Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

711–720 of 789 posts

Re: Passkeys: A shattered dream

#711

Post by gertop »

prmoustache wrote: post #658
littlestymaar wrote: post #627

Earlier quoted context omitted.

That's a fundamental problem with cryptographic security: you cannot trust people to manage your keys for you (because due to lack of regulation preventing that companies have this bad habit of pulling the rug under their customers' feet) but you cannot trust yourself doing that either, because you can, and will, make mistakes.

My rule of thumb is if for some reason you need to use crypto keys that can't be easily replaced, you need to have a safe at the bank with the keys stored in 2 differente media formats, that are recreated every year. I don't trust many people to do that. I have everything encrypted and self hosted and I sometimes wonder what I would do if I was suffering from amnesia after an accident for example. And having a note s…

> I have everything encrypted and self hosted and I sometimes wonder what I would do if I was suffering from amnesia after an accident for example.

Ah! I have the exact same recurring worry, it's very unpleasant. I'd really prefer to keep home media unencrypted, but the thought of a robber seeing my tax returns or photos of my infant daughter is constantly at the back of my mind.

Re: Passkeys: A shattered dream

#712

Post by Szpadel »

whywhywhywhy wrote: post #197
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

The platform lock in attempt is wild, my initial experiences with Passkeys were great on iOS and Safari, either getting pushed to touch-id or scanning a QR with my phone. But then in Chrome I couldn't get into GitHub because chrome would only push me to use their manager and wouldn't offer a QR code. Seeing this more and more with Chrome, like Credit Card numbers used to just save and autocomplete in browser but then…

> Then had to like type in the CCV to retrieve the card but then it also charged my bank account 1c for the privilege of autocompleting the card each time.

I believe those transactions are never confirmed and are reverted after 7 days or something like that

Re: Passkeys: A shattered dream

#713

Post by MrDrMcCoy »

yaleman wrote: post #654
skinkestek wrote: post #650

Earlier quoted context omitted.

I wonder if BitWarden doesn't support passkeys too. BitWarden is open source to a large degree and even provides an (open source) server for self-hosting.

It does, works great. Not sure about vaultwarden's support for it though.

It works fine on Vaultwarden for me.

Re: Passkeys: A shattered dream

#714

Post by MrDrMcCoy »

ceinewydd wrote: post #554
MrDrMcCoy wrote: post #544

Earlier quoted context omitted.

1Password is a closed-source, cloud-hosted service. At any time, for any reason, they can close and delete your account, leaving you high and dry. Self-hosted, multi-device password managers are the only real solution. Thankfully, Vaultwarden and KeePassXC fill this role perfectly. Now if we could just get the other providers that require insecure email/SMS 2FA to follow suit, that would be great...

I’m really not sure the “only real solution” is every human needs to selfhost a password manager. That’s ill-advised; an extreme take. The vast majority of the population will do a worse job on the availability and security of a selfhost solution than 1Password, whose core business and value proposition is password management. I’m a very happy user of 1Password for Families and consider it the likely the best ~$50 a…

I disagree. While Vaultwarden may be a bit much to ask of the unwashed masses, the storage model of KeePass* is very easy to understand and works with any existing file synchronisation solution, which almost everyone already has at this point. The effort is nearly as low as with a cloud hosted solution, and the value/safety proposition is quite high.

Re: Passkeys: A shattered dream

#716

Post by nullfield »

kxrm wrote: post #473
Xelynega wrote: post #465

Earlier quoted context omitted.

It's up to the server whether it uses it in challenge-response or not. That's application-specific behaviour that's past the definition of passkeys themselves. The reason you couldn't have an open source passkey manager that allows backup is that it wouldn't be a "passkey manager" then, just a password manager. To be a passkey it seems to require that it can't be exported/viewed other than by the website it was creat…

> even by the user Perhaps this is something I shouldn't be feeling, but this bothers me and I do not know why. I can see that you might not want it exposed to the user to prevent social engineering but at the same time, if I can't view then I don't feel like I actually own it. Is there a mechanism that might exist to help me not feel this way? I am totally new to passkeys as a concept as well, but I understand the l…

No, you’re smart to feel this. See the previously linked comment from someone upset that KeyPassXC lets users export:

https://github.com/keepassxreboot/keepassxc/issues/10407

When it comes to Apple, or Google, remember that people keep their accounts (and therefore access to their keys) at Apple or Google’s pleasure; people’s lives can and do get upended when Google decides you’ve done “The Bad” and they revoke your account-and there’s no learning what you did. For your, and everyone else’s, security of course.

The desire for better metadata is good, because you don’t want to hand your password for microsoft.com to microsolt.com when you’re in a hurry and a sophisticated phishing email arrived. Still, as an example, I’m trusting 1Password less and less. They just helped me autofill credentials somewhere they shouldn’t have (thankfully to no ill effect) when the password was correctly set up with website information, basically where something was site1.example.com instead of othersite.example.com. Because they ignored the subdomain.

Their response from support? “By default 1Password doesn’t take into account subdomains when suggesting an item…” and if you’re using their desktop product, there you can go change - per-item (wtf?) - whether it requires exact domain match to fill.

As so many other people here are saying, it feels like a mass lock-in attempt. If it’s not FIDO is doing a really good job making it look that way, especially with “attestation” (which could just be Web Integrity 2.0 if misused).

Re: Passkeys: A shattered dream

#717

Post by nullfield »

mingus88 wrote: post #460
mac-mc wrote: post #421

Earlier quoted context omitted.

> By requiring the passkey to be managed by a password manager, you get some anti-phishing protection. A passkey includes metadata, including the website domain that created it, and the password managers simply won't provide the passkey to the wrong domain. There are so many apps that don't get this right. Make a login on the website, store it in 1password, and then try to login in their mobile app and it doesn't sho…

1password has a URL field. All you have to do it add the extra URLs Better yet, while on mobile, search for the entry of the desktop site and have it fill. 1password will ask if you want to update the entry for this site

Except they ignore subdomains. Unless you fix that on a per-item basis, in their desktop application.

I think, finally, that the reason this feels so dirty-apart from companies and lock-in and all-is that it’s taking the “something you know” as one auth factor and turning it into something that, not only do you not know, the big goal of is to make sure you can’t know but something you have.

Re: Passkeys: A shattered dream

#718

Post by nullfield »

barryp wrote: post #450
red_admiral wrote: post #415

Earlier quoted context omitted.

... with some of the functionality of SSH keys removed, like being able to use one key for many accounts, or many keys (on many machines) all for the same account. At least that's how I understand it.

I think you're right about the first part...a passkey being tied to a single account on a single site. But not the second: on Github for example you can have multiple passkeys for the same account.

But not the same ssh key on multiple accounts.

Re: Passkeys: A shattered dream

#719

Post by Groxx »

alwaysbeconsing wrote: post #687
generalpf wrote: post #676

Earlier quoted context omitted.

Having the passwords in the cloud is useful though. Before, if you wanted to use your vault across multiple machines, you had to store your vault in someone else’s cloud. This simplifies the process.

Incorrect. 1P orginally offer direct LAN syncing among machines.

And you could just open the in-backup html file to decrypt and read your stuff in emergencies.

1Password has fallen hard from their earlier excellence.

Re: Passkeys: A shattered dream

#720

Post by whywhywhywhy »

gcr wrote: post #552
whywhywhywhy wrote: post #197

Earlier quoted context omitted.

The platform lock in attempt is wild, my initial experiences with Passkeys were great on iOS and Safari, either getting pushed to touch-id or scanning a QR with my phone. But then in Chrome I couldn't get into GitHub because chrome would only push me to use their manager and wouldn't offer a QR code. Seeing this more and more with Chrome, like Credit Card numbers used to just save and autocomplete in browser but then…

Odd! I've been able to sign into desktops running Chrome both on Windows and Mac. Both times Chrome will show a QR code that my iPhone scans. The actual passkey is stored in 1Password. The dark pattern about signing up for google pay is absolutely inexcusable though. Sorry you're going through that.

I think they changed it recently to offer a QR code because checking now it's offering it. But I absolutely had the issue for the first few months of the year.
Post reply on HN