Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

581–590 of 789 posts

Re: Passkeys: A shattered dream

#581

Post by manicdee »

knallfrosch wrote: post #211
javawizard wrote: post #143

Earlier quoted context omitted.

The risk of your password getting stolen in between your browser and whatever hash algorithm the service you're authenticating with puts your password through before storing/verifying it. That's the benefit you get from passkeys that no password manager will otherwise be able to give you.

If they control the information flow can't they simply steal the passkey too?

The attacker could pretend to be the service the user is trying to authenticate to, issue a bogus challenge signed with the user's public key. That will allow intercepting the user's interactions but by this time the attacker has control over the target system so why not just take what is inside rather than go to the effort of interacting with the user?

Re: Passkeys: A shattered dream

#582

Post by dogman144 »

brabel wrote: post #285
dogman144 wrote: post #269

Earlier quoted context omitted.

There’s more to phishing threat models than strictly credential theft, as you seem to imply. If passkeys are around, phishing will certainly still exist, and shift to dropping malware on endpoints or w/e vs going after logins

I don't think you know what phishing means. By "dropping malware on endpoints" I think you mean having a website serving malware? That's not phishing. For an attack to be "phishing", the website needs to be pretending to be some other website that the user trusts. Passkeys completely prevent the user from logging in to another website than the one they've created an account with. Your attack only works on people who…

I’m a security engineer, I’m pretty fluent on the topic. And phishing comes in beyond the methods you describe -> malicious attachments downloaded, etc etc.

Re: Passkeys: A shattered dream

#583

Post by Wowfunhappy »

signal11 wrote: post #577
Wowfunhappy wrote: post #568

Earlier quoted context omitted.

But what happens if I as an iPhone user want to switch to Android next year? Can I move my Apple passkeys?

You can use passkeys cross platform already, eg with 1Password or even KeePass XC. But I do agree with the point that Passkeys make it really easy to get locked in unless you’re careful.

> You can use passkeys cross platform already, eg with 1Password or even KeePass XC.

But then I have the analogous problem of never being able to switch password managers!

Re: Passkeys: A shattered dream

#584

Post by shepherdjerred »

eudes_ochoa wrote: post #562
shepherdjerred wrote: post #325

Here's my opposing view: I love Passkeys. I use Firefox as my browser and 1Password as my password manager. On my iPhone, I use 1Password + Firefox. I look at https://passkeys.directory/ every so often and switch my logins from passwords to passkeys. This has included a lot of my common logins like GitHub, Google, and Microsoft. There is a lot of confusing terminology. For some reason sites will say "login with Touch…

Honest question, not a critique: what's the point of passkeys if you already use 1password? It unlocks with touch ID both on computers and phones, it autofills and autogenerates username and password. Plus you've got the option to fall back to manual input if you don't have 1password available in a particular device, and credential sharing (outside of 1p) becomes feasible. What's better about passkeys with 1p?

They're easy to use! I don't have to go through a site's normal login flow. 1Password just shows a standard prompt where I can click "sign in"

Additionally, it makes 2FA quite a bit more convenient.

Lastly it's the only way to login to my Georgia Tech account without opening an app on my phone which is absurdly annoying.

Re: Passkeys: A shattered dream

#585

Post by shepherdjerred »

joe_the_user wrote: post #571
shepherdjerred wrote: post #325

Here's my opposing view: I love Passkeys. I use Firefox as my browser and 1Password as my password manager. On my iPhone, I use 1Password + Firefox. I look at https://passkeys.directory/ every so often and switch my logins from passwords to passkeys. This has included a lot of my common logins like GitHub, Google, and Microsoft. There is a lot of confusing terminology. For some reason sites will say "login with Touch…

If your only argument is "wow, it's easy", you're not arguing from the perspective of any kind of security. I can believe it's easy. But just knowing this doesn't give you any understanding of potential downsides. Years ago I lost access to various stack-exchange accounts when Yahoo stopped offering Oauth services. Thankfully not a biggie for me but it soured me on relying on third parties for access to a given accou…

Are you arguing against password managers or passkeys?

Re: Passkeys: A shattered dream

#586

Post by recursive »

ceinewydd wrote: post #554
MrDrMcCoy wrote: post #544

Earlier quoted context omitted.

1Password is a closed-source, cloud-hosted service. At any time, for any reason, they can close and delete your account, leaving you high and dry. Self-hosted, multi-device password managers are the only real solution. Thankfully, Vaultwarden and KeePassXC fill this role perfectly. Now if we could just get the other providers that require insecure email/SMS 2FA to follow suit, that would be great...

I’m really not sure the “only real solution” is every human needs to selfhost a password manager. That’s ill-advised; an extreme take. The vast majority of the population will do a worse job on the availability and security of a selfhost solution than 1Password, whose core business and value proposition is password management. I’m a very happy user of 1Password for Families and consider it the likely the best ~$50 a…

I'm a happy user of 1password also. But I'm not touching passkeys until they let me export them. Last time I checked, it was a platform lock-in.

Re: Passkeys: A shattered dream

#587

Post by recursive »

afavour wrote: post #262
michaelt wrote: post #127

Earlier quoted context omitted.

If you've already got a password manager, what benefit do you get from passkeys? Avoiding the risks of short, weak passwords? The risks of reusing passwords across sites? The inconvenience of remembering loads of passwords? The frustration of having to type passwords manually? The risk of getting phished or typing one site's password into a different site? Remembering and typing usernames? The password manager takes…

The actual implementation of password managers is really messy. Browser extensions that try to guess which field may or may not contain your username, copy the 2FA code to the clipboard in the hopes that you’ll easily be able to paste it on the next page… passkeys offering a standardized API to provide this information makes it worth considering alone IMO, even without considering the extra security compared to plain…

These are all good things. Now, if I can just use it without getting locked into someone's walled garden, I'll be all-in.

Re: Passkeys: A shattered dream

#588

Post by nxicvyvy »

Wowfunhappy wrote: post #583
signal11 wrote: post #577

Earlier quoted context omitted.

You can use passkeys cross platform already, eg with 1Password or even KeePass XC. But I do agree with the point that Passkeys make it really easy to get locked in unless you’re careful.

> You can use passkeys cross platform already, eg with 1Password or even KeePass XC. But then I have the analogous problem of never being able to switch password managers!

Bitwarden exports passkeys along with everything else.

Re: Passkeys: A shattered dream

#589

Post by vbezhenar »

sholladay wrote: post #539
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

You are able to share an Apple passkey to any nearby Apple device at any time using AirDrop. Passkeys can also be used cross-platform during sign in via an NFC/Bluetooth handshake initiated by QR code. Additionally, passkeys are just a synced-via-cloud implementation of FIDO2, an open standard that has other implementations you may feel more comfortable using. For someone who requires being able to sign in to, say, G…

My issue with option 1 is that it utilizes bluetooth. And everything involving bluetooth is not reliable.

Re: Passkeys: A shattered dream

#590

Post by vbezhenar »

Wowfunhappy wrote: post #568
sholladay wrote: post #539

Earlier quoted context omitted.

You are able to share an Apple passkey to any nearby Apple device at any time using AirDrop. Passkeys can also be used cross-platform during sign in via an NFC/Bluetooth handshake initiated by QR code. Additionally, passkeys are just a synced-via-cloud implementation of FIDO2, an open standard that has other implementations you may feel more comfortable using. For someone who requires being able to sign in to, say, G…

But what happens if I as an iPhone user want to switch to Android next year? Can I move my Apple passkeys?

No, you can't. You need to login into every website and replace passkey with new one in website-specific way.
Post reply on HN