Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

591–600 of 789 posts

Re: Passkeys: A shattered dream

#591

Post by nxicvyvy »

pseudo0 wrote: post #236
masklinn wrote: post #169

Earlier quoted context omitted.

> Passkeys can’t be phished, or shoulder peeped, or entered on a malicious domain. And for the layman, it means they can’t forget their password. Neither can passwords if you’re using a password manager to handle them. So again, if you’ve already got a password manager, and would put your passkeys in a password manager, what is the benefit of passkeys?

It cuts out the necessity for a password manager browser extension to handle stuff like autofill, password generation, etc. Those extensions have had fairly significant vulnerabilities in the past. So you're reducing the attack surface, as well as getting a cryptographic guarantee against phishing (the signature the client returns include the domain that sent the challenge). Edit: The other great part is that the ser…

Except now you have vendor, browser and device lock in. So password managers are required to solve those very real problems anyway.

The value of these seem very low. Passkeys are a solution looking for a problem.

Mayve 10 years ago before password managers became a thing they made more sense? Now they're just kind of annoying and hard to share (sharing passwords is a real need for many people /applications / services)

Re: Passkeys: A shattered dream

#592

Post by epistasis »

nxicvyvy wrote: post #588
Wowfunhappy wrote: post #583

Earlier quoted context omitted.

> You can use passkeys cross platform already, eg with 1Password or even KeePass XC. But then I have the analogous problem of never being able to switch password managers!

Bitwarden exports passkeys along with everything else.

Can anything else import a passkey? It makes me nervous to have export, Id rather just have multiple platforms.

Re: Passkeys: A shattered dream

#594

Post by vbezhenar »

int_19h wrote: post #531
crote wrote: post #196

Earlier quoted context omitted.

This isn't a viable option in practice, because Passkeys use "Resident Keys". This means the credential needs to be stored on the Yubikey - which has a limited number of key slots. Need to log in to more than 25 (I believe) websites? Tough luck!

I'm curious as to why the number of slots is so small. Surely this is not some kind of fundamental limitation on what's possible (or cheap) with hardware?

Because yubikeys were designed long before passkeys become a thing. And hardware people love cutting cost to the bare bone to save one cent of $50 device.

Re: Passkeys: A shattered dream

#595

Post by vbezhenar »

int_19h wrote: post #534
al_borland wrote: post #512

Earlier quoted context omitted.

If I first signup for a service on my iPhone, then want to login on a Linux desktop, for example, how would I login if the passkey is not on my system, and I can’t login on the desktop to say I’m me? Maybe they sorted all this out so it “just works”, but there seems to be so many potential pitfalls, that I feel like I’d need to spend weeks researching stuff and testing edge cases before I could feel safe using it. No…

You get a link (or more commonly a QR code) that you open from the device on which you already have the passkey to grant access to the new device. Then you add the passkey for the new device. FWIW I don't think that this makes passwords redundant in general, but with passkeys, password becomes a last-ditch safety valve to regain access to the account. Meaning that it can be generated, very long, and stored in a way t…

One big issue with this QR thing is that phone will need to talk via bluetooth to the PC. Like every PC comes equipped with bluetooth chip. Should be some kind of pin code instead.

Re: Passkeys: A shattered dream

#596

Post by sunshowers »

diggernet wrote: post #551
jasonjayr wrote: post #158

Earlier quoted context omitted.

... and they are getting warned about that feature existing: https://news.ycombinator.com/item?id=39698502

with an excellent response to that warning here: https://news.ycombinator.com/item?id=39706876

Thank you for posting this comment. I'm saddened but not surprised that attestation is being seriously talked about as a way to get independent password managers in line but not large corporations, and completely agree with Dan there.

Re: Passkeys: A shattered dream

#597

Post by snowwrestler »

Wowfunhappy wrote: post #568
sholladay wrote: post #539

Earlier quoted context omitted.

You are able to share an Apple passkey to any nearby Apple device at any time using AirDrop. Passkeys can also be used cross-platform during sign in via an NFC/Bluetooth handshake initiated by QR code. Additionally, passkeys are just a synced-via-cloud implementation of FIDO2, an open standard that has other implementations you may feel more comfortable using. For someone who requires being able to sign in to, say, G…

But what happens if I as an iPhone user want to switch to Android next year? Can I move my Apple passkeys?

No, you add a new passkey from Android and then remove the passkey from iPhone.

1. Login with the passkey from your iPhone.

2. In your account, add a new passkey from your new Android. Now both passkeys are active.

3. Login with your new Android passkey.

4. In your account, deactivate the passkey that is stored on your iPhone.

Passkeys aren’t passwords. You can have more than one active at the same time. So instead of moving a single passkey around, you add or remove them to change devices or service providers.

Re: Passkeys: A shattered dream

#598

Post by mingus88 »

Thrymr wrote: post #486
mingus88 wrote: post #458

Earlier quoted context omitted.

I have been using passkeys for a while in the form of yubikeys Best practice is to register two keys to every website. Keep one physically in a safe. With password managers I would say the same basic practice applies. Make sure you have a working offline backup of whatever secrets you hold dear. There are some sites that only allow you to register a single passkey for an account (AWS Console last I checked) but these…

> Best practice is to register two keys to every website. Keep one physically in a safe. Well, this sounds convenient. Keep the second one in a safe, but register a key to it for every website you use. Is this a practice we actually believe users will carry out?

Yubikey are $50 so if you are already investing real money in your online security it’s not a stretch to expect that people will spend extra time and money to keep a physical backup

I don’t bother with a safe. I have one key that never leaves my home desk and another I have on my keychain. It’s trivial to register the second key when I am home.

Yes it is less convenient than a digital passkey but there is absolutely no way for a remote attacker to compromise it

Re: Passkeys: A shattered dream

#599

Post by umvi »

saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

You can't trust Yubico?

Re: Passkeys: A shattered dream

#600

Post by yawaramin »

saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

Create a new passkey on the device? Or on the new device? I don't see why this is a big issue. Sure, it's slightly inconvenient to go through the 'create passkey' flow on a new device, but as long as the account you are using (let's say, GitHub) supports storing multiple passkeys per account and managing them online, there's no reason you can't.
Post reply on HN