Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

731–740 of 789 posts

Re: Passkeys: A shattered dream

#731

Post by Groxx »

recursive wrote: post #697
scient wrote: post #673

Earlier quoted context omitted.

The whole original point of what underpins FIDO2 was device locked, unphishable credentials. Wanting to export and move passkeys between devices is kind of counter to that. And I would argue vendors completing the attestation process are much more trustworthy than storing your own keys god knows where.

Oh, ok. If that's the same thing as passkeys, then I finally figured out that I'm not interested. To me it looks like another vector for platform lock-in, or getting mysteriously locked out of my accounts with no recourse. I'll wait for FIDO3.

Yep. I absolutely refuse to support anything that wants to dictate what I do with my identity.

Such things do have purposes, in high-stakes environments. They prevent accidents. The vast majority of uses on the public web are not even remotely in that realm. It'd be better off being a separate spec that only a handful of internal-only systems use, ideally requiring MDM to set up conveniently (to strongly discourage normal and even high-stakes-normal website usage).

My banking website has absolutely no business knowing and being able to approve or deny what brand my authenticator is.

Re: Passkeys: A shattered dream

#732

Post by littlestymaar »

gertop wrote: post #711
prmoustache wrote: post #658

Earlier quoted context omitted.

My rule of thumb is if for some reason you need to use crypto keys that can't be easily replaced, you need to have a safe at the bank with the keys stored in 2 differente media formats, that are recreated every year. I don't trust many people to do that. I have everything encrypted and self hosted and I sometimes wonder what I would do if I was suffering from amnesia after an accident for example. And having a note s…

> I have everything encrypted and self hosted and I sometimes wonder what I would do if I was suffering from amnesia after an accident for example. Ah! I have the exact same recurring worry, it's very unpleasant. I'd really prefer to keep home media unencrypted, but the thought of a robber seeing my tax returns or photos of my infant daughter is constantly at the back of my mind.

> the thought of a robber seeing my tax returns or photos of my infant daughter is constantly at the back of my mind.

Even worse is the eventuality of them getting their hand of a picture of your ID card or passport, or whatever they can later use to steal your identity. Identity theft is nightmare stuff.

Re: Passkeys: A shattered dream

#733

Post by littlestymaar »

patrakov wrote: post #690
littlestymaar wrote: post #627

Earlier quoted context omitted.

That's a fundamental problem with cryptographic security: you cannot trust people to manage your keys for you (because due to lack of regulation preventing that companies have this bad habit of pulling the rug under their customers' feet) but you cannot trust yourself doing that either, because you can, and will, make mistakes.

It's worse: there are regulations (called "sanctions" and "KYC") that force companies to pull the rug.

Idk if it's “worse” but yeah sanctions are a serious problem for the many people who happen to have family ties with the “wrong” countries.

Re: Passkeys: A shattered dream

#734

Post by brabel »

dogman144 wrote: post #582
brabel wrote: post #285

Earlier quoted context omitted.

I don't think you know what phishing means. By "dropping malware on endpoints" I think you mean having a website serving malware? That's not phishing. For an attack to be "phishing", the website needs to be pretending to be some other website that the user trusts. Passkeys completely prevent the user from logging in to another website than the one they've created an account with. Your attack only works on people who…

I’m a security engineer, I’m pretty fluent on the topic. And phishing comes in beyond the methods you describe -> malicious attachments downloaded, etc etc.

I do agree but in this discussion we're talking about the general problem of logging in to a website. That's the case where phishing is the most devastating. Solving that problem is a huge step in making people's online lives more secure. Just because we didn't solve all problems, doesn't mean we shouldn't solve what we can solve. If you're a security engineer, it's your job to promote ways for people to be more secure online. And this is what I am trying to do myself.

Re: Passkeys: A shattered dream

#735

Post by FireBeyond »

whereismyacc wrote: post #167
gehsty wrote: post #50

Earlier quoted context omitted.

I thought passkeys were shared across Apple keychain (like passwords?) so you make a passkey on iPhone your iPad can use it.

Are they not private keys that shouldn't be synced across devices? I thought icloud facilitated automatic creation of passkeys for each device, not actually sharing the same passkey across devices?

That's the crux of one of the debates... members of the FIDO Consortium threatening KeePassXC and other open source tools with blocking for sharing "roaming keys", meanwhile "Oh, Apple wants to share keys via AirDrop? No problem", which is one of the concerns, that it's yet another "push users to Apple and Google's tool of choice".

Re: Passkeys: A shattered dream

#736

Post by FireBeyond »

Double_a_92 wrote: post #501
saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

As I understood it, that's exactly the purpose and not an issue. You are supposed to create a new passkey on each device you have. The fact that they can roam around within e.g. the Apple ecosystem is just some added function that Apple offers.

... and that the FIDO Consortium threatens to block other, non-Apple/Google companies if they try to offer.

Re: Passkeys: A shattered dream

#737

Post by hnarn »

I always set up two passkeys, one in iOS and one in bitwarden. I use the former on my phone (obviously) and the latter on desktop, in addition to “normal” logins with 2FA.

I haven’t had a single issue yet, and while I accept that it would be annoying if iOS suddenly wiped my keys, I really feel like it shouldn’t matter: ideally you shouldn’t have only one passkey to begin with, but even if you lose it, all services I use still allow “normal” logins as long as you can 2FA with a phone number or email.

Re: Passkeys: A shattered dream

#738

Post by psd1 »

sroussey wrote: post #578
ceinewydd wrote: post #554

Earlier quoted context omitted.

I’m really not sure the “only real solution” is every human needs to selfhost a password manager. That’s ill-advised; an extreme take. The vast majority of the population will do a worse job on the availability and security of a selfhost solution than 1Password, whose core business and value proposition is password management. I’m a very happy user of 1Password for Families and consider it the likely the best ~$50 a…

Agreed. I self hosted the key 100 bitcoin in like 2010. Machine crashed. Oops.

Feels. I had half a bitcoin on a disk that I left alone. Forgot about it. Reinstalled the OS. Three times. I was a sysadmin for years, but the cobblers' children go barefoot.

Re: Passkeys: A shattered dream

#739

Post by psd1 »

marssaxman wrote: post #386
whywhywhywhy wrote: post #197

Earlier quoted context omitted.

The platform lock in attempt is wild, my initial experiences with Passkeys were great on iOS and Safari, either getting pushed to touch-id or scanning a QR with my phone. But then in Chrome I couldn't get into GitHub because chrome would only push me to use their manager and wouldn't offer a QR code. Seeing this more and more with Chrome, like Credit Card numbers used to just save and autocomplete in browser but then…

> and shut down my Google Pay account I never knew I had Google loves that nonsense, don't they? It's as though they think so highly of themselves that they cannot imagine they might not be strictly doing us all a favor by signing us up for their services. Fifteen years later, I still have friends occasionally sending messages to a GMail address I never asked for, never used, and didn't even know about for most of a…

Never surrender any email address that a random berk can then claim.

I had my Facebook taken over because I had all notifications disabled and forgot that the email address was associated to it. Some criminal behind an Egyptian IP address took my old email and was in my Facebook within two days of me surrendering it.

Re: Passkeys: A shattered dream

#740

Post by psd1 »

static_motion wrote: post #546
yonatan8070 wrote: post #399

Earlier quoted context omitted.

Same goes for Chrome and Firefox on all platforms

Which is an overall terrible idea since passwords saved by browsers are saved in plaintext and are very easy to get to.

I really need to know more, so please, spill the beans.
Post reply on HN