Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys and Modern Authentication

lucumr.pocoo.org

Post reply on HN
Print view View original

51–60 of 212 posts

Re: Passkeys and Modern Authentication

#51

Post by recursive »

AnotherGoodName wrote: post #3

> there is effectively no way to export private keys between authentication password managers No exporting really is a feature. Otherwise people would be tricked into giving away passkeys much like they are with passwords today. You can always register multiple passkeys with providers though. Already have a passkey with google but want another one via a different password/account manager? Just go into settings on goo…

I don't want to cede a chokepoint to my online identity to a multinational conglomerate with no support department. I don't understand the UX for adding more passkeys.

I'd rather have the possibility of being "tricked" than get locked into another walled garden. Maybe I'm wrong for feeling that way, but there are literally dozens of us.

Re: Passkeys and Modern Authentication

#52

Post by AlexandrB »

tptacek wrote: post #38
cuu508 wrote: post #36

Earlier quoted context omitted.

Security-wise, passkeys are worse than username/password plus WebAuthn as the second factor.

But better than username/password + TOTP, and username/password + WebAuthn had really low uptake.

Username/password + TOTP is still better than username/password + one time email, no? Especially since the latter creates additional dependencies/risks for the user in the form of an email account.

Re: Passkeys and Modern Authentication

#53

Post by the_mitsuhiko »

dan-robertson wrote: post #20

> Obviously, one could pay for an authenticator like 1Password, which at least is ecosystem independent. However, not everybody is in a situation where they can afford to pay for basic services like password managers This argument was made in the context of moving out of the Apple ecosystem (are there other ecosystems one would want to leave where the only option is paying for something like 1password?). I don’t real…

> This argument was made in the context of moving out of the Apple ecosystem

Author here. Insert your favorite ecosystem in that people currently have. If you have a windows 11 computer you end up with Windows Hello passkeys for free. If you have a Chromebook then it will be something else.

Apple devices show up in low income households somewhat regularly where I live because of subsidized iPads for education.

Re: Passkeys and Modern Authentication

#54

Post by psanford »

jcmontx wrote: post #45

One day Authy for desktop was deprecated and all of a sudden I was forced to always have my smartphone with me, which I was struggling to replace with a dumbphone. To this day, I have no way out of owning an smartphone for this very reason

I assume you were using Authy desktop for TOTP? You don't need a smartphone for storing TOTP seeds or generating TOTP codes.

Re: Passkeys and Modern Authentication

#55

Post by OJFord »

toomuchtodo wrote: post #32
juancn wrote: post #18

Signing into my accounts on my children’s devices has turned from a straightforward process to an incredibly frustrating experience. I find myself juggling all kinds of different apps and flows. This strikes home for me, I'm the main gatekeeper of passwords and service accounts in my home. 2FA and passkeys are so annoying to juggle. My kids use prepaid numbers, once I changed one and forgot to tell Apple, when I real…

Passwords are a weak authentication mechanism and incur liability. MFA is good, Passkeys are better. One time passwords via email are tolerable, still better than passwords. (customer identity and access management is a component of my work at a fintech)

Your fintech is probably not among the 99% accounts GP says don't warrant 'anything fancy'.

IME as a customer/user, financial institutions are some of the worst culprits for doing appalling things in the name of security (theatre) anyway.

Re: Passkeys and Modern Authentication

#56

Post by [deleted] »

karmarepellent wrote: post #15
alphazard wrote: post #6

Unfortunately the tech community is full of people who pride themselves on being aware of and advocating for the latest standard put out by whatever company. That's how we end up with lots of complicated nonsense like most of what is sent in HTTP headers, or the contents of a TLS certificate. On the topic of authentication, it's solved. SSH nailed it, any further complexity is strictly worse . Signing up is uploading…

> Signing in is cryptographically signing a commitment to the current ephemeral tunnel. I can see how SSH could be used for authentication on the web. And I have no doubt that it would be sound out-of-the-box. But I am not sure what you mean by your last sentence. Do you mean that authentication targets are gated and only reachable by establishing a tunnel via some kind of forwarding? Aside from the wonderful possibi…

[deleted]

Re: Passkeys and Modern Authentication

#57

Post by tadfisher »

dan-robertson wrote: post #29

What do security professionals think about passkeys? In particular, those who were not involved in designing them. Lots of the arguments in this article feel very much like the sort of thing one would expect from someone into open source (not saying they are wrong, and I think they are well explained here) but I feel they will inevitably be the product of different concerns than those a security practitioner might ha…

I helped implement support for passkeys in a banking product. They obviate so many attack vectors and adoption is high enough that it should be a requirement to at least support them.

We already require TOTP-based 2FA, and have even implemented secure TOTP via our mobile apps. Customers still do not understand 2FA and probably never will; we regularly have customers request 2FA resets after using their 10 backup codes. SMS- or email-based 2FA is a no-go.

We don't require hardware attestation, as that is the recommendation of the FIDO alliance and Google/Apple/Microsoft. It doesn't make sense to cut out iCloud/Google-synced passkeys given the clear security benefits over passwords+2FA.

Keep in mind that for our service, we regularly see attackers set up copycat sites to phish user credentials, and pay for Google Search ads to appear before our site in search results. These phishing attempts are sophisticated and customers will send their 2FA codes through them. _This is impossible with passkeys._

Re: Passkeys and Modern Authentication

#58

Post by skybrian »

yomismoaqui wrote: post #11
alphazard wrote: post #6

Unfortunately the tech community is full of people who pride themselves on being aware of and advocating for the latest standard put out by whatever company. That's how we end up with lots of complicated nonsense like most of what is sent in HTTP headers, or the contents of a TLS certificate. On the topic of authentication, it's solved. SSH nailed it, any further complexity is strictly worse . Signing up is uploading…

All developers pass this magpie phase [1] and as you get older you start to see new things more critically. I guess a desirable trait of seniority is to balance the urge to play with new toys vs the feeling that sometimes we are running in circles, repeating the same mistakes with different tech. [1]: https://blog.codinghorror.com/the-magpie-developer/

I’ll add that eventually it’s less about what I want and more about what would work for other people I know. Many of them aren’t very technical.

What do you need to do to keep family from (a) not getting locked out and (b) not getting phished?

Re: Passkeys and Modern Authentication

#59

Post by adiabatichottub »

alphazard wrote: post #6

Unfortunately the tech community is full of people who pride themselves on being aware of and advocating for the latest standard put out by whatever company. That's how we end up with lots of complicated nonsense like most of what is sent in HTTP headers, or the contents of a TLS certificate. On the topic of authentication, it's solved. SSH nailed it, any further complexity is strictly worse . Signing up is uploading…

@alphazard, what are your thoughts on using self-signed X.509 certs, since 95% of the infrastructure is already there?

Re: Passkeys and Modern Authentication

#60

Post by tadfisher »

OJFord wrote: post #55
toomuchtodo wrote: post #32

Earlier quoted context omitted.

Passwords are a weak authentication mechanism and incur liability. MFA is good, Passkeys are better. One time passwords via email are tolerable, still better than passwords. (customer identity and access management is a component of my work at a fintech)

Your fintech is probably not among the 99% accounts GP says don't warrant 'anything fancy'. IME as a customer/user, financial institutions are some of the worst culprits for doing appalling things in the name of security (theatre) anyway.

Yes, because financial institutions are responsible for losses incurred via account takeover.
Post reply on HN