Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

511–520 of 789 posts

Re: Passkeys: A shattered dream

#511

Post by lapcat »

xcrunner529 wrote: post #491
lapcat wrote: post #243

Earlier quoted context omitted.

> If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. That's not true. Passkeys actually require iCloud Keychain, which is obnoxious, because you can't use the OS passkey support without using iCloud. And you can't even manually export passkeys from iCloud Keychain, which is totally opaque. So it is still platform lock-in, just not i…

So use a password manager still (1P). You can have multiple passkeys for different devices or keychains but no entering passwords or credentials. Still an improvement and far less vulnerable.

1Password is a platform, one that has gotten worse over the years. They've taken a bunch of venture capital, switched to rental pricing, and apparently now demand that everything be in the "cloud". No thanks. I prefer to be my own password manager.

Re: Passkeys: A shattered dream

#512

Post by al_borland »

Double_a_92 wrote: post #501
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

As I understood it, that's exactly the purpose and not an issue. You are supposed to create a new passkey on each device you have. The fact that they can roam around within e.g. the Apple ecosystem is just some added function that Apple offers.

If I first signup for a service on my iPhone, then want to login on a Linux desktop, for example, how would I login if the passkey is not on my system, and I can’t login on the desktop to say I’m me?

Maybe they sorted all this out so it “just works”, but there seems to be so many potential pitfalls, that I feel like I’d need to spend weeks researching stuff and testing edge cases before I could feel safe using it. No one is going to do that.

With a password, I know it works now, and it will work in 40 years. I don’t have that same kind of confidence with a passkey. Even if it’s great, if people don’t adopt it in mass, it will fade away and be removed, so how deep do I want to go? This isn’t something I want to be an early adopter on, at least not for anything I care about.

Re: Passkeys: A shattered dream

#513

Post by whartung »

michaelt wrote: post #250
joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

> I’ve avoided passkeys so far because I just don’t have a good mental model of them. OK, so the simplest way to understand is to first know about the previous generation. U2F keys are designed to be used alongside a username and password, as a more secure replacement for phone apps showing 6-digit codes. In U2F the key has a hardware 'secure element' where secrets can't be extracted, even if you plug it into a compr…

The big question I have is are the keys device/browser specific?

Seems to me I need to be able to log in with a password from any place (my phone, my machine, my office, my wifes phone, her laptop, my friends laptop, etc.).

I mean, who knows when I'll want or need to get into Something.

Also, my wife and I share accounts (such as Amazon). So, it needs to work seamlessly across all of her devices.

Then there's always the "F-with it factor" that I loathe. At least I understand passwords. Can (mostly) always recover a password (I recall trying to recover my Apple ID password -- they bluntly said "ok, but you have to come back in 2 weeks", so I was locked out for 2 weeks).

And, of course the level of patience my wife has with Technology is less than zero.

I rely on my Safari auto fill, when I use another browser, I just copy the pw from Safari.

And I don't use any of the cloud services. I have an iPhone, but don't use iCloud.

Re: Passkeys: A shattered dream

#514

Post by Izkata »

> This library ended up with Kanidm being (to my knowledge) the very first OpenSource IDM to implement passwordless (now passkeys). The experience was wonderful. You went to Kanidm, typed in your username and then were prompted to type your PIN and touch your key. Simple, fast, easy.

> For devices like your iPhone or Android, you would do similar - just use your Touch ID and you're in.

The fingerprint scanner on my phone is so finicky this would've been a dealbreaker from the get-go. I regularly have to just enter my PIN because it refuses to recognize my fingerprint.

Re: Passkeys: A shattered dream

#515

Post by HeatrayEnjoyer »

orthecreedence wrote: post #510
wayeq wrote: post #503

Earlier quoted context omitted.

> But they don't have the right to extract something from your brain. sure they do if, unless you want to be held in contempt of court for not providing the information.

You cannot be compelled (in US court, anyway) to give up encryption passwords/keys. You can certainly be compelled in a black site torture den, but most people don't have that as a looming threat yet.

> You cannot be compelled (in US court, anyway) to give up encryption passwords/keys.

Multiple people have been held in contempt for refusing to provide an encryption password by US courts.

Re: Passkeys: A shattered dream

#516

Post by echoangle »

HeatrayEnjoyer wrote: post #515
orthecreedence wrote: post #510

Earlier quoted context omitted.

You cannot be compelled (in US court, anyway) to give up encryption passwords/keys. You can certainly be compelled in a black site torture den, but most people don't have that as a looming threat yet.

> You cannot be compelled (in US court, anyway) to give up encryption passwords/keys. Multiple people have been held in contempt for refusing to provide an encryption password by US courts.

[citation needed], can you give a link? In a court case about their own crimes?

Re: Passkeys: A shattered dream

#518

Post by al_borland »

dfabulich wrote: post #366
joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

People keep trying to answer this question, so I'll try, too, but I'm going to do a better job than anyone else. ;-) Passkeys are randomly generated passwords that are required to be managed by a password manager. All the major password managers support them, including Apple, Google, Microsoft, Mozilla, and 1Password. By requiring the passkey to be managed by a password manager, you get some anti-phishing protection.…

I have been using 1Password for over 15 years and it has the ability to only show/fill passwords when on the correct site. The issue is, over time, companies shift their strategies on the web. URLs change, while the accounts stay the same. I have had to update these details many times. I've also run into situations where the browser plugin isn't functioning, for whatever reason, and the only way in is to copy/paste. There are also times where I'm not on my computer. For example, I usually piggyback on my dad's copy of TurboTax each year. When I'm over there, I will often need to pull up a password on my phone and type it into TurboTax as it logs into my bank to download the tax forms. Passkeys don't sound like they can solve that problem. I'd question if the Passkeys would work in TurboTax even if I was running it on my own computer.

With passwords and logins, it seems like there are far too many edge cases to draw a hard line to say they are locked in the password manager forever. Having a way to copy it out, or export, is also a way to ensure portability, if the password manager being used ever becomes bad and a different option is needed.

Password managers put users in a vulnerable position, as once a user is invested, they've got you by the short hairs. The thing that keeps this from being a big problem, is that there is always a way out. Eliminating this way out, or raising the barrier to exit, can temp these password managers to extort their users, which is not good.

Re: Passkeys: A shattered dream

#519

Post by macintux »

Atotalnoob wrote: post #506
marssaxman wrote: post #386

Earlier quoted context omitted.

> and shut down my Google Pay account I never knew I had Google loves that nonsense, don't they? It's as though they think so highly of themselves that they cannot imagine they might not be strictly doing us all a favor by signing us up for their services. Fifteen years later, I still have friends occasionally sending messages to a GMail address I never asked for, never used, and didn't even know about for most of a…

Why don’t you setup the Gmail account to forward? I know it’s a hassle, but will resolve the issue

That seems like an invitation for long-term pain if Google changes their policies, requiring someone to log in every X months or have their gmail account locked, for example, or some AI enforcement tool locks the account for inscrutable reasons.

Re: Passkeys: A shattered dream

#520

Post by sroussey »

Groxx wrote: post #370
whywhywhywhy wrote: post #197

Earlier quoted context omitted.

The platform lock in attempt is wild, my initial experiences with Passkeys were great on iOS and Safari, either getting pushed to touch-id or scanning a QR with my phone. But then in Chrome I couldn't get into GitHub because chrome would only push me to use their manager and wouldn't offer a QR code. Seeing this more and more with Chrome, like Credit Card numbers used to just save and autocomplete in browser but then…

Yep, this is why I don't use passkeys. I tried. The power-grabbing garbage was immediately apparent and sent me straight for "heck no, I'll just use passwords until they figure this out, at least that can't control my password manager". In principle I should be very in favor of them, but the wild variety of lack of support for basics, and the built-in-the-spec ability for site X to control how I store and sync stuff…

I use 1Password which supports Passkeys, and don’t have an issue across mobile or desktop.

I don’t get what the issues people have really are. I never experience them (fortunately!).

Post reply on HN