Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys and Modern Authentication

lucumr.pocoo.org

Post reply on HN
Print view View original

101–110 of 212 posts

Re: Passkeys and Modern Authentication

#101

Post by palata »

karmarepellent wrote: post #17
vbezhenar wrote: post #14

Earlier quoted context omitted.

ssh is terribly insecure with no way of checking server certificate fingerprint automatically. Web solved it decades ago with CA.

This is incorrect. SSH certificates work just like x509 certificates in that regard. Also, with PubkeyAuthentication, there exist all kinds of ways to collect host keys before connecting to them for the first time and thus avoiding the trust-on-first-use problem. Especially in private networks where you control all the nodes.

SSH does have certificates, but in practice most people using SSH don't use SSH certificates and don't check the fingerprints.

Not sure if we can say it's solved if nobody wants to use it by choice (certificates are probably mostly used in enterprise setups, but in my experience it's not even that common there).

Re: Passkeys and Modern Authentication

#102

Post by palata »

AlexandrB wrote: post #64
habinero wrote: post #49

Earlier quoted context omitted.

Yes, it's called phishing.

Phishing is different (from the user's POV) than exporting a password and "giving it away". I don't see how phishing would be applicable to passkey exports.

> Phishing is different

Nope, it's exactly that: tricking people into believing that they are exporting their passkey securely where actually they are sharing it with the attacker.

> I don't see how phishing would be applicable to passkey exports.

Phishing is applicable to everything humans can do: if you can ask a human to do it, you can phish a human to do it.

Re: Passkeys and Modern Authentication

#103

Post by teekert »

juancn wrote: post #18

Signing into my accounts on my children’s devices has turned from a straightforward process to an incredibly frustrating experience. I find myself juggling all kinds of different apps and flows. This strikes home for me, I'm the main gatekeeper of passwords and service accounts in my home. 2FA and passkeys are so annoying to juggle. My kids use prepaid numbers, once I changed one and forgot to tell Apple, when I real…

I’m on proton (family) and put pass on all devices (inc the kids’) so I can quickly share credentials. But still, I agree that some kind of export of private keys is sorely needed.

Re: Passkeys and Modern Authentication

#104

Post by palata »

hooverd wrote: post #84
AnotherGoodName wrote: post #3

> there is effectively no way to export private keys between authentication password managers No exporting really is a feature. Otherwise people would be tricked into giving away passkeys much like they are with passwords today. You can always register multiple passkeys with providers though. Already have a passkey with google but want another one via a different password/account manager? Just go into settings on goo…

Effectively ceding control of your online identity is a feature? Would you be willing to bet real money that the passkey attestation feature will never be abused be these same companies ?

How is that effectively ceding control of your online identity?

You can buy a security key (that does not have your name on it), have it generate a FIDO2 key and use it as a passkey. You can have 100 Yubikeys for 100 different websites if you want.

But you can't ever export the private key from the Yubikey, and that's a feature. That's the whole point of the Yubikey.

Re: Passkeys and Modern Authentication

#105

Post by palata »

AlexandrB wrote: post #66
jazzyjackson wrote: post #16

Earlier quoted context omitted.

Just made the same comment, weird that its an unpopular opinion. Chalk it up to a UX issue around user expectations.

It's not just that. There's a huge lack of trust with the tech industry. I don't think anyone trusts tech companies to act in the user's best interests with this kind of restriction instead of using it to drive more platform or service lock-in.

I get the lack of trust with TooBigTech, but I personally use passkeys with security keys (Yubikeys). WebAuthn is just a bunch of protocols that can run independently from TooBigTech.

Re: Passkeys and Modern Authentication

#106

Post by tptacek »

jrochkind1 wrote: post #85
tptacek wrote: post #71

Earlier quoted context omitted.

They're about the same. The important factor is phishing resistance (neither TOTP nor email links have that), and an account that has lost its primary email account is 99% of the time already boned. I would use TOTP in preference to email backup, but that's mostly an affectation. The reality is that TOTP has been obsolete for awhile now. It's a net negative for ordinary users that is kept front-of-mind for everyone b…

This is actually the first I've heard of this, re considering TOTP to be not worthwhile. Can you recommend some links to material for me to read to get up to speed with the argument?

Basically everything ever written about U2F, WebAuthn, and phishing-proof authentication generally is about the weaknesses of TOTP. The principle component of the problem is phishing.

Re: Passkeys and Modern Authentication

#107

Post by adiabatichottub »

lixtra wrote: post #95
adiabatichottub wrote: post #34

Earlier quoted context omitted.

It makes sense to keep printed backups of certain keys and passwords in a physically secure location, accessible to the people you trust in case of an emergency.

You might even split them so that k out of n trusted people are needed to restore them. For example https://shamir.securitytools.io/

Yes, I think that's a good idea for high-value secrets. In a family situation it would be a great way to limit elder abuse (unless all your children hate you).

Re: Passkeys and Modern Authentication

#108

Post by palata »

AnotherGoodName wrote: post #3

> there is effectively no way to export private keys between authentication password managers No exporting really is a feature. Otherwise people would be tricked into giving away passkeys much like they are with passwords today. You can always register multiple passkeys with providers though. Already have a passkey with google but want another one via a different password/account manager? Just go into settings on goo…

I don't get the downvotes here.

I feel like people mix up the protocols and the implementations. Because one can share their passkeys with a Google password manager does not mean that they have to. Passkeys are just WebAuthn, which works on its own.

Since I'm getting downvoted as well: I am using passkeys with Yubikeys, without depending on any TooBigTech.

Re: Passkeys and Modern Authentication

#109

Post by arccy »

dan-robertson wrote: post #29

What do security professionals think about passkeys? In particular, those who were not involved in designing them. Lots of the arguments in this article feel very much like the sort of thing one would expect from someone into open source (not saying they are wrong, and I think they are well explained here) but I feel they will inevitably be the product of different concerns than those a security practitioner might ha…

Pretty much everyone likes them? Nobody likes passwords, especially passwords by users. Passkeys essentially force the users to have some sort of password manager, whether third party, or OS / browser integrated. Plus they're unphishable in normal use.

They're technically weaker than password + hardware key but stronger than anything else, including password + totp. Google Advanced Protection still wants you to have a hardware key for your account.

Re: Passkeys and Modern Authentication

#110

Post by palata »

alphazard wrote: post #42
tadfisher wrote: post #35

Earlier quoted context omitted.

You are describing passkeys. All of this applies to the passkey scheme. Actually, a benefit of passkeys is the standardization of client-side cross-device authz operations via caBLE and similar; your secret keys never leave your primary device, but are usable from other devices over a variety of transports.

> All of this applies to the passkey scheme. It also applies to SSH keys. I never said that passkeys couldn't do everything SSH keys can do. My criticism is that they are more complicated to do the same thing. This is exactly what not valuing simplicity looks like.

A passkey uses FIDO2, which asks you to sign a challenge. If you use OpenSSH with a security key, it will... use FIDO2. If you use OpenSSH with a private key on your computer, you also sign a challenge, right? So it's not less complicated.

WebAuthn just adds a few things like the relying party and a counter (that nobody seems to use). And the relying party helps preventing phishing, which SSH doesn't do really well in practice (most people don't use SSH certificates and don't check the server fingerprints).

So it's just not true that passkeys are more complicated to do the same thing.

Post reply on HN