Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys and Modern Authentication

lucumr.pocoo.org

Post reply on HN
Print view View original

31–40 of 212 posts

Re: Passkeys and Modern Authentication

#31

Post by dan-robertson »

Dr4kn wrote: post #26
dan-robertson wrote: post #20

> Obviously, one could pay for an authenticator like 1Password, which at least is ecosystem independent. However, not everybody is in a situation where they can afford to pay for basic services like password managers This argument was made in the context of moving out of the Apple ecosystem (are there other ecosystems one would want to leave where the only option is paying for something like 1password?). I don’t real…

There is also keepass, which you can sync with whatever free cloud storage you want. It might not be the nicest password manager you can use, but you can always use it for free. Bitwardens free tier is also generous enough that a lot of people won't have to pay

Seems like the existence of keypass does not support the argument made in the OP.

Re: Passkeys and Modern Authentication

#32

Post by toomuchtodo »

juancn wrote: post #18

Signing into my accounts on my children’s devices has turned from a straightforward process to an incredibly frustrating experience. I find myself juggling all kinds of different apps and flows. This strikes home for me, I'm the main gatekeeper of passwords and service accounts in my home. 2FA and passkeys are so annoying to juggle. My kids use prepaid numbers, once I changed one and forgot to tell Apple, when I real…

Passwords are a weak authentication mechanism and incur liability. MFA is good, Passkeys are better. One time passwords via email are tolerable, still better than passwords.

(customer identity and access management is a component of my work at a fintech)

Re: Passkeys and Modern Authentication

#33

Post by alphazard »

karmarepellent wrote: post #15
alphazard wrote: post #6

Unfortunately the tech community is full of people who pride themselves on being aware of and advocating for the latest standard put out by whatever company. That's how we end up with lots of complicated nonsense like most of what is sent in HTTP headers, or the contents of a TLS certificate. On the topic of authentication, it's solved. SSH nailed it, any further complexity is strictly worse . Signing up is uploading…

> Signing in is cryptographically signing a commitment to the current ephemeral tunnel. I can see how SSH could be used for authentication on the web. And I have no doubt that it would be sound out-of-the-box. But I am not sure what you mean by your last sentence. Do you mean that authentication targets are gated and only reachable by establishing a tunnel via some kind of forwarding? Aside from the wonderful possibi…

> authentication targets are gated and only reachable by establishing a tunnel via some kind of forwarding?

No, it's just how you authenticate with signing keys. Given that a secure channel has been set up with ephemeral keys, you can sign a commitment to the channel (like the hash of the shared secret key) to prove who you are to the other party.

> let users authenticate via SSH and then return a short-lived token that can then be used to log into an application (or even a SSO service)

This is exactly what I recommend. If everyone did this, then eventually then the browsers or 1password could support it.

Re: Passkeys and Modern Authentication

#34

Post by adiabatichottub »

juancn wrote: post #18

Signing into my accounts on my children’s devices has turned from a straightforward process to an incredibly frustrating experience. I find myself juggling all kinds of different apps and flows. This strikes home for me, I'm the main gatekeeper of passwords and service accounts in my home. 2FA and passkeys are so annoying to juggle. My kids use prepaid numbers, once I changed one and forgot to tell Apple, when I real…

It makes sense to keep printed backups of certain keys and passwords in a physically secure location, accessible to the people you trust in case of an emergency.

Re: Passkeys and Modern Authentication

#35

Post by tadfisher »

alphazard wrote: post #24
01HNNWZ0MV43FF wrote: post #19

Earlier quoted context omitted.

> Signing up is uploading a public key. Signing in is cryptographically signing a commitment to the current ephemeral tunnel. How do I sign in from multiple computers?

There are multiple solutions to this, with tradeoffs. Doesn't change the fact that the service should only want a public key, and you should only give the service a public key. That's where this new complexity is being forced on users and developers. You need to be able to sign in, or let your users sign in, but you can choose how complicated of a key management strategy to have. You can either have 1 key pair per se…

You are describing passkeys. All of this applies to the passkey scheme.

Actually, a benefit of passkeys is the standardization of client-side cross-device authz operations via caBLE and similar; your secret keys never leave your primary device, but are usable from other devices over a variety of transports.

Re: Passkeys and Modern Authentication

#36

Post by cuu508 »

toomuchtodo wrote: post #32
juancn wrote: post #18

Signing into my accounts on my children’s devices has turned from a straightforward process to an incredibly frustrating experience. I find myself juggling all kinds of different apps and flows. This strikes home for me, I'm the main gatekeeper of passwords and service accounts in my home. 2FA and passkeys are so annoying to juggle. My kids use prepaid numbers, once I changed one and forgot to tell Apple, when I real…

Passwords are a weak authentication mechanism and incur liability. MFA is good, Passkeys are better. One time passwords via email are tolerable, still better than passwords. (customer identity and access management is a component of my work at a fintech)

Security-wise, passkeys are worse than username/password plus WebAuthn as the second factor.

Re: Passkeys and Modern Authentication

#37

Post by unsnap_biceps »

bradley13 wrote: post #22

This. All of this. Passkeys are a great idea, but the walled gardens are a huge problem. Also, services placing additional requirements (e.g., attestations) that potentially violate your privacy and anonymity. Just now, at least in Europe, there is a huge push to force users to authenticate themselves with their actual identity, even for ordinary Internet services. This is happening simultaneously in many countries (…

The walls are going to come down. KeyPassX supports passkeys and allows you to export them as you wish. 1Password and Apple Passwords have both said they're going to support exporting and importing of passkeys.

Yes, it's awful during the transition period while the tech matures, but there is a path towards a great future.

Re: Passkeys and Modern Authentication

#38

Post by tptacek »

cuu508 wrote: post #36
toomuchtodo wrote: post #32

Earlier quoted context omitted.

Passwords are a weak authentication mechanism and incur liability. MFA is good, Passkeys are better. One time passwords via email are tolerable, still better than passwords. (customer identity and access management is a component of my work at a fintech)

Security-wise, passkeys are worse than username/password plus WebAuthn as the second factor.

But better than username/password + TOTP, and username/password + WebAuthn had really low uptake.

Re: Passkeys and Modern Authentication

#39

Post by [deleted] »

cuu508 wrote: post #36
toomuchtodo wrote: post #32

Earlier quoted context omitted.

Passwords are a weak authentication mechanism and incur liability. MFA is good, Passkeys are better. One time passwords via email are tolerable, still better than passwords. (customer identity and access management is a component of my work at a fintech)

Security-wise, passkeys are worse than username/password plus WebAuthn as the second factor.

[deleted]

Re: Passkeys and Modern Authentication

#40

Post by alphazard »

agwa wrote: post #27
alphazard wrote: post #6

Unfortunately the tech community is full of people who pride themselves on being aware of and advocating for the latest standard put out by whatever company. That's how we end up with lots of complicated nonsense like most of what is sent in HTTP headers, or the contents of a TLS certificate. On the topic of authentication, it's solved. SSH nailed it, any further complexity is strictly worse . Signing up is uploading…

The simplicity of SSH's public key authentication comes with a significant privacy downside: https://www.agwa.name/blog/post/whoarethey https://words.filippo.io/whoami-updated/ This isn't such a big deal in the SSH ecosystem, but it would be a disaster on the Web where there is an enormous incentive to track users. Part of WebAuthn's complexity comes from addressing that.

The complexity is unwarranted. The only thing that needs standardizing is how to hand over public keys (SSH format works fine), and what to sign to prove identity.

Everything else about managing which public keys are for what does not need to be decided in a standard. The users can choose whatever key management solution works best for them. What those links get at is a problem of key management. A single set of keys, where you send all of them to every server all the time, is a bad strategy.

Post reply on HN