Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys and Modern Authentication

lucumr.pocoo.org

Post reply on HN
Print view View original

71–80 of 212 posts

Re: Passkeys and Modern Authentication

#71

Post by tptacek »

AlexandrB wrote: post #52
tptacek wrote: post #38

Earlier quoted context omitted.

But better than username/password + TOTP, and username/password + WebAuthn had really low uptake.

Username/password + TOTP is still better than username/password + one time email, no? Especially since the latter creates additional dependencies/risks for the user in the form of an email account.

They're about the same. The important factor is phishing resistance (neither TOTP nor email links have that), and an account that has lost its primary email account is 99% of the time already boned. I would use TOTP in preference to email backup, but that's mostly an affectation.

The reality is that TOTP has been obsolete for awhile now. It's a net negative for ordinary users that is kept front-of-mind for everyone because nerds like us are attached to it.

Re: Passkeys and Modern Authentication

#72

Post by AlotOfReading »

tadfisher wrote: post #65
AlotOfReading wrote: post #48

Earlier quoted context omitted.

The website already has guarantees against phishing because those are enforced by the managers. What's prevented is the snooping case of taking an export and cloning it without the exporting manager being involved. This is essentially indistinguishable from many legitimate use cases like archival or access to deceased relatives' credentials, which users might want regardless of the website's preferences.

> The website already has guarantees against phishing because those are enforced by the managers. There is no such guarantee if credential-stealing malware can export your private key material in plaintext!

If the malware can orchestrate the managers, why wouldn't they simply use that power to orchestrate the offline export as they were going to do anyway? The RP ID makes the process a bit noisy, but it doesn't seem to change the fundamental vulnerability for the credential owner.

Re: Passkeys and Modern Authentication

#73

Post by adiabatichottub »

alphazard wrote: post #68
adiabatichottub wrote: post #59

Earlier quoted context omitted.

@alphazard, what are your thoughts on using self-signed X.509 certs, since 95% of the infrastructure is already there?

I'm opposed to using certs where public keys will do. Certificates especially X.509 are more complicated than the public keys that they reference. They include things like domain names, serial numbers, version numbers, etc. The complexity of X.509 belongs in the domain name system. If a bunch of large corporations want to come up with complicated formats so they can decide who gets to call themselves what on the inte…

Yes, I agree much of the added complexity isn't necessary, but since TLS is a common and widely used protocol for just about everything other than SSH, it seems like it would be easier to plug in.

Edit: or put another way, why should I have to load another library for PKA when I already have one that works just fine?

Re: Passkeys and Modern Authentication

#74

Post by ezfe »

skybrian wrote: post #50
ezfe wrote: post #4

The Passwords app in macOS 26 and iOS 26 support exporting passkeys to other password managers.

It’s been announced but there’s no release date yet, in case anyone is wondering why they don’t have it.

The export/import function is present in the public beta

Re: Passkeys and Modern Authentication

#75

Post by dmfdmf »

I think that now that IPV6 has 2^128 addresses that some of these can be assigned to individuals as a unique ID, maybe at birth like SSN. It could serve as the base of a public key and secret private key blockchain system controlled by the individual or his trusted agent in some kind of identifier/authenticator system. If properly implemented it could serve as an anonymous ID and age verification system on the internet which seems to be coming soon in a not-so anonymous form to a fascist, commie or authoritarian govt near you, i.e. all of them as current events now show.

I don't know if that would work but it is an interesting idea to me. However, it also illustrates that authentication and protecting user identity on the web without sacrificing anonymity is a _political_ problem not a technical problem. I have always been told that when thinking about security you have to define what threat are you trying to protect yourself from. I see discussions on security and virtually all of them ignore that the govt or govt controlled corps (i.e. fascism) is a much bigger threat to individuals and freedom than so called "hackers" or "terrorists" and other boogie men, etc.

Re: Passkeys and Modern Authentication

#76

Post by palata »

alphazard wrote: post #6

Unfortunately the tech community is full of people who pride themselves on being aware of and advocating for the latest standard put out by whatever company. That's how we end up with lots of complicated nonsense like most of what is sent in HTTP headers, or the contents of a TLS certificate. On the topic of authentication, it's solved. SSH nailed it, any further complexity is strictly worse . Signing up is uploading…

> On the topic of authentication, it's solved. SSH nailed it, any further complexity is strictly worse.

Ever tried to SSH with a security key... through FIDO2? Or would you say that having your private key as a file on your computer is strictly better than having it in a security key? :-)

Re: Passkeys and Modern Authentication

#77

Post by palata »

yomismoaqui wrote: post #11
alphazard wrote: post #6

Unfortunately the tech community is full of people who pride themselves on being aware of and advocating for the latest standard put out by whatever company. That's how we end up with lots of complicated nonsense like most of what is sent in HTTP headers, or the contents of a TLS certificate. On the topic of authentication, it's solved. SSH nailed it, any further complexity is strictly worse . Signing up is uploading…

All developers pass this magpie phase [1] and as you get older you start to see new things more critically. I guess a desirable trait of seniority is to balance the urge to play with new toys vs the feeling that sometimes we are running in circles, repeating the same mistakes with different tech. [1]: https://blog.codinghorror.com/the-magpie-developer/

Are you trying to say that security keys are not a good thing? I love security keys, that's my one example of a good technology.

Re: Passkeys and Modern Authentication

#79

Post by shmerl »

> One slightly more concerning issue today is that there is effectively no way to export private keys between authentication password managers

Not being able to use the passkey manager at all is a bigger concern. For example Keepassxc works with some sites but not with others. It's super annoying and way worse than situation with passwords.

Re: Passkeys and Modern Authentication

#80

Post by akazantsev »

unsnap_biceps wrote: post #37
bradley13 wrote: post #22

This. All of this. Passkeys are a great idea, but the walled gardens are a huge problem. Also, services placing additional requirements (e.g., attestations) that potentially violate your privacy and anonymity. Just now, at least in Europe, there is a huge push to force users to authenticate themselves with their actual identity, even for ordinary Internet services. This is happening simultaneously in many countries (…

The walls are going to come down. KeyPassX supports passkeys and allows you to export them as you wish. 1Password and Apple Passwords have both said they're going to support exporting and importing of passkeys. Yes, it's awful during the transition period while the tech matures, but there is a path towards a great future.

> KeyPassX supports passkeys and allows you to export them as you wish.

The last time I tried to use passkeys, the desktop was easy. What about mobile? There wasn't a local third-party password manager that could work with passkeys on Android.

Post reply on HN