I honestly have no understanding of why people thought passkeys really improved anything... Why would I want to give a massive tech company the ability to usurp ALL of my accounts under the guise of being "more secure".
Passkeys and Modern Authentication
201–210 of 212 posts
Re: Passkeys and Modern Authentication
#202Unfortunately the tech community is full of people who pride themselves on being aware of and advocating for the latest standard put out by whatever company. That's how we end up with lots of complicated nonsense like most of what is sent in HTTP headers, or the contents of a TLS certificate. On the topic of authentication, it's solved. SSH nailed it, any further complexity is strictly worse . Signing up is uploading…
> On the topic of authentication, it's solved. SSH nailed it, any further complexity is strictly worse. Ever tried to SSH with a security key... through FIDO2? Or would you say that having your private key as a file on your computer is strictly better than having it in a security key? :-)
I use this very setup, it works great. Yubikey has supported resident keys for a while.
Re: Passkeys and Modern Authentication
#203Earlier quoted context omitted.
Niеther an ssh MITM can use your private key on a legit server. A middleman doesn't need it in most cases, however. My point was that the situation with ssh is basically the same as with webauthn.
> Niеther an ssh MITM can use your private key on a legit server Of course they can: that's precisely the meaning of MITM. They don't get direct access to your private key (because they wouldn't need to stay in the middle anymore at that point), but they will ask you to sign the challenge sent by the legit server, which you will happily do if you don't realise that you are not talking to the legit server. WebAuthn pr…
I guess you're saying that a challenge is tightly packed with a server ID and processed by the webauthn client lib, so a middleman cannot separate and forward the same challenge from its own server. I don't know the exact details of the ssh protocol, but I see no reason why ssh can't do the same.
If we are simply talking about ssh users ignoring fingerprint warnings then I don't see how this is an ssh weakness. A fingerprint change warning is basically saying "you're connecting to a phishing site" as I see it.
Re: Passkeys and Modern Authentication
#204Earlier quoted context omitted.
> We could live in a world where services are inaccessible unless you use Google/Apple/1Password/etc as your password manager If services want to force you to use whatever authentication they want, they can. That's what already happens with any service that is serious about security. In big companies, you have to use their authenticator app, their mail client, their messaging system, etc. Often it's Microsoft softwar…
I don’t think we should create standards that make it easier for companies to erode user freedoms and I’d support legislation to restrict what certain companies can/can’t do (banks, Google/Apple, etc) The discussion about what happens in big companies is completely unrelated to this discussion. In that case the company is the user. They can do/enforce whatever they want and nobody is having any freedoms infringed.
> The discussion about what happens in big companies is completely unrelated to this discussion
It's not, in that they have plenty of technological solutions to address their security concerns. Passkeys don't make it easier.
> I don’t think we should create standards that make it easier for companies to erode user freedoms
We want some degree of security in many services (typically our bank). And we generally can't have it all. Security is a compromise.
Re: Passkeys and Modern Authentication
#205Earlier quoted context omitted.
> Niеther an ssh MITM can use your private key on a legit server Of course they can: that's precisely the meaning of MITM. They don't get direct access to your private key (because they wouldn't need to stay in the middle anymore at that point), but they will ask you to sign the challenge sent by the legit server, which you will happily do if you don't realise that you are not talking to the legit server. WebAuthn pr…
I guess you're saying that a challenge is tightly packed with a server ID and processed by the webauthn client lib, so a middleman cannot separate and forward the same challenge from its own server. I don't know the exact details of the ssh protocol, but I see no reason why ssh can't do the same. If we are simply talking about ssh users ignoring fingerprint warnings then I don't see how this is an ssh weakness. A fin…
> If we are simply talking about ssh users ignoring fingerprint warnings then I don't see how this is an ssh weakness.
I didn't say it was an SSH weakness. I said that it was not "solved" problem in that most users I have seen completely ignore those warnings from SSH. So the problem persists even though SSH does it right.
With WebAuthn, the problem disappears. So that's an improvement for the users.
Don't get me wrong: I love SSH. I just think it's wrong to say that WebAuthn doesn't bring any kind of security to users.
Re: Passkeys and Modern Authentication
#206Earlier quoted context omitted.
Work IT is different from services being offered to the public, though.
The difference is the security requirements. Services that are fine today with you using just a username+password won't care at all if you use a passkey that is considered unsafe.
Yes they will, because of risk aversion and cargo culting. They won't actually audit a passkey provider or have well-defined security criteria, but they will just require what everyone else requires.
Re: Passkeys and Modern Authentication
#207Earlier quoted context omitted.
I don’t think we should create standards that make it easier for companies to erode user freedoms and I’d support legislation to restrict what certain companies can/can’t do (banks, Google/Apple, etc) The discussion about what happens in big companies is completely unrelated to this discussion. In that case the company is the user. They can do/enforce whatever they want and nobody is having any freedoms infringed.
> The discussion about what happens in big companies is completely unrelated to this discussion It's not, in that they have plenty of technological solutions to address their security concerns. Passkeys don't make it easier. > I don’t think we should create standards that make it easier for companies to erode user freedoms We want some degree of security in many services (typically our bank). And we generally can't h…
> Security is a compromise.
To spell out the quote I allude to above, "give me liberty, or give me death!" We could eliminate a lot of bad things in the world if we were willing to give up freedoms.
Well intentioned but naive security researchers are constructing the very tools that will be used to by governments and corporations to restrict the rights and freedoms of users and I don't think we should stand for it.
Re: Passkeys and Modern Authentication
#208Earlier quoted context omitted.
Pretty much everyone likes them? Nobody likes passwords, especially passwords by users. Passkeys essentially force the users to have some sort of password manager, whether third party, or OS / browser integrated. Plus they're unphishable in normal use. They're technically weaker than password + hardware key but stronger than anything else, including password + totp. Google Advanced Protection still wants you to have…
Google's Advanced Protection Program supports both passkeys and security keys.
I guess they lowered requirements recently, now you can even do "1 passkey or security key, and recovery options, like a recovery phone and email".
Re: Passkeys and Modern Authentication
#209Earlier quoted context omitted.
> The discussion about what happens in big companies is completely unrelated to this discussion It's not, in that they have plenty of technological solutions to address their security concerns. Passkeys don't make it easier. > I don’t think we should create standards that make it easier for companies to erode user freedoms We want some degree of security in many services (typically our bank). And we generally can't h…
> Security is a compromise. To spell out the quote I allude to above, "give me liberty, or give me death!" We could eliminate a lot of bad things in the world if we were willing to give up freedoms. Well intentioned but naive security researchers are constructing the very tools that will be used to by governments and corporations to restrict the rights and freedoms of users and I don't think we should stand for it.
> Well intentioned but naive security researchers
If you are still talking about passkeys, I kindly disagree. I feel like many well intentioned but naive people seem to complain about passkeys for reasons that are not justified, precisely because governments and corporations don't need at all passkeys to restrict the rights and freedoms of users. Passkeys won't make it easier for them, it's already easy.
Re: Passkeys and Modern Authentication
#210Earlier quoted context omitted.
The difference is the security requirements. Services that are fine today with you using just a username+password won't care at all if you use a passkey that is considered unsafe.
Yes they will, because of risk aversion and cargo culting. They won't actually audit a passkey provider or have well-defined security criteria, but they will just require what everyone else requires.
Hmm... why don't they already implement their own authenticator apps, if it's just risk aversion and cargo culting? Again it's totally possible and it already exists.
I currently, exclusively use my Yubikeys as passkeys, and it works everywhere where passkeys are available. So I don't personally see a problem.
What I see is that people complain because of some kind of disagreement that happened between some people on the Internet about the passkey implementation in KeepassXC. And nothing about that materialised.