Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

611–620 of 789 posts

Re: Passkeys: A shattered dream

#611

Post by int_19h »

vel0city wrote: post #311
abadpoli wrote: post #309

Earlier quoted context omitted.

Great in theory, but in practice there are still a frustrating amount of websites and services that put a low upper limit (usually just one or two) of the number of keys you can enroll. This effectively makes it impossible to do what you’re saying. It sucks.

I hear this a lot but it hasn't generally been my experience. The only site I've personally come across that supports webauthn/passkeys but doesn't support multiple is the AWS management page. Which I essentially bypass by just configuring SSO and using an IdP which does support it. Every other site I've come across that supports these things supports multiple. What common sites support only one or two?

PayPal is a big one. It allows you to have exactly one passkey.

Re: Passkeys: A shattered dream

#612

Post by maeil »

moscoe wrote: post #574
lapcat wrote: post #511

Earlier quoted context omitted.

1Password is a platform, one that has gotten worse over the years. They've taken a bunch of venture capital, switched to rental pricing, and apparently now demand that everything be in the "cloud". No thanks. I prefer to be my own password manager.

Then perhaps Bitwarden… or do you have a bone to pick with them as well? There are choices.

Using a good old password means you don't rely on any particular service, period. Passkeys means you do, you rely on either a particular type of device (e.g. Apple device) or a SaaS.

It doesn't matter how many SaaSes offer it or how many brands of devices adopt it. It still means that for access to all of your accounts, you either 1. Have to stay with that brand of device or 2. Have to rely on the goodwill of the SaaS not to suddenly start raising their prices (the comparison here is passwords, which are free).

Before you say that switching providers is possible, that doesn't really matter. Let's say I stored the passkeys on my iPhone/iCloud. And then it got stolen.. whoops! Now I must at the very least acquire another Apple device until I can reach any of my accounts, i.e. I'm tech-dead until I do so.

If switching is not frictionless, it's an absurd level of lock-in, almost making it impossible. I have to go into every single account and add a new passkey? What if I forget one when I switch, then I'm out of luck and can never use the account again?

Re: Passkeys: A shattered dream

#613

Post by maeil »

yawaramin wrote: post #600
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

Create a new passkey on the device? Or on the new device? I don't see why this is a big issue. Sure, it's slightly inconvenient to go through the 'create passkey' flow on a new device, but as long as the account you are using (let's say, GitHub) supports storing multiple passkeys per account and managing them online, there's no reason you can't.

For every single one of your 100+ accounts? What if you forget an account when doing so, then it's lost forever? If one of the 100+ websites is momentarily down I simply have to keep the old passkey provider around until it comes back up and then remember to switch just that one later?

Re: Passkeys: A shattered dream

#614

Post by maeil »

int_19h wrote: post #534
al_borland wrote: post #512

Earlier quoted context omitted.

If I first signup for a service on my iPhone, then want to login on a Linux desktop, for example, how would I login if the passkey is not on my system, and I can’t login on the desktop to say I’m me? Maybe they sorted all this out so it “just works”, but there seems to be so many potential pitfalls, that I feel like I’d need to spend weeks researching stuff and testing edge cases before I could feel safe using it. No…

You get a link (or more commonly a QR code) that you open from the device on which you already have the passkey to grant access to the new device. Then you add the passkey for the new device. FWIW I don't think that this makes passwords redundant in general, but with passkeys, password becomes a last-ditch safety valve to regain access to the account. Meaning that it can be generated, very long, and stored in a way t…

> You get a link (or more commonly a QR code) that you open from the device on which you already have the passkey to grant access to the new device.

Because surely such devices never get stolen, or dropped from a cliff.

Re: Passkeys: A shattered dream

#616

Post by nxicvyvy »

epistasis wrote: post #592
nxicvyvy wrote: post #588

Earlier quoted context omitted.

Bitwarden exports passkeys along with everything else.

Can anything else import a passkey? It makes me nervous to have export, Id rather just have multiple platforms.

Another bitwarden server? You can self host.

The idea isn't to move your keys around willy nilly the idea is that should you need to, you're not beholden to bitwarden inc.

Re: Passkeys: A shattered dream

#617

Post by jackson1442 »

recursive wrote: post #586
ceinewydd wrote: post #554

Earlier quoted context omitted.

I’m really not sure the “only real solution” is every human needs to selfhost a password manager. That’s ill-advised; an extreme take. The vast majority of the population will do a worse job on the availability and security of a selfhost solution than 1Password, whose core business and value proposition is password management. I’m a very happy user of 1Password for Families and consider it the likely the best ~$50 a…

I'm a happy user of 1password also. But I'm not touching passkeys until they let me export them. Last time I checked, it was a platform lock-in.

You can export them- just did so by touching the context menu on the mobile app then “copy item JSON.” This includes the private key for the passkey. Here’s one I just exported: https://gist.github.com/jacksonwelsh/f5ad519770b1adde40a6ee9...

Whether or not you can import them into something else though…

Re: Passkeys: A shattered dream

#618

Post by sowbug »

Aeolun wrote: post #272
brabel wrote: post #186

Earlier quoted context omitted.

You're wrong, with password managers you can definitely be phished. Unless it's literally impossible to extract the password to enter it manually, but I don't think password managers make that impossible (and if it's possible, users will do it). With passkeys it's literally impossible.

> With passkeys it's literally impossible. I dunno about you. But I like being able to get my passwords out of the password manager. How is not being able to do so a feature?

It's not that kind of impossible. It means that even if you are tricked into giving your passkey to the attacker, it's cryptographically useless to the attacker because a passkey is bound to a specific origin.

Re: Passkeys: A shattered dream

#619

Post by jackson1442 »

Xelynega wrote: post #465
red_admiral wrote: post #416

Earlier quoted context omitted.

I'm assuming tech people would also like to know that a passkey is not just "a really long password" but also one that's never sent to the server directly - instead it's used in a challenge/response protocol (like SSH keys). Which requires software, either the browser or an external password manager, to run. I think that's what you're getting at in paragraph 3? There's no reason you couldn't have an open source passk…

It's up to the server whether it uses it in challenge-response or not. That's application-specific behaviour that's past the definition of passkeys themselves. The reason you couldn't have an open source passkey manager that allows backup is that it wouldn't be a "passkey manager" then, just a password manager. To be a passkey it seems to require that it can't be exported/viewed other than by the website it was creat…

> It's up to the server whether it uses it in challenge-response or not. That's application-specific behaviour that's past the definition of passkeys themselves.

Do you have a source for this? After reading the W3 spec[0] this seems entirely antithetical to the Passkey model and additionally raises concerns about the integrity of hardware mfa devices.

[0]: https://w3c.github.io/webauthn/

Re: Passkeys: A shattered dream

#620

Post by notpushkin »

I think passkeys can be used just like biometric authentication is used in mobile apps right now: you sign in just like you usually do (e. g. username + password + TOTP or something), then on subsequent visits you can skip that and go through passkeys instead. New device? Just sign in with a password again.
Post reply on HN