Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

641–650 of 789 posts

Re: Passkeys: A shattered dream

#641

Post by yawaramin »

maeil wrote: post #613
yawaramin wrote: post #600

Earlier quoted context omitted.

Create a new passkey on the device? Or on the new device? I don't see why this is a big issue. Sure, it's slightly inconvenient to go through the 'create passkey' flow on a new device, but as long as the account you are using (let's say, GitHub) supports storing multiple passkeys per account and managing them online, there's no reason you can't.

For every single one of your 100+ accounts? What if you forget an account when doing so, then it's lost forever? If one of the 100+ websites is momentarily down I simply have to keep the old passkey provider around until it comes back up and then remember to switch just that one later?

Are you using every single one of the 100+ accounts constantly? No? Then you can do the passkey flow on demand as needed. It can be comparably simple as an email login or 'we emailed you an OTP' login confirmation flow. If you never get around to using the account ever again in your life, I suppose you never needed it?

If the website is momentarily down how are you going to access it with a password at that moment? You'd have to wait until it came back up. And then you could just as well set up the passkey.

Re: Passkeys: A shattered dream

#642

Post by conradludgate »

nivenhuh wrote: post #483

For folks who don't know how passkeys work at a technical level, take a look at this implementation guide: https://webauthn.guide/ I don't get the passkey hate -- moving to public key challenge for authentication is a strong step forward for web security. Each browser / OS safeguards & backs up the private key (and even if that's lost, you can still reset your auth credentials using a normal "forgot password" flow).

You can absolutely do public key challenge authentication with passwords. You can use argon2 to derive the secret key for your account from your password and use that to encrypt a challenge message

Re: Passkeys: A shattered dream

#643

Post by jiggawatts »

skarra wrote: post #572
jiggawatts wrote: post #547

Earlier quoted context omitted.

I’m sorry, but you’re either naive or lying. This is precisely like the imaging standards trying to replace JPG. After two decades of vendors like Google trying to establish a new standard, I can’t send anything other than an SDR sRGB JPEG to anyone, especially to an Android user. The current post-JPG formats may as well be called “the Apple format”, “Google image”, and “Netflix pics”. There is no practical interoper…

I said "more interop" is coming.. There is a significant amount of interop that already exists, that folks are looking past or just already taken for granted (which is actually fine too!). While on a Windows machine using Edge, you can save a passkey for your Google account to your 1Password vault, and use it to sign in to that Google account on Chrome on Mac (if you have signed in to the same 1Password account on th…

If you can enumerate the few specific scenarios that work, after “companies worked hard to make it happen”, then there is no interoperability to speak of.

This is like someone from North Korea saying that they are free because they’re allowed to go to three specific cities in China for work.

Interoperability is an afterthought.

Even if that NK citizen is allowed to go to dozens of foreign countries, he’s still not free. There’s a fundamental difference between enumerated positives and enumerated negatives. Interoperability would be if every combination worked with only a handful of exceptions.

PS: Literally just after I made the comment above I had to add a PassKey to PayPal and only 1 of 4 scenarios that I tried worked.

“Sorry, your browser is not supported.”

Re: Passkeys: A shattered dream

#644

Post by arthur_sav »

MrDrMcCoy wrote: post #544
sroussey wrote: post #520

Earlier quoted context omitted.

I use 1Password which supports Passkeys, and don’t have an issue across mobile or desktop. I don’t get what the issues people have really are. I never experience them (fortunately!).

1Password is a closed-source, cloud-hosted service. At any time, for any reason, they can close and delete your account, leaving you high and dry. Self-hosted, multi-device password managers are the only real solution. Thankfully, Vaultwarden and KeePassXC fill this role perfectly. Now if we could just get the other providers that require insecure email/SMS 2FA to follow suit, that would be great...

> 1Password is a closed-source, cloud-hosted service. At any time, for any reason, they can close and delete your account

They used to offer their apps offline and you could "host" it anywhere. Venture Capital ruined them.

Re: Passkeys: A shattered dream

#645

Post by tsimionescu »

Spunkie wrote: post #423
red_trumpet wrote: post #168

Earlier quoted context omitted.

I have to store them on my disc, in order to use them tomorrow.

Oddly enough you don't. We've been storing our ssh keys(ed25519-sk) as resident keys for years now without issue. So basically we've been storing ssh keys directly on yubikeys the same way passkeys are stored since before passkeys were a thing. It seemed a clearly superior option compared to letting ssh private keys roam around on random computers.

Sure, but then limits you to a handful of keys. The WebAuthn people don't like this, they want one key per service, so basically YubiKeys no longer really work with WebAuthn (unless you're fine with only ever using a max of 25 services).

Re: Passkeys: A shattered dream

#646

Post by vbezhenar »

tsimionescu wrote: post #639
vbezhenar wrote: post #638

Earlier quoted context omitted.

That's not true. Phone and PC have to communicate via bluetooth.

Edit: everything I say below is not just wrong, but confidently wrong... "Communicate over bluetooth" doesn't mean anything. What app or BT device would they be using? How would a PC communicate with a YubiKey over bluetooth? I have no idea where you got this strange concept from, but registering multiple passkeys from multiple devices on the same account on a site requires no communication between the devices - it o…

That's how it works. You open Google Chrome on Linux, press "Log in with PassKey", scan QR with iPhone, then iPhone contacts Google Chrome via bluetooth to do its crypto magic (which doesn't work 50% of times) and may be it'll work.

No idea how Yubikey works, never used it.

Re: Passkeys: A shattered dream

#647

Post by tsimionescu »

knallfrosch wrote: post #213
vanburen wrote: post #82

Usernameless always seemed like an optimization too far to me. I think it's totally reasonable, and probably a good thing for users having to use their username at login. Especially as it reminds them what username they are using for that service. I could totally see a situation where a user uses a Usernameless passkey for years to access a service and for some reason loses access to the Usernameless passkey, and the…

There's no account recovery process for passkeys. I thought they are your identity?

No, your person is your identity. Passkey don't pay for services, people do. So there is always a recovery process, at least for any business that actually values you as a customer.

Re: Passkeys: A shattered dream

#648

Post by bannana2033 »

mmsc wrote: post #234
graton wrote: post #112

As someone who happily uses Yubikeys, I really don't want to use a Passkey. I want to still use a username/password and the Yubikey. Not just username and Yubikey. Google tries to force use of passkey now that if you enroll a Yubikey it will now be a Passkey, instead of a second factor. With no option to disable it. I have to run the Yubikey Manager tool and then disable "FIDO2", so that I can force it only be used a…

Using a direct link to Google’s 2FA setup will allow a Yubikey to be setup as 2FA instead of a Passkey, too: https://joshua.hu/enrolling-hardware-keys-2fa-google-workspa...

Thanks for the link. But it doesn't work anymore. I am being prompted to register as a passkey!

Re: Passkeys: A shattered dream

#649

Post by maeil »

yawaramin wrote: post #641
maeil wrote: post #613

Earlier quoted context omitted.

For every single one of your 100+ accounts? What if you forget an account when doing so, then it's lost forever? If one of the 100+ websites is momentarily down I simply have to keep the old passkey provider around until it comes back up and then remember to switch just that one later?

Are you using every single one of the 100+ accounts constantly? No? Then you can do the passkey flow on demand as needed. It can be comparably simple as an email login or 'we emailed you an OTP' login confirmation flow. If you never get around to using the account ever again in your life, I suppose you never needed it? If the website is momentarily down how are you going to access it with a password at that moment? Y…

I'm referring to the process of switching where my passkeys are stored to a different place. E.g. moving from them being stored by Apple to them being stored by Google or any other provider.

Re: Passkeys: A shattered dream

#650

Post by skinkestek »

MrDrMcCoy wrote: post #544
sroussey wrote: post #520

Earlier quoted context omitted.

I use 1Password which supports Passkeys, and don’t have an issue across mobile or desktop. I don’t get what the issues people have really are. I never experience them (fortunately!).

1Password is a closed-source, cloud-hosted service. At any time, for any reason, they can close and delete your account, leaving you high and dry. Self-hosted, multi-device password managers are the only real solution. Thankfully, Vaultwarden and KeePassXC fill this role perfectly. Now if we could just get the other providers that require insecure email/SMS 2FA to follow suit, that would be great...

I wonder if BitWarden doesn't support passkeys too.

BitWarden is open source to a large degree and even provides an (open source) server for self-hosting.

Post reply on HN