Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys and Modern Authentication

lucumr.pocoo.org

Post reply on HN
Print view View original

151–160 of 212 posts

Re: Passkeys and Modern Authentication

#151

Post by varjolintu »

unsnap_biceps wrote: post #37
bradley13 wrote: post #22

This. All of this. Passkeys are a great idea, but the walled gardens are a huge problem. Also, services placing additional requirements (e.g., attestations) that potentially violate your privacy and anonymity. Just now, at least in Europe, there is a huge push to force users to authenticate themselves with their actual identity, even for ordinary Internet services. This is happening simultaneously in many countries (…

The walls are going to come down. KeyPassX supports passkeys and allows you to export them as you wish. 1Password and Apple Passwords have both said they're going to support exporting and importing of passkeys. Yes, it's awful during the transition period while the tech matures, but there is a path towards a great future.

KeePassX is long dead, and it's not with "key" but with "kee" -> KeePassXC. Thank you :)

Re: Passkeys and Modern Authentication

#152

Post by recursive »

const_cast wrote: post #141
palata wrote: post #131

Earlier quoted context omitted.

But passwords are hell for most people: they never remember them, for some reason (I don't understand it either) they really don't want to use a password manager, and they get phished. Passkeys mean that most people can just FaceID or their fingerprint everywhere and they are happy. They are happy to be locked in if it just works. For those of us who don't want to be locked in, we still have the possibility to not be…

> Passkeys mean that most people can just FaceID or their fingerprint everywhere and they are happy. They are happy to be locked in if it just works. Yeah, because people are stupid. Heading towards a future where you need to use government-approved devices which are tied to your real identity to access the internet is a recipe for disaster.

I'm stupid. I don't think passkeys actually just work. What if I get a new phone? I don't know the answer to that. I do know how to install my password manager on a new phone. Last time I got a new phone, all my 2FA authenticator codes stopped working. I switched them all to SMS.

Re: Passkeys and Modern Authentication

#153

Post by apitman »

mgulick wrote: post #88
jazzyjackson wrote: post #12

Earlier quoted context omitted.

Given that you don't strictly need to have one passkey per site, is this desire to move passkeys around a holdover from wanting to "export" your passwords? Because if you can export them, an exploit can too. I find passkeys rather more interesting when they cannot be exported from a HSM / key enclave / yubikey, but of course I need to be able to register multiple yubikeys per site, and a few of my accounts didn't all…

My keepass database has around 400 different entries in it. If I needed to transfer to a new password manager, it's not feasible to go around to 400 different sites to register new passkeys. In case one might say the answer to that is oauth, I'm also not interested in putting my faith in Google/Microsoft/Apple being benevolent arbiters of my ability to access my accounts.

You could put your faith in LastLogin: https://lastlogin.net

Re: Passkeys and Modern Authentication

#154

Post by 15155 »

juancn wrote: post #18

Signing into my accounts on my children’s devices has turned from a straightforward process to an incredibly frustrating experience. I find myself juggling all kinds of different apps and flows. This strikes home for me, I'm the main gatekeeper of passwords and service accounts in my home. 2FA and passkeys are so annoying to juggle. My kids use prepaid numbers, once I changed one and forgot to tell Apple, when I real…

> 2FA and passkeys are so annoying to juggle.

Try 1Password Family and store your passkeys in there?

Re: Passkeys and Modern Authentication

#155

Post by hbogert »

I was totally bummed out that despite buying a industry leader's product, a yubikey; I can't use it as a passkey through NFC on android[1]. It's simply not supported, wth. How can this work as a 2FA through NFC, but not as a passkey. It's easy to get into conspiracy theory mode, but this really feels like there's mixed incentives as Google wants to push their vendored passkey implementation.

[1]: https://developers.yubico.com/Developer_Program/WebAuthn_Sta...

Re: Passkeys and Modern Authentication

#156

Post by anon7000 »

basch wrote: post #149
teekert wrote: post #103

Earlier quoted context omitted.

I’m on proton (family) and put pass on all devices (inc the kids’) so I can quickly share credentials. But still, I agree that some kind of export of private keys is sorely needed.

Ill maintain that family management of access control is one of the most broken things on the internet. Not only does 2fa make granting access on other devices a nightmare, but then each developer has its own version of parental controls. ALL of account permissions, relations to other accounts, and authentication should be an exposed api that rolls up into a single dashboard. I should be able to go into one single co…

That basically does exist, and it’s called SSO. SSO providers (eg Okta) have a unified dashboard where you can control who can access what, and at what level, and can revoke access any time. It’d be nice if there was a version of that for families that wasn’t insanely expensive.

Anyways, 1Password completely solves this problem for me with me & my wife.

Re: Passkeys and Modern Authentication

#157

Post by anon7000 »

15155 wrote: post #154
juancn wrote: post #18

Signing into my accounts on my children’s devices has turned from a straightforward process to an incredibly frustrating experience. I find myself juggling all kinds of different apps and flows. This strikes home for me, I'm the main gatekeeper of passwords and service accounts in my home. 2FA and passkeys are so annoying to juggle. My kids use prepaid numbers, once I changed one and forgot to tell Apple, when I real…

> 2FA and passkeys are so annoying to juggle. Try 1Password Family and store your passkeys in there?

Agreed, my wife even says 1Password is one of the best tech things I’ve set up just because it completely solves sharing passwords and stuff with each other.

Re: Passkeys and Modern Authentication

#158

Post by anon7000 »

ajsnigrutin wrote: post #82
juancn wrote: post #18

Signing into my accounts on my children’s devices has turned from a straightforward process to an incredibly frustrating experience. I find myself juggling all kinds of different apps and flows. This strikes home for me, I'm the main gatekeeper of passwords and service accounts in my home. 2FA and passkeys are so annoying to juggle. My kids use prepaid numbers, once I changed one and forgot to tell Apple, when I real…

Passwords + OTP (stored in keepass or somewhere) is the win for me. Everything else is a security theatre and an UX pain.

Passkeys is not security theatre, and also not a UX pain if you use a password manager. Turns out it’s nice to have a standardized API for submitting a credential to a website rather than relying on browser extensions to hopefully guess the input field is for a password. (Not to mention the multitude of sites that don’t properly handle text being autofilled)

Re: Passkeys and Modern Authentication

#159

Post by smagin »

Like the take that we need to authentificate more often nowadays. AWS makes it extreme — it resets login each 12 hours I reckon, and each time I need to click like 10 times, touch the fingerprint button 3 times (fill email, fill password, passkey), and I fail to imagine how it's not a security theater.

Re: Passkeys and Modern Authentication

#160

Post by vbezhenar »

karmarepellent wrote: post #17
vbezhenar wrote: post #14

Earlier quoted context omitted.

ssh is terribly insecure with no way of checking server certificate fingerprint automatically. Web solved it decades ago with CA.

This is incorrect. SSH certificates work just like x509 certificates in that regard. Also, with PubkeyAuthentication, there exist all kinds of ways to collect host keys before connecting to them for the first time and thus avoiding the trust-on-first-use problem. Especially in private networks where you control all the nodes.

When I connect to github using ssh, I must google github page with ssh fingerprint and verify it by hand. Imagine how many people actually do that, instead of blindly accepting the key.

If github can't make it right, nobody can.

Post reply on HN