Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys and Modern Authentication

lucumr.pocoo.org

Post reply on HN
Print view View original

141–150 of 212 posts

Re: Passkeys and Modern Authentication

#141

Post by const_cast »

palata wrote: post #131
recursive wrote: post #115

Earlier quoted context omitted.

It's hard for more people to verify whether this is actually independent from big tech. With a password, you can write it on a piece of paper. You can then type it back in. If any character doesn't match, it doesn't work. This seems like a trustworthy demonstration that it is actually independent. Passkeys have too much magic to understand in this way.

But passwords are hell for most people: they never remember them, for some reason (I don't understand it either) they really don't want to use a password manager, and they get phished. Passkeys mean that most people can just FaceID or their fingerprint everywhere and they are happy. They are happy to be locked in if it just works. For those of us who don't want to be locked in, we still have the possibility to not be…

> Passkeys mean that most people can just FaceID or their fingerprint everywhere and they are happy. They are happy to be locked in if it just works.

Yeah, because people are stupid.

Heading towards a future where you need to use government-approved devices which are tied to your real identity to access the internet is a recipe for disaster.

Re: Passkeys and Modern Authentication

#142

Post by 8cvor6j844qw_d6 »

Personally I like the idea of passkeys. However, it needs some sort of easy to export like 2FA seeds, or even BIP39 that some cryptocurrency wallets uses.

The seemingly non-transparent (or was there none?) way to backup to a cold storage (e.g., printed and locked in a physical safe) turns me off.

---

> lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations). [1]

There is a possibility websites will only allow approved password managers to create/interact with passkeys with attestation, something that is not a problem with the common TOTP + Password or other authentication methods.

Attestation (perhaps targeted for enterprise usage?) but should be a separate spec/extension or something.

[1]: https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

Re: Passkeys and Modern Authentication

#143

Post by dandanua »

palata wrote: post #100
turtlebits wrote: post #83

Earlier quoted context omitted.

"Solved" doesn't mean anything unless you have implementation/adoption.

And it's just not true: ever wondered what those fingerprints are that nobody cares about and blindly goes for "yes" in SSH? The vast majority of SSH users would have no idea if they got MitM-ed. WebAuthn helps prevent just that.

WebAuthn won't help you if you are signing-up on a phishing site.

Re: Passkeys and Modern Authentication

#144

Post by 1oooqooq »

xeonmc wrote: post #123
ajsnigrutin wrote: post #82

Earlier quoted context omitted.

Passwords + OTP (stored in keepass or somewhere) is the win for me. Everything else is a security theatre and an UX pain.

I use my OTP secret as my account password, best of both worlds for portability!

that's so insanely unexpected it might actually be secure

Re: Passkeys and Modern Authentication

#145

Post by tadfisher »

Nextgrid wrote: post #117
tadfisher wrote: post #25

Earlier quoted context omitted.

Amazing, just like passkeys!

Biggest difference is that SSH keys allow you to store and submit the public key without the private key being present. With passkeys, the private key must be present and usable (at least with current implementations) at the time of enrolment. This raises a major problem: with SSH keys you can keep an backup key in a secure location (bank vault, etc) and still be able to register it. With passkeys your backup key mus…

With SSH, "registering" your key on a server means having out-of-band access to copy your public key. There is no such facility if you're registering a never-before-seen user with a new key, so it makes a whole heap of sense to ensure that the credential you're registering has a working private key that exists.

Re: Passkeys and Modern Authentication

#146

Post by 1oooqooq »

toomuchtodo wrote: post #32
juancn wrote: post #18

Signing into my accounts on my children’s devices has turned from a straightforward process to an incredibly frustrating experience. I find myself juggling all kinds of different apps and flows. This strikes home for me, I'm the main gatekeeper of passwords and service accounts in my home. 2FA and passkeys are so annoying to juggle. My kids use prepaid numbers, once I changed one and forgot to tell Apple, when I real…

Passwords are a weak authentication mechanism and incur liability. MFA is good, Passkeys are better. One time passwords via email are tolerable, still better than passwords. (customer identity and access management is a component of my work at a fintech)

let me guess, until last years you had deployed a java applet keypad for users to log in? and today every time I can your recording offer to enroll in voice print?

yeah i will not be taking advice from the majority of people in Fintech on this topic. thank you.

Re: Passkeys and Modern Authentication

#147

Post by 1oooqooq »

bradley13 wrote: post #22

This. All of this. Passkeys are a great idea, but the walled gardens are a huge problem. Also, services placing additional requirements (e.g., attestations) that potentially violate your privacy and anonymity. Just now, at least in Europe, there is a huge push to force users to authenticate themselves with their actual identity, even for ordinary Internet services. This is happening simultaneously in many countries (…

you're spot on. everyone here "keepassX works for me" are just frogs being slow boiled.

passkey are designed in a ways that the attestation party is visible. Tomorrow the coordinated effort will say "too much fraud from providers other than google and apple, sorry" (or something about protecting kids).

Re: Passkeys and Modern Authentication

#148

Post by apitman »

> This is the mechanism by which the Austrian government, for instance, prevents you from using an Open Source or any other software-based authenticator to sign in to do your taxes, access medical records or do anything else that is protected by eID. Instead you have to buy a whitelisted hardware token.

When the time comes to support passkeys on my services, I think I might use attestation in the other direction, ie only offer passkeys to users if I detect they are using a cross-platform password manager like Bitwarden or 1Password. There are simply too many moving pieces (including ad-hoc Bluetooth connections!) to guarantee a good UX when trying to move between the big tech implementations.

Re: Passkeys and Modern Authentication

#149

Post by basch »

teekert wrote: post #103
juancn wrote: post #18

Signing into my accounts on my children’s devices has turned from a straightforward process to an incredibly frustrating experience. I find myself juggling all kinds of different apps and flows. This strikes home for me, I'm the main gatekeeper of passwords and service accounts in my home. 2FA and passkeys are so annoying to juggle. My kids use prepaid numbers, once I changed one and forgot to tell Apple, when I real…

I’m on proton (family) and put pass on all devices (inc the kids’) so I can quickly share credentials. But still, I agree that some kind of export of private keys is sorely needed.

Ill maintain that family management of access control is one of the most broken things on the internet. Not only does 2fa make granting access on other devices a nightmare, but then each developer has its own version of parental controls.

ALL of account permissions, relations to other accounts, and authentication should be an exposed api that rolls up into a single dashboard. I should be able to go into one single control panel to control exactly what accounts are allowed to do what on what devices for all services for all family members. That includes lockouts, auth resets, push of auth to a device I dont have physical access to (kid is on a trip, I need to sign him into something).

I could go on and on and on about all the different ways this paradigm is so broken, it actually breaks our imagination of what it should look like in a functioning world. We are so used to doing it completely wrong, its hard to see right.

Re: Passkeys and Modern Authentication

#150

Post by loughnane »

I created my first passkey today using bitwarden. After digging around I saw I'm not able to see the keys (ie like I can in ~/.ssh).

I won't do it anymore until I have some way to see them, otherwise I'm essentially locked in, no?

Post reply on HN