Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

691–700 of 789 posts

Re: Passkeys: A shattered dream

#691

Post by latchkey »

cchance wrote: post #685
latchkey wrote: post #496

Earlier quoted context omitted.

No, I don't want to be tied to a single browser for my passkey, what happens if I want to log into a site on my phone using safari or chrome? I also don't want it tied to my apple keychain. What if I want to share my passkey with my partner?

lol it’s a passkey… why would you want 1 that can be shared and… lost you just register another one Being like “I don’t want to add another passkey” is really a semantic issue what exactly is the difference to you or adding a passkeys to an account vs copying a passkey to another device except the fact that if you can copy it/share it… it’d be far less secure with more ways to leak

> why would you want 1 that can be shared

My partner and I share a single account for XYZ service. We don't want separate accounts.

> it’d be far less secure with more ways to leak

There is nothing "less secure" with sharing an account credentials with my partner through bitwarden. Especially for accounts that are things like "pay my electric bill" or "online shopping".

Re: Passkeys: A shattered dream

#692

Post by 4ad »

graton wrote: post #112

As someone who happily uses Yubikeys, I really don't want to use a Passkey. I want to still use a username/password and the Yubikey. Not just username and Yubikey. Google tries to force use of passkey now that if you enroll a Yubikey it will now be a Passkey, instead of a second factor. With no option to disable it. I have to run the Yubikey Manager tool and then disable "FIDO2", so that I can force it only be used a…

If you use Google Workspace you can set 2FA directly from the admin console, so you don't need to disable FIDO2 on the key. Does not help with gmail, though.

Re: Passkeys: A shattered dream

#693

Post by 4ad »

Ferret7446 wrote: post #575
crote wrote: post #218

The part I hate most about Passkeys is that it essentially killed the FIDO1/U2F ecosystem. Just about every website which implemented Passkeys removed the option to use hardware tokens with "non-resident" credentials. This means you're stuck using your Yubikey as either an insecure TOTP token, or as a practically-useless Passkey. We had the perfect 2FA method with U2F hardware tokens, why did they have to take that a…

> Just about every website which implemented Passkeys removed the option to use hardware tokens with "non-resident" credentials Which ones? AFAIK they support passkeys in addition to password+U2F 2FA

Google.

It still support U2F 2FA, but only if you have a non-FIDO2 key. If you have a FIDO2 key it will use it as a passkey, with no option to change this.

Re: Passkeys: A shattered dream

#695

Post by mixmastamyk »

joshuaissac wrote: post #670
mixmastamyk wrote: post #626

Earlier quoted context omitted.

So you don’t, just leave it to BigTech, thanks.

KeePassXC is not Big Tech. It is open source and self-hosted. It supports exporting the private keys, although Big Tech is not happy about that feature: https://news.ycombinator.com/item?id=40167782

Interesting rabbit hole. Seems like it supports my point about the powers that be working to eliminate the possibility.

Re: Passkeys: A shattered dream

#696

Post by sholladay »

calaverainfo wrote: post #625
sholladay wrote: post #539

Earlier quoted context omitted.

You are able to share an Apple passkey to any nearby Apple device at any time using AirDrop. Passkeys can also be used cross-platform during sign in via an NFC/Bluetooth handshake initiated by QR code. Additionally, passkeys are just a synced-via-cloud implementation of FIDO2, an open standard that has other implementations you may feel more comfortable using. For someone who requires being able to sign in to, say, G…

Number 2 is not true. I have a Yubikey and it can't be used on Android without a Google made app or account. It's always the same story, give a plausible option to seem open or neutral, but make sure there are "details" that establishes chain of consequences preventing it that is weird enough to allow denying intention. Even though I'm not that young I thought I just need to wait for Firefox to implement it, but as t…

I was able to log in to GitHub using a Yubikey on my Pixel without a special app.

Check whether your Yubikey supports resident keys (aka discoverable credentials) and whether the FIDO key for your account was created with residentKey: true, otherwise it’s a completely different (older) flow under the hood, where the private key actually gets sent to the server, and it wouldn’t surprise me if that’s the underlying cause of what’s happening to you.

Re: Passkeys: A shattered dream

#697

Post by recursive »

scient wrote: post #673
recursive wrote: post #586

Earlier quoted context omitted.

I'm a happy user of 1password also. But I'm not touching passkeys until they let me export them. Last time I checked, it was a platform lock-in.

The whole original point of what underpins FIDO2 was device locked, unphishable credentials. Wanting to export and move passkeys between devices is kind of counter to that. And I would argue vendors completing the attestation process are much more trustworthy than storing your own keys god knows where.

Oh, ok. If that's the same thing as passkeys, then I finally figured out that I'm not interested. To me it looks like another vector for platform lock-in, or getting mysteriously locked out of my accounts with no recourse. I'll wait for FIDO3.

Re: Passkeys: A shattered dream

#698

Post by discardedrefuse »

vel0city wrote: post #301
rcarmo wrote: post #297

Earlier quoted context omitted.

It's still not a great multi-platform/multi-device story. I use multiple machines regularly (and I've migrated away from 1Password to the KeePass ecosystem, by the way) so syncing passkeys from my Mac(s) to my iPad, to my Fedora machines and my Windows working environment is simply not happening any way I look at it. Passkeys are great for consumers who use one or two devices (or browsers - I also switch browsers fre…

You shouldn't ~~necessarily~~ need to "sync" your passkeys across all your devices; each device should have its own passkey. Then if you lose a device (or that one device gets compromised), you revoke the one key and everything else is fine. Similar to SSH keys. No reason to use the same key on all your machines, use a different key from different places. The passkeys on my laptop are different from the passkeys on m…

Yo. Thank you so much for posting in this thread. Turns out I was thinking about Passkeys wrong this whole time and you're the first person (I've seen) to really explain this workflow. Thanks again!

Re: Passkeys: A shattered dream

#699

Post by jhasse »

jiggawatts wrote: post #547
skarra wrote: post #537

Earlier quoted context omitted.

Thanks for your faith. I work on the team shipping passkeys at Google. We are very much hard at work to realize the full potential of passkeys. Platform lockin serves no one. That is no one's intent - independent password managers storing passkeys is already a thing today. More interop will come once relevant standards are blessed.

I’m sorry, but you’re either naive or lying. This is precisely like the imaging standards trying to replace JPG. After two decades of vendors like Google trying to establish a new standard, I can’t send anything other than an SDR sRGB JPEG to anyone, especially to an Android user. The current post-JPG formats may as well be called “the Apple format”, “Google image”, and “Netflix pics”. There is no practical interoper…

> This is precisely like the imaging standards trying to replace JPG. After two decades of vendors like Google trying to establish a new standard, I can’t send anything other than an SDR sRGB JPEG to anyone, especially to an Android user.

Android supports WebP since Android 4, HEIF since Android 8 and AVIF since Android 14. They are only missing JPEG XL, but to my knowledge neither iOS nor Windows support that format natively either. Regarding interoperability and support for open formats Android/Google is way ahead of Apple or Microsoft in my experience.

Re: Passkeys: A shattered dream

#700

Post by nullfield »

mdaniel wrote: post #472
noname120 wrote: post #452

Earlier quoted context omitted.

Where did you see that? This comment just 4 months ago from 1Password says that exporting isn't possible: https://www.reddit.com/r/1Password/comments/18m4iph/comment/... And I haven't seen any announcements in the opposite direction. ———— Edit: so I just checked and I can confirm that it's not possible to export passkeys from 1Password. Neither of the two available export options include passkeys. > • 1PUX A 1Passwor…

Well then their enshitification just continues with their unending quest for burning every user-centric bridge they ever built. Goddamn To answer your question, "bamboo menu, Copy Item JSON" which I believe is turned on due to my "Preferences, Advanced, Show debugging tools" being checked. I actually did try the $(op item get --format=json $its_uuid) first but figured there was some sekrit env var or --fields some_ho…

This will be the straw, and now comes the “god how do I migrate off this shitshow” - enshittification pun intended. I nearly cancelled upon their choice to even add telemetry, then they made it possible to disable and off by default (though they still ask to turn it on).

The whole fucking point of a password manager, though, is to store and securely provide authn material while ensuring users can’t lose it… which necessarily includes ability to access it, and back it up.

It looks a LOT like passkeys and FIDO are, relatively effectively, backdooring what Google got beat to death for when they attempted to add “Web Environment Integrity” to browsers.

edit: But can I? I’m already questioning how hard it’s going to be, and if it’s feasible without a lotttt of hurt.

Post reply on HN