Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

531–540 of 789 posts

Re: Passkeys: A shattered dream

#531

Post by int_19h »

crote wrote: post #196
triblemaster wrote: post #182

Earlier quoted context omitted.

You can always use passkeys like Yubikey or others which are much more multi-platform.

This isn't a viable option in practice, because Passkeys use "Resident Keys". This means the credential needs to be stored on the Yubikey - which has a limited number of key slots. Need to log in to more than 25 (I believe) websites? Tough luck!

I'm curious as to why the number of slots is so small. Surely this is not some kind of fundamental limitation on what's possible (or cheap) with hardware?

Re: Passkeys: A shattered dream

#532

Post by orthecreedence »

HeatrayEnjoyer wrote: post #515
orthecreedence wrote: post #510

Earlier quoted context omitted.

You cannot be compelled (in US court, anyway) to give up encryption passwords/keys. You can certainly be compelled in a black site torture den, but most people don't have that as a looming threat yet.

> You cannot be compelled (in US court, anyway) to give up encryption passwords/keys. Multiple people have been held in contempt for refusing to provide an encryption password by US courts.

Maybe it's slightly more nuanced than I thought. This (https://crsreports.congress.gov/product/pdf/LSB/LSB10416) seems to be an interesting report on the issue, although in most cases a defendant cannot be compelled to unlock their password-protected device. Biometrics might be different, but honestly, don't use a fucking fingerprint unlock if you've got "sensitive shit" on your device. Duh...

Re: Passkeys: A shattered dream

#533

Post by [deleted] »

echoangle wrote: post #516
HeatrayEnjoyer wrote: post #515

Earlier quoted context omitted.

> You cannot be compelled (in US court, anyway) to give up encryption passwords/keys. Multiple people have been held in contempt for refusing to provide an encryption password by US courts.

[citation needed], can you give a link? In a court case about their own crimes?

[deleted]

Re: Passkeys: A shattered dream

#534

Post by int_19h »

al_borland wrote: post #512
Double_a_92 wrote: post #501

Earlier quoted context omitted.

As I understood it, that's exactly the purpose and not an issue. You are supposed to create a new passkey on each device you have. The fact that they can roam around within e.g. the Apple ecosystem is just some added function that Apple offers.

If I first signup for a service on my iPhone, then want to login on a Linux desktop, for example, how would I login if the passkey is not on my system, and I can’t login on the desktop to say I’m me? Maybe they sorted all this out so it “just works”, but there seems to be so many potential pitfalls, that I feel like I’d need to spend weeks researching stuff and testing edge cases before I could feel safe using it. No…

You get a link (or more commonly a QR code) that you open from the device on which you already have the passkey to grant access to the new device. Then you add the passkey for the new device.

FWIW I don't think that this makes passwords redundant in general, but with passkeys, password becomes a last-ditch safety valve to regain access to the account. Meaning that it can be generated, very long, and stored in a way that is optimized for safety and security over ease of access (like, say, an encrypted text file on multiple USB sticks stored in different physical locations).

Re: Passkeys: A shattered dream

#535

Post by tzs »

al_borland wrote: post #512
Double_a_92 wrote: post #501

Earlier quoted context omitted.

As I understood it, that's exactly the purpose and not an issue. You are supposed to create a new passkey on each device you have. The fact that they can roam around within e.g. the Apple ecosystem is just some added function that Apple offers.

If I first signup for a service on my iPhone, then want to login on a Linux desktop, for example, how would I login if the passkey is not on my system, and I can’t login on the desktop to say I’m me? Maybe they sorted all this out so it “just works”, but there seems to be so many potential pitfalls, that I feel like I’d need to spend weeks researching stuff and testing edge cases before I could feel safe using it. No…

> If I first signup for a service on my iPhone, then want to login on a Linux desktop, for example, how would I login if the passkey is not on my system, and I can’t login on the desktop to say I’m me?

What's supposed to happen is when you tell the site you want to use a passkey and one is not available to your Linux desktop's browser you are shown a QR code that you can scan on your phone. The login will then take place via the phone using your passkey that is on the phone for that site.

If you want to test to see if your browser handles this right you can do so at https://www.passkeys.io/>.

Once you are logged in with your passkey from you phone you should be able to go to your account settings on the site and somewhere in there find an option to add another passkey. You can then add a passkey generated by your Linux browser or your Linux password manager if you use a password manager that supports passkeys.

Some will object that this is not good enough because they might want to login to some desktop they have never logged in from before when they do not have their phone handy.

That's probably not as big a problem as they expect though because unless you are using passwords you have memorized the same problem applies to passwords. I've got over 400 accounts in my password manager, almost all with long random unique passwords. That means I'm not going to be logging in somewhere new to any of those sites unless I've got access to my password manager, which in practice means unless I've got my phone or tablet with me.

Re: Passkeys: A shattered dream

#536

Post by Pfhortune »

sheepscreek wrote: post #523
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

There is a way around this. Password managers. I use 1Passwords and it acts as the vault for all my Passkeys. Can access them on all devices. Super happy with it.

Is there a way to export a passkey from 1P to use in a different manager? (Legitimately asking, I haven't tried passkeys yet due to portability concerns, and this would be good to know)

Re: Passkeys: A shattered dream

#537

Post by skarra »

tadfisher wrote: post #530
jjav wrote: post #500

Earlier quoted context omitted.

> I don't get the passkey hate The linked article does a quite good job explaining why hating passkeys make sense. Here's a key quote, but I do recommend reading the whole article. > Since then Passkeys are now seen as a way to capture users and audiences into a platform. What better way to encourage long term entrapment of users then by locking all their credentials into your platform, and even better, credentials t…

I don't believe this is necessarily true, as far as intent goes. I think Apple and Google focused on a core use case, shipped it, and subsequently lost interest or fired everyone involved. Unfortunately, this scenario is indistinguishable from one in which they deliberately mishandled the specs in order to lock in users.

Thanks for your faith. I work on the team shipping passkeys at Google. We are very much hard at work to realize the full potential of passkeys. Platform lockin serves no one. That is no one's intent - independent password managers storing passkeys is already a thing today. More interop will come once relevant standards are blessed.

Re: Passkeys: A shattered dream

#538

Post by kstrauser »

shepherdjerred wrote: post #325

Here's my opposing view: I love Passkeys. I use Firefox as my browser and 1Password as my password manager. On my iPhone, I use 1Password + Firefox. I look at https://passkeys.directory/ every so often and switch my logins from passwords to passkeys. This has included a lot of my common logins like GitHub, Google, and Microsoft. There is a lot of confusing terminology. For some reason sites will say "login with Touch…

I’m with you on that. Also, 1Password’s built-in Watchtower tells you which of your saved accounts could have passkeys added to them.

Re: Passkeys: A shattered dream

#539

Post by sholladay »

saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

You are able to share an Apple passkey to any nearby Apple device at any time using AirDrop. Passkeys can also be used cross-platform during sign in via an NFC/Bluetooth handshake initiated by QR code.

Additionally, passkeys are just a synced-via-cloud implementation of FIDO2, an open standard that has other implementations you may feel more comfortable using.

For someone who requires being able to sign in to, say, GitHub from multiple different operating systems or platforms, you have a few options.

1. Use a passkey on your primary device, say an iPhone. You can still sign in to GitHub on a Windows computer or Android phone but you must have your iPhone with you. During sign in, there is an option to show a QR code on the Windows/Android, which you will point your iPhone at, and the two devices will do a secure handshake to sign you in. This is probably the worst option from a UX standpoint if you sign in on lots of devices that are not your primary.

2. Use a physical security key to store a FIDO2 key instead of a passkey. These devices are inherently cross-platform. Remember, a passkey is just a type of FIDO2 key. No one is forcing you to store it in the cloud. You can buy something like the YubiKey 5C NFC to store your keys completely offline and under your own control. The tradeoff is you will need to have it with you and you will need to plug it in every time you create an account or sign in.

3. Add multiple passkeys to your GitHub account, one for each platform you want to be able to sign in on. Unlike passwords, where an account generally only has one password at a time, it’s normal and even recommended to have at least one backup FIDO2/passkey registered with an account.

And of course these aren’t mutually exclusive, you can mix and match these techniques, perhaps depending on how important the account is or how/where you typically access it. Maybe you only use a single passkey on your primary device for your bedtime social media scrolling, but use a passkey with a backup FIDO2 security key on GitHub.

Re: Passkeys: A shattered dream

#540

Post by matheusmoreira »

Atotalnoob wrote: post #506
marssaxman wrote: post #386

Earlier quoted context omitted.

> and shut down my Google Pay account I never knew I had Google loves that nonsense, don't they? It's as though they think so highly of themselves that they cannot imagine they might not be strictly doing us all a favor by signing us up for their services. Fifteen years later, I still have friends occasionally sending messages to a GMail address I never asked for, never used, and didn't even know about for most of a…

Why don’t you setup the Gmail account to forward? I know it’s a hassle, but will resolve the issue

The issue is not forwarding the email. The issue is people sending email to the Google address in the first place. As someone who just set up email on his own domain, I'm starting to wish I could search every database and contacts list for my old Google address and replace it with the new one which is actually mine.
Post reply on HN