Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

621–630 of 789 posts

Re: Passkeys: A shattered dream

#621

Post by tsimionescu »

sholladay wrote: post #539
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

You are able to share an Apple passkey to any nearby Apple device at any time using AirDrop. Passkeys can also be used cross-platform during sign in via an NFC/Bluetooth handshake initiated by QR code. Additionally, passkeys are just a synced-via-cloud implementation of FIDO2, an open standard that has other implementations you may feel more comfortable using. For someone who requires being able to sign in to, say, G…

This all sounds like "it's technically possible, but it's a huge huge hassle and sticking with passwords is significantly easier".

Re: Passkeys: A shattered dream

#622

Post by [deleted] »

crote wrote: post #196
triblemaster wrote: post #182

Earlier quoted context omitted.

You can always use passkeys like Yubikey or others which are much more multi-platform.

This isn't a viable option in practice, because Passkeys use "Resident Keys". This means the credential needs to be stored on the Yubikey - which has a limited number of key slots. Need to log in to more than 25 (I believe) websites? Tough luck!

[deleted]

Re: Passkeys: A shattered dream

#623

Post by akie »

hedora wrote: post #603
snowwrestler wrote: post #597

Earlier quoted context omitted.

No, you add a new passkey from Android and then remove the passkey from iPhone. 1. Login with the passkey from your iPhone. 2. In your account, add a new passkey from your new Android. Now both passkeys are active. 3. Login with your new Android passkey. 4. In your account, deactivate the passkey that is stored on your iPhone. Passkeys aren’t passwords. You can have more than one active at the same time. So instead o…

I have 400 accounts in my password manager. There’s no way I’m doing that for each of them (or figuring out which ones support passkeys).

Then don’t change phone OS, or put your passkeys in a third party password manager.

Re: Passkeys: A shattered dream

#624

Post by seanhunter »

marssaxman wrote: post #386
whywhywhywhy wrote: post #197

Earlier quoted context omitted.

The platform lock in attempt is wild, my initial experiences with Passkeys were great on iOS and Safari, either getting pushed to touch-id or scanning a QR with my phone. But then in Chrome I couldn't get into GitHub because chrome would only push me to use their manager and wouldn't offer a QR code. Seeing this more and more with Chrome, like Credit Card numbers used to just save and autocomplete in browser but then…

> and shut down my Google Pay account I never knew I had Google loves that nonsense, don't they? It's as though they think so highly of themselves that they cannot imagine they might not be strictly doing us all a favor by signing us up for their services. Fifteen years later, I still have friends occasionally sending messages to a GMail address I never asked for, never used, and didn't even know about for most of a…

My wife has the opposite side of this problem coin. Her gmail address (which she does use) has virally spread through a family and circle of friends who all believe it relates to a person in the US who we are entirely unconnected with in any way. Attempts to get them to sort this out always fail because inevitably the address gets re-added to some thread or other and starts spreading again.

Re: Passkeys: A shattered dream

#625

Post by calaverainfo »

sholladay wrote: post #539
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

You are able to share an Apple passkey to any nearby Apple device at any time using AirDrop. Passkeys can also be used cross-platform during sign in via an NFC/Bluetooth handshake initiated by QR code. Additionally, passkeys are just a synced-via-cloud implementation of FIDO2, an open standard that has other implementations you may feel more comfortable using. For someone who requires being able to sign in to, say, G…

Number 2 is not true. I have a Yubikey and it can't be used on Android without a Google made app or account. It's always the same story, give a plausible option to seem open or neutral, but make sure there are "details" that establishes chain of consequences preventing it that is weird enough to allow denying intention. Even though I'm not that young I thought I just need to wait for Firefox to implement it, but as time went by I got curious and found out why it actually can't be done.

Re: Passkeys: A shattered dream

#626

Post by mixmastamyk »

stetrain wrote: post #469
mixmastamyk wrote: post #396

Earlier quoted context omitted.

How do you back up the private key? With ssh I know to back up .ssh with the rest of my home folder. With a passkey I'd have no idea where it was, and get the feeling the "modern" software won't tell me on purpose, so that it can manage/sync it for me. Which leads to a lack of a mental model.

The same way you would back up passwords stored in iCloud Keychain, 1Password, KeePassXC, etc.

So you don’t, just leave it to BigTech, thanks.

Re: Passkeys: A shattered dream

#627

Post by littlestymaar »

sroussey wrote: post #578
ceinewydd wrote: post #554

Earlier quoted context omitted.

I’m really not sure the “only real solution” is every human needs to selfhost a password manager. That’s ill-advised; an extreme take. The vast majority of the population will do a worse job on the availability and security of a selfhost solution than 1Password, whose core business and value proposition is password management. I’m a very happy user of 1Password for Families and consider it the likely the best ~$50 a…

Agreed. I self hosted the key 100 bitcoin in like 2010. Machine crashed. Oops.

That's a fundamental problem with cryptographic security: you cannot trust people to manage your keys for you (because due to lack of regulation preventing that companies have this bad habit of pulling the rug under their customers' feet) but you cannot trust yourself doing that either, because you can, and will, make mistakes.

Re: Passkeys: A shattered dream

#628

Post by Hnrobert42 »

MrDrMcCoy wrote: post #544
sroussey wrote: post #520

Earlier quoted context omitted.

I use 1Password which supports Passkeys, and don’t have an issue across mobile or desktop. I don’t get what the issues people have really are. I never experience them (fortunately!).

1Password is a closed-source, cloud-hosted service. At any time, for any reason, they can close and delete your account, leaving you high and dry. Self-hosted, multi-device password managers are the only real solution. Thankfully, Vaultwarden and KeePassXC fill this role perfectly. Now if we could just get the other providers that require insecure email/SMS 2FA to follow suit, that would be great...

No they can’t. You have a local cache. Also, you can export and backup if you are really worried.

Re: Passkeys: A shattered dream

#629

Post by tsimionescu »

Tomte wrote: post #105
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

Enroll another passkey. Password manager can also do that (Bitwarden, for example), so I really don‘t see a reason for all the agitation.

Because there is no way to do that at scale. If I've tied 200 services to my Windows-managed passkeys and now I want to switch to Linux, I have to manually go to each of the 200 services and ask them nicely to allow me to enroll a second key. This is simply unacceptable - and it's not like I could have done this ahead of time when I first signed up.

Re: Passkeys: A shattered dream

#630

Post by tsimionescu »

tssva wrote: post #488
kiwijamo wrote: post #476

Earlier quoted context omitted.

However the Windows sync is only possible due to Apple providing an app for use in Windows which suggests its still within the Apple ecosystem. Apple could on a whim decide to discontinue their app for Windows.

Then you export from keychain and import into a different password manager.

No, you don't, because it's not possible. Passkeys are essentially designed to tie you into an ecosystem.
Post reply on HN