Is passkey just OTP + vendor lockin because the vendors accidentally allowed OTP key export and are embarrassed about removing it?
Passkeys: A shattered dream
661–670 of 789 posts
Re: Passkeys: A shattered dream
#662Is passkey just OTP + vendor lockin because the vendors accidentally allowed OTP key export and are embarrassed about removing it?
>Is passkey just OTP + vendor lockin because the vendors accidentally allowed OTP key export
No, TOTP and passkeys had different motivational concepts:
- TOTP Time-Based-Onetime-Password of a "rolling numeric code" is conceptually similar to "trusted hardware" such as RSA SecurID tokens: https://www.google.com/search?q=securid&tbm=isch
- passkeys are conceptually similar to "trusted hardware" such as biometric USB vault from Yubikey that cost $50: https://www.yubico.com/product/yubikey-5-series/yubikey-5-nf... ... or Nitrokey: https://shop.nitrokey.com/shop?&search=nitrokey%203
In both cases, you can put secrets into the hardware but can't extract them back out. You can _use_ the secrets stored in the hardware via your fingerprint to facilitate logins but you can't extract/copy the digital data from one Yubikey to another Nitrokey. This restriction for USB vaults is deliberately designed for security but typically isn't disparaged as "vendor lock-in"
However, increasing website security via "trusted hardware" by making everybody spend an extra $50 for a USB vault is not ideal. Instead, a bunch of security experts noticed that billions of people are already carrying smartphones that have built-in biometric security such as face-id and fingerprint readers. Ok, let's just piggyback on existing smartphones and make them "act like the $50 Yubikey/Nitrokey" -- which means mobile passkeys managers like Google not allowing simple export/copying of passkeys.
Yeah but desktop managers like 1Password, Bitwarden, KeePassXC allow export of passkeys! True, but there's controversy and disagreement about that because they're not restricted like the Yubikey hardware is. Will some websites that are very strict reject some clients that allow passkeys export? It's a wait & see.
If the "ideal" passkeys ("ideal" from the RP Relying Parties point-of-view) are for them not to exportable/transferrable to another device, how do they expect people migrate from Apple to Android or whatever? By generating new passkeys for that new device and adding it the list of approved passkeys the website accepts. Instead of transferring the secrets, you re-generate new secrets.
Re: Passkeys: A shattered dream
#663Earlier quoted context omitted.
You're wrong, with password managers you can definitely be phished. Unless it's literally impossible to extract the password to enter it manually, but I don't think password managers make that impossible (and if it's possible, users will do it). With passkeys it's literally impossible.
Could you expand on how to trick a password manager to enter the password on a fake domain ? I'd see having the user add the domain themselves, or get the user to copy/past the password themselves on some other form. But the phishing is not happening on the password manager side, and these use cases still exist even after you chose passkeys (i.e. I'd still need to somewhat log into Google's auth from my Nest hub for…
There can be vulnerabilities, this is clearly the hottest attack surface of password managers. I remember a few years ago Tavis Ormandy from Google Project Zero found such vulnerabilities in a bunch of the most popular password managers which allowed to steal credentials from a rogue website.
I'd still recommend using a password manager, as overall and in practice the risk of phishing and (re)using (weak) passwords is far greater than this kind of rare vulnerabilities (and also I work for a company that makes a password manager ^^)
See https://lock.cmpxchg8b.com/passmgrs.html if you'd like to know more
Re: Passkeys: A shattered dream
#664Earlier quoted context omitted.
The metaphor might be a bit esoteric, but that's similar to wishing that Hardware Security Modules (HSMs) allowed you "get your " out of the HSM. As sibling comment says, that's how you get phished. The whole point of an HSM (and a passkey) is that the super-secret private part never leaves the HSM no matter how nicely you ask and no matter how compromised the machine is. A password manager, OTOH, is happy to hand ou…
Yes, but I don’t want vendor lockin. I want to move my passkeys where I want and use tools I want. Not allowing anyway of changing passkeys is terrible. Imagine someone switches from IOS to android. How do they use their passkeys? Even if they had a big “warning don’t do this” sign it would be better than not allowing it in anyway.
It's a middle ground. You should be able to move passkeys from one vendor to another with some export process but the secret key is not exposed when you use it which reduces the risk of having it stolen
Re: Passkeys: A shattered dream
#665Earlier quoted context omitted.
I’m really not sure the “only real solution” is every human needs to selfhost a password manager. That’s ill-advised; an extreme take. The vast majority of the population will do a worse job on the availability and security of a selfhost solution than 1Password, whose core business and value proposition is password management. I’m a very happy user of 1Password for Families and consider it the likely the best ~$50 a…
Agreed. I self hosted the key 100 bitcoin in like 2010. Machine crashed. Oops.
Do you still have the hard disk? Did you attempt to recover it ?
Re: Passkeys: A shattered dream
#666The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…
[deleted]
Re: Passkeys: A shattered dream
#667Earlier quoted context omitted.
Passkeys only encourage the need for a password management tool, which is funny because if everyone had password management tools to begin with then we wouldn't need passkeys.
This is not true. Passkeys still protect you from additional things that password managers don't protect you against: 1. Your credential can't be phished as it's cryptographically bound to the domain. You could stil be tricked into entering your password and TOTP into a malicious website. 2. Your credential can't be leaked by sloppy servers as it's public key crypto. This makes your security not depend on believing t…
Most password managers tie credentials to domains. In fact, this is a good indicator of possible phishing attempts when your password manager doesn’t offer to auto-fill your expected credentials.
Re: Passkeys: A shattered dream
#668Earlier quoted context omitted.
I’m really not sure the “only real solution” is every human needs to selfhost a password manager. That’s ill-advised; an extreme take. The vast majority of the population will do a worse job on the availability and security of a selfhost solution than 1Password, whose core business and value proposition is password management. I’m a very happy user of 1Password for Families and consider it the likely the best ~$50 a…
Agreed. I self hosted the key 100 bitcoin in like 2010. Machine crashed. Oops.
Sounds like you had control of your data.
Re: Passkeys: A shattered dream
#669Passkeys are being pushed by Government and Law Enforcement because PASSWORDS WORK and frustrate them. Police access 95% of the phones they seize so they want passkeys to be the norm because once they own the phone they own EVERYTHING you secured with passkeys.
There is nothing wrong is passwords.
There is everything wrong with biometrics.
Wake up!
Re: Passkeys: A shattered dream
#670Earlier quoted context omitted.
The same way you would back up passwords stored in iCloud Keychain, 1Password, KeePassXC, etc.
So you don’t, just leave it to BigTech, thanks.
KeePassXC is not Big Tech. It is open source and self-hosted. It supports exporting the private keys, although Big Tech is not happy about that feature: https://news.ycombinator.com/item?id=40167782