Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys and Modern Authentication

lucumr.pocoo.org

Post reply on HN
Print view View original

161–170 of 212 posts

Re: Passkeys and Modern Authentication

#161

Post by palata »

const_cast wrote: post #141
palata wrote: post #131

Earlier quoted context omitted.

But passwords are hell for most people: they never remember them, for some reason (I don't understand it either) they really don't want to use a password manager, and they get phished. Passkeys mean that most people can just FaceID or their fingerprint everywhere and they are happy. They are happy to be locked in if it just works. For those of us who don't want to be locked in, we still have the possibility to not be…

> Passkeys mean that most people can just FaceID or their fingerprint everywhere and they are happy. They are happy to be locked in if it just works. Yeah, because people are stupid. Heading towards a future where you need to use government-approved devices which are tied to your real identity to access the internet is a recipe for disaster.

> Heading towards a future where you need to use government-approved devices which are tied to your real identity to access the internet is a recipe for disaster.

That's unrelated to passkeys. When you use your credit card to pay online, it's tied to your real identity. Many countries offered to do a lot of official stuff online (like taxes) long before passkeys.

Re: Passkeys and Modern Authentication

#162

Post by palata »

tuckerman wrote: post #140
palata wrote: post #132

Earlier quoted context omitted.

Where is the threat to blacklist? I missed that so I lack context.

My reading of the the linked github thread is: 1) A member of the FIDO alliance says that provider attestation is bad because relying parties could block specific providers 2) This FIDO alliance member doesn't like that keypassxc has implemented a feature for their users that weighs user freedom/security different than they would prefer and 3) they insinuate that if keypassxc doesn't change this, they could decide to…

> But I think users have the right to build/use software that works how they see fit.

They have, I don't think anyone denies that. But the other side has the right to refuse working with them if they find them insecure.

I don't think it is limited to passkeys... I have always been forced to use the authentication chosen by the IT at work, it's not like I can come and say "You know what? Instead of your SSO coupled with your second factor app, I would like to use my own password manager with email and password".

Re: Passkeys and Modern Authentication

#163

Post by palata »

tptacek wrote: post #138
palata wrote: post #135

Earlier quoted context omitted.

I think it's the case in big companies. But most companies are not big :-), which means that a lot of people are using SSH without ever checking the fingerprint. That would be my intuition.

SSH has always relied on key continuity for this problem; you're exposed when you're first introduced to a host (on a particular client) but then fine from that point on. This of course breaks down with cattle fleets where ~most logins are to hosts you've never hit before, which is why cattle fleets tend to use SSH PKI.

Over the years I have seen - repeatedly - colleagues just removing ~/.ssh/known_hosts when SSH showed the warning that says something like "YOU MAY HAVE BEEN HACKED!!!".

I think passkeys resolve that, even though it's more of a human issue than a technical issue :-).

Re: Passkeys and Modern Authentication

#164

Post by palata »

dandanua wrote: post #143
palata wrote: post #100

Earlier quoted context omitted.

And it's just not true: ever wondered what those fingerprints are that nobody cares about and blindly goes for "yes" in SSH? The vast majority of SSH users would have no idea if they got MitM-ed. WebAuthn helps prevent just that.

WebAuthn won't help you if you are signing-up on a phishing site.

Well if you sign up on a phishing site, they won't be able to access the legit site with your credentials...

Re: Passkeys and Modern Authentication

#165

Post by palata »

1oooqooq wrote: post #147
bradley13 wrote: post #22

This. All of this. Passkeys are a great idea, but the walled gardens are a huge problem. Also, services placing additional requirements (e.g., attestations) that potentially violate your privacy and anonymity. Just now, at least in Europe, there is a huge push to force users to authenticate themselves with their actual identity, even for ordinary Internet services. This is happening simultaneously in many countries (…

you're spot on. everyone here "keepassX works for me" are just frogs being slow boiled. passkey are designed in a ways that the attestation party is visible. Tomorrow the coordinated effort will say "too much fraud from providers other than google and apple, sorry" (or something about protecting kids).

> passkey are designed in a ways that the attestation party is visible

Are you talking about the relying party? I don't think it works the way you describe...

Re: Passkeys and Modern Authentication

#166

Post by palata »

tuckerman wrote: post #122
AndrewDucker wrote: post #96

Earlier quoted context omitted.

Because many end users will ignore that. And this technology is set up to prevent end users from hurting themselves, even if that constrains technologically capable ones.

My values are such that it’s inappropriate for a few folks at companies and random consortiums to make that decision on behalf of all society. If KeepassXC wanted to enforce that world view for the safety of their users, it’s their right, but this is essentially a threat of blacklisting an entire password manager for adding a feature demanded by their users (who likely predominantly used by technically savvy users at…

> but this is essentially a threat of blacklisting an entire password manager

I don't think they could blacklist the entire password manager. They can't prevent it from giving you a username/password...

Refusing some passkeys is, to me, similar to refusing passwords that are too short. It may make sense to only accept passkeys backed by a secure element. Companies already force their employees to use a specific MFA app, because they don't want to trust any app out there.

Re: Passkeys and Modern Authentication

#167

Post by palata »

8cvor6j844qw_d6 wrote: post #142

Personally I like the idea of passkeys. However, it needs some sort of easy to export like 2FA seeds, or even BIP39 that some cryptocurrency wallets uses. The seemingly non-transparent (or was there none?) way to backup to a cold storage (e.g., printed and locked in a physical safe) turns me off. --- > lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have prev…

> Personally I like the idea of passkeys. However, it needs some sort of easy to export

Some passkey implementations can be exported (synced), some can't. By design. E.g. I don't want my Yubikeys to export the private keys, ever.

Re: Passkeys and Modern Authentication

#168

Post by raxxorraxor »

Passkeys are worthless if you cannot create a backup. This poses as a blatant risk to security that is often neglected to be mentioned. I guess this is purely due to attestation ambitions of companies.

So, yes, username + password or more generally a secret known only to you is superior.

Re: Passkeys and Modern Authentication

#169

Post by raxxorraxor »

anon7000 wrote: post #158
ajsnigrutin wrote: post #82

Earlier quoted context omitted.

Passwords + OTP (stored in keepass or somewhere) is the win for me. Everything else is a security theatre and an UX pain.

Passkeys is not security theatre, and also not a UX pain if you use a password manager. Turns out it’s nice to have a standardized API for submitting a credential to a website rather than relying on browser extensions to hopefully guess the input field is for a password. (Not to mention the multitude of sites that don’t properly handle text being autofilled)

Not theatre, passkeys are a security risk if you need a specific device to access your information and there is no way to extract a passkey.

Re: Passkeys and Modern Authentication

#170

Post by raxxorraxor »

unsnap_biceps wrote: post #37
bradley13 wrote: post #22

This. All of this. Passkeys are a great idea, but the walled gardens are a huge problem. Also, services placing additional requirements (e.g., attestations) that potentially violate your privacy and anonymity. Just now, at least in Europe, there is a huge push to force users to authenticate themselves with their actual identity, even for ordinary Internet services. This is happening simultaneously in many countries (…

The walls are going to come down. KeyPassX supports passkeys and allows you to export them as you wish. 1Password and Apple Passwords have both said they're going to support exporting and importing of passkeys. Yes, it's awful during the transition period while the tech matures, but there is a path towards a great future.

The "tech" of passkeys is trivial in context of authentication. You could argue that it is a UX issue. But I think you cut large companies, that have the ability to develop sensible UX a thousand times over, too much slack for a shitty product.
Post reply on HN