Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys and Modern Authentication

lucumr.pocoo.org

Post reply on HN
Print view View original

81–90 of 212 posts

Re: Passkeys and Modern Authentication

#81

Post by arp242 »

jcmontx wrote: post #70
cuu508 wrote: post #61

Earlier quoted context omitted.

Are there many sites that only support Authy's push authentication and nothing else?

No, not really, it's about migrating/restoring every single 2FA key would be extremely inconvenient

TOTP should just be a (typically base32) secret string; I don't know if Authy allows exporting that though (and if not, that only underscores the point of this article).

I just use a simple shell script with dmenu/xclip/oathtool:

  #!/bin/zsh

  typeset -A opt=(
      Docker ABC
      GitHub DEF
      # ...
  )
  k=$(print -l ${(ko)opt} | dmenu -i)
  [[ $k != "" ]] && oathtool --totp --base32 $opt[$k] | xclip -rmlastnl

Re: Passkeys and Modern Authentication

#82

Post by ajsnigrutin »

juancn wrote: post #18

Signing into my accounts on my children’s devices has turned from a straightforward process to an incredibly frustrating experience. I find myself juggling all kinds of different apps and flows. This strikes home for me, I'm the main gatekeeper of passwords and service accounts in my home. 2FA and passkeys are so annoying to juggle. My kids use prepaid numbers, once I changed one and forgot to tell Apple, when I real…

Passwords + OTP (stored in keepass or somewhere) is the win for me.

Everything else is a security theatre and an UX pain.

Re: Passkeys and Modern Authentication

#83

Post by turtlebits »

alphazard wrote: post #6

Unfortunately the tech community is full of people who pride themselves on being aware of and advocating for the latest standard put out by whatever company. That's how we end up with lots of complicated nonsense like most of what is sent in HTTP headers, or the contents of a TLS certificate. On the topic of authentication, it's solved. SSH nailed it, any further complexity is strictly worse . Signing up is uploading…

"Solved" doesn't mean anything unless you have implementation/adoption.

Re: Passkeys and Modern Authentication

#84

Post by hooverd »

AnotherGoodName wrote: post #3

> there is effectively no way to export private keys between authentication password managers No exporting really is a feature. Otherwise people would be tricked into giving away passkeys much like they are with passwords today. You can always register multiple passkeys with providers though. Already have a passkey with google but want another one via a different password/account manager? Just go into settings on goo…

Effectively ceding control of your online identity is a feature? Would you be willing to bet real money that the passkey attestation feature will never be abused be these same companies ?

Re: Passkeys and Modern Authentication

#85

Post by jrochkind1 »

tptacek wrote: post #71
AlexandrB wrote: post #52

Earlier quoted context omitted.

Username/password + TOTP is still better than username/password + one time email, no? Especially since the latter creates additional dependencies/risks for the user in the form of an email account.

They're about the same. The important factor is phishing resistance (neither TOTP nor email links have that), and an account that has lost its primary email account is 99% of the time already boned. I would use TOTP in preference to email backup, but that's mostly an affectation. The reality is that TOTP has been obsolete for awhile now. It's a net negative for ordinary users that is kept front-of-mind for everyone b…

This is actually the first I've heard of this, re considering TOTP to be not worthwhile. Can you recommend some links to material for me to read to get up to speed with the argument?

Re: Passkeys and Modern Authentication

#86

Post by [deleted] »

tptacek wrote: post #43
dan-robertson wrote: post #29

What do security professionals think about passkeys? In particular, those who were not involved in designing them. Lots of the arguments in this article feel very much like the sort of thing one would expect from someone into open source (not saying they are wrong, and I think they are well explained here) but I feel they will inevitably be the product of different concerns than those a security practitioner might ha…

Security people are generally pretty positive on Passkeys. Eliminating passwords has been the white whale of information security for over 3 decades. Practitioners are generally positive about FIDO2 (Yubikeys are fetish objects for them). I think message board people would probably be surprised at security practitioner attitudes towards Apple and Google authentication lock-in (locking my team into Google authenticati…

[deleted]

Re: Passkeys and Modern Authentication

#88

Post by mgulick »

jazzyjackson wrote: post #12
seany wrote: post #7

Exporting passkeys is the single required feature for me to start using them more. The "anti phishing" push has really gotten a little too crazy. It seems mostly related to our legal inability to push security responsibility onto consumers.

Given that you don't strictly need to have one passkey per site, is this desire to move passkeys around a holdover from wanting to "export" your passwords? Because if you can export them, an exploit can too. I find passkeys rather more interesting when they cannot be exported from a HSM / key enclave / yubikey, but of course I need to be able to register multiple yubikeys per site, and a few of my accounts didn't all…

My keepass database has around 400 different entries in it. If I needed to transfer to a new password manager, it's not feasible to go around to 400 different sites to register new passkeys. In case one might say the answer to that is oauth, I'm also not interested in putting my faith in Google/Microsoft/Apple being benevolent arbiters of my ability to access my accounts.

Re: Passkeys and Modern Authentication

#89

Post by DavideNL »

unsnap_biceps wrote: post #37
bradley13 wrote: post #22

This. All of this. Passkeys are a great idea, but the walled gardens are a huge problem. Also, services placing additional requirements (e.g., attestations) that potentially violate your privacy and anonymity. Just now, at least in Europe, there is a huge push to force users to authenticate themselves with their actual identity, even for ordinary Internet services. This is happening simultaneously in many countries (…

The walls are going to come down. KeyPassX supports passkeys and allows you to export them as you wish. 1Password and Apple Passwords have both said they're going to support exporting and importing of passkeys. Yes, it's awful during the transition period while the tech matures, but there is a path towards a great future.

…and do you think we can trust Big Tech on their promises, based on their reputation / recent news events?

Re: Passkeys and Modern Authentication

#90

Post by lurking_swe »

akazantsev wrote: post #80
unsnap_biceps wrote: post #37

Earlier quoted context omitted.

The walls are going to come down. KeyPassX supports passkeys and allows you to export them as you wish. 1Password and Apple Passwords have both said they're going to support exporting and importing of passkeys. Yes, it's awful during the transition period while the tech matures, but there is a path towards a great future.

> KeyPassX supports passkeys and allows you to export them as you wish. The last time I tried to use passkeys, the desktop was easy. What about mobile? There wasn't a local third-party password manager that could work with passkeys on Android.

> There wasn't a local third-party password manager that could work with passkeys on Android.

sounds like you found yourself a market opportunity…

Post reply on HN