Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Beginner's Deep Dive Guide to Entra Passkeys

emsroute.com

Post reply on HN
Print view View original

11–20 of 30 posts

Re: A Beginner's Deep Dive Guide to Entra Passkeys

#11

Post by rf15 »

treetalker wrote: post #9

I sometimes consider the number of man-hours wasted every year by companies (such as Amazon and Dropbox) that repeatedly offer to convert passwords to passkeys, despite having already been declined (once, or even dozens or hundreds of times).

This reminds me of the number of man-hours wasted on logging in into Microsoft accounts - bonus points for "No, this app only" being hit after the session timeout of the login session so you have to log in _again_. (instead of being able to make that decision any time you like, because, you know, you've already authenticated yourself)

Re: A Beginner's Deep Dive Guide to Entra Passkeys

#12

Post by dfabulich »

rf15 wrote: post #3

In my experience, for most basic services, Passkeys are absolute overkill: Your ability to recover your account without too much hassle usually beats having a key explicitely tied to physical hardware (even worse, your phone that you carry around in public). Besides, passkeys are also often used by companies like Microsoft to peddle their apps, because of course you have to have specific apps for it. Makes me all fee…

Passkeys aren't tied to physical hardware. They're tied to your password manager. Passkeys are just passwords that require a password manager.

On Windows, macOS, iOS, and Android, there's a cloud-based password manager built into the operating system, so you can use your passkey anywhere you use that password manager.

Microsoft, Apple, Google, 1Password, and Bitwarden all have password-manager apps for Windows, macOS, iOS, and Android.

Pick a password manager and use the same one everywhere, and your passkeys will be available wherever you go.

Re: A Beginner's Deep Dive Guide to Entra Passkeys

#13

Post by throw7 »

"Something you have"/"device bound" is not what I want if I don't control it. In the case of passkeys, I don't have access to the private key, so I consider that not controllable by me.

I'm happy to be wrong if I am able to extract and import the private keys (it's what I do with TOTP now), but my understanding is designers of passkeys explicitly don't want users access to their own privkeys so they can tie them to physical objects. I get that, I don't want that.

So passkeys are not something I'll ever use or useful or convenient to me.

Re: A Beginner's Deep Dive Guide to Entra Passkeys

#14

Post by fitblipper »

rf15 wrote: post #3

In my experience, for most basic services, Passkeys are absolute overkill: Your ability to recover your account without too much hassle usually beats having a key explicitely tied to physical hardware (even worse, your phone that you carry around in public). Besides, passkeys are also often used by companies like Microsoft to peddle their apps, because of course you have to have specific apps for it. Makes me all fee…

>even worse, your phone that you carry around in public

Sorry to attach on to such a small part of your comment. Why do you think having it attached to your phone is worse? In my understanding phones are WAY more secure than any run of the mill laptop or desktop due to a variety of security measures like sandboxing, encryption by default, and secure elements. If I came home to a break in I would be way less nervous about them swiping my phone than my desktop.

Re: A Beginner's Deep Dive Guide to Entra Passkeys

#15

Post by dfabulich »

tomjen3 wrote: post #4

For a company this may be a good idea, but for consumers this is a nightmare. It will be so easy to get locked out of your account.

People just assume that, but it's not true. If you have access to your Microsoft account, then you'll have access to your Microsoft passkeys in the cloud.

Passkeys are just passwords that require a password manager. You can login to Microsoft with a Microsoft passkey, but that's not the only way to login to your Microsoft account. You can still login to Microsoft with a password.

All password managers require just one last password outside the password manager to access your account. That's how Microsoft's password manager works, too, and that's why you'll always be able to use a password to login to your Microsoft account.

(If you're afraid of Microsoft banning you from your Microsoft account, then don't use Microsoft's password manager. Bitwarden is pretty good.)

Re: A Beginner's Deep Dive Guide to Entra Passkeys

#16

Post by erincandescent »

throw7 wrote: post #13

"Something you have"/"device bound" is not what I want if I don't control it. In the case of passkeys, I don't have access to the private key, so I consider that not controllable by me. I'm happy to be wrong if I am able to extract and import the private keys (it's what I do with TOTP now), but my understanding is designers of passkeys explicitly don't want users access to their own privkeys so they can tie them to p…

If you're using a hardware device, you can't extract them, because that's the point.

If you're using a password manager to store your passkeys, there are protocols to move them between password managers.

Re: A Beginner's Deep Dive Guide to Entra Passkeys

#18

Post by dfabulich »

throw7 wrote: post #13

"Something you have"/"device bound" is not what I want if I don't control it. In the case of passkeys, I don't have access to the private key, so I consider that not controllable by me. I'm happy to be wrong if I am able to extract and import the private keys (it's what I do with TOTP now), but my understanding is designers of passkeys explicitly don't want users access to their own privkeys so they can tie them to p…

Bitwarden lets you extract and import passkeys. Apple, Google, Microsoft, and 1Password don't support that directly, but they do support a finicky app-to-app transfer system, where you install two password-manager apps on the same device, and you directly export your passkeys from one app to another. It's called the "Credential Exchange Protocol" (CXP).

Bitwarden's app can receive CXP passkeys, so you can install a passkey in Apple's password manager, CXP it to Bitwarden, and then export it to a file that you control.

Putting the file under your control does make it possible for someone to trick you into sending you that file, undermining some of the phishing protections of passkeys. It’s up to you to decide whether protecting yourself from being tricked into exporting your passkeys is worth sacrificing your ability to read them.

Re: A Beginner's Deep Dive Guide to Entra Passkeys

#19

Post by someguydave »

erincandescent wrote: post #16
throw7 wrote: post #13

"Something you have"/"device bound" is not what I want if I don't control it. In the case of passkeys, I don't have access to the private key, so I consider that not controllable by me. I'm happy to be wrong if I am able to extract and import the private keys (it's what I do with TOTP now), but my understanding is designers of passkeys explicitly don't want users access to their own privkeys so they can tie them to p…

If you're using a hardware device, you can't extract them, because that's the point. If you're using a password manager to store your passkeys, there are protocols to move them between password managers.

okay but on apple devices (for instance) I believe the private keys are stored in the icloud keychain, otherwise there would be no passkey portability between your apple devices

Re: A Beginner's Deep Dive Guide to Entra Passkeys

#20

Post by xg15 »

dfabulich wrote: post #12
rf15 wrote: post #3

In my experience, for most basic services, Passkeys are absolute overkill: Your ability to recover your account without too much hassle usually beats having a key explicitely tied to physical hardware (even worse, your phone that you carry around in public). Besides, passkeys are also often used by companies like Microsoft to peddle their apps, because of course you have to have specific apps for it. Makes me all fee…

Passkeys aren't tied to physical hardware. They're tied to your password manager. Passkeys are just passwords that require a password manager. On Windows, macOS, iOS, and Android, there's a cloud-based password manager built into the operating system, so you can use your passkey anywhere you use that password manager. Microsoft, Apple, Google, 1Password, and Bitwarden all have password-manager apps for Windows, macOS…

Well, unless you have a device-bound or FIDO2 key, according to the post.

And I think for FIDO2 keys, this is fine. If I can register a key (plus a backup) the usage doesn't seem so different from a regular key.

For the rest, I think what irks me is the feeling of "you have free choice which corporation you want to entrust all your login credentials with, but you will have to choose one". Previously, password managers were a convenience (that incidentally also increased security, because they made keeping a separate, hard password for each domain practically feasible) - but nothing stopped me from keeping passwords at several different places at once or memorizing some of them, in case I lose access to the password manager.

Now suddenly, they become the arbiters of my logins everywhere. What happens if they ban me, or go out of business or get bought up? (Or in Apple or Google's case, make arbitrary business decisions that can now affect the way I login to completely unrelated services?)

Post reply on HN