm missing something basic (which at this point, I don't think is my fault since thi…

> But they don't have the right to extract something from your brain.

sure they do if, unless you want to be held in contempt of court for not providing the information.

Re: Passkeys: A shattered dream

#504

Post by echoangle »

wayeq wrote: post #503
tunesmith wrote: post #362

Every time I see a long inscrutable discussion about Passkeys, I see a weird avoidance of the "something you know" part of security. Here in the US, courts and law enforcement have every right to get your username, fingerprint, retina scan, face ID, whatever. But they don't have the right to extract something from your brain. Unless I'm missing something basic (which at this point, I don't think is my fault since thi…

> But they don't have the right to extract something from your brain. sure they do if, unless you want to be held in contempt of court for not providing the information.

Don’t you have a right to not incriminate yourself? You only have to give them information as long as you’re not incriminating yourself, right?

Re: Passkeys: A shattered dream

#505

Post by Double_a_92 »

teeray wrote: post #271
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

This is why I’m not interested in passkeys unless I can use it with my password manager (which I probably can at this point). It would also be nice to see the spec for these specifically address lock-in and provide anti-lock-in measures.

The idea of a passkey is that it's bound to a device, and you can have more than one passkey. Think of a YubiKey, just that you can use your Phone or your PC instead. You basically have designated hardware that is always allowed to just login to your account...

Re: Passkeys: A shattered dream

#506

Post by Atotalnoob »

marssaxman wrote: post #386
whywhywhywhy wrote: post #197

Earlier quoted context omitted.

The platform lock in attempt is wild, my initial experiences with Passkeys were great on iOS and Safari, either getting pushed to touch-id or scanning a QR with my phone. But then in Chrome I couldn't get into GitHub because chrome would only push me to use their manager and wouldn't offer a QR code. Seeing this more and more with Chrome, like Credit Card numbers used to just save and autocomplete in browser but then…

> and shut down my Google Pay account I never knew I had Google loves that nonsense, don't they? It's as though they think so highly of themselves that they cannot imagine they might not be strictly doing us all a favor by signing us up for their services. Fifteen years later, I still have friends occasionally sending messages to a GMail address I never asked for, never used, and didn't even know about for most of a…

Why don’t you setup the Gmail account to forward? I know it’s a hassle, but will resolve the issue

Re: Passkeys: A shattered dream

#507

Post by madeofpalk »

kiwijamo wrote: post #476
tssva wrote: post #455

Earlier quoted context omitted.

I don't sync anywhere because I don't use the Apple keychain for my passwords. No idea if there is a solution for Android but the original claim was syncing between your devices was only possible if you stayed strictly with the Apple ecosystem. This is not accurate since you can sync to Windows even if you can't sync to Android.

However the Windows sync is only possible due to Apple providing an app for use in Windows which suggests its still within the Apple ecosystem. Apple could on a whim decide to discontinue their app for Windows.

Or just use a third party app, such as 1Password and others, which syncs to everything, and is presented along side apple's stuff

Re: Passkeys: A shattered dream

#509

Post by Atotalnoob »

mikestew wrote: post #335
Aeolun wrote: post #272

Earlier quoted context omitted.

> With passkeys it's literally impossible. I dunno about you. But I like being able to get my passwords out of the password manager. How is not being able to do so a feature?

The metaphor might be a bit esoteric, but that's similar to wishing that Hardware Security Modules (HSMs) allowed you "get your " out of the HSM. As sibling comment says, that's how you get phished. The whole point of an HSM (and a passkey) is that the super-secret private part never leaves the HSM no matter how nicely you ask and no matter how compromised the machine is. A password manager, OTOH, is happy to hand ou…

Yes, but I don’t want vendor lockin.

I want to move my passkeys where I want and use tools I want.

Not allowing anyway of changing passkeys is terrible. Imagine someone switches from IOS to android. How do they use their passkeys?

Even if they had a big “warning don’t do this” sign it would be better than not allowing it in anyway.

Re: Passkeys: A shattered dream

#510

Post by orthecreedence »

wayeq wrote: post #503
tunesmith wrote: post #362

Every time I see a long inscrutable discussion about Passkeys, I see a weird avoidance of the "something you know" part of security. Here in the US, courts and law enforcement have every right to get your username, fingerprint, retina scan, face ID, whatever. But they don't have the right to extract something from your brain. Unless I'm missing something basic (which at this point, I don't think is my fault since thi…

> But they don't have the right to extract something from your brain. sure they do if, unless you want to be held in contempt of court for not providing the information.

You cannot be compelled (in US court, anyway) to give up encryption passwords/keys.

You can certainly be compelled in a black site torture den, but most people don't have that as a looming threat yet.

Post reply on HN