Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Passkeys Will Be Simpler and More Secure Than Passwords – TidBITS

tidbits.com

Post reply on HN
Print view View original

11–16 of 16 posts

Re: Why Passkeys Will Be Simpler and More Secure Than Passwords – TidBITS

#11

Post by exmadscientist »

RL_Quine wrote: post #7
Spivak wrote: post #4

Passkeys are such a great idea that is for sure going to be ruined by implementers clinging stupidly hard to their “secure enclaves” making them a huge PITA to actually use. It should be as simple as storing your private keys in your password manager, browser keychain, in a folder, or USB stick, Yubikey, or anywhere the user damn well pleases. You should be able to easily export presigned tickets for recovery, suppor…

That's not really how they're meant to be used. Want multiple keys? Register multiple devices. Copying the same key around willy nilly just means you can't revoke access selectively. Not being able to export keys and mishandle them is kind of a design goal rather than a limitation.

That's because WebAuthn in general is a poor match to most lower-stakes uses of passwords. Not everything is a bank account. Many things are appropriately authenticated using "just" a password manager. WebAuthn refuses to acknowledge that, because it's a standard born of corporate security officers serving their own ends. It's still appropriate for some things an average human or techie human does, but not everything, and its promoters need to stop acting like it is the only game in town.

Re: Why Passkeys Will Be Simpler and More Secure Than Passwords – TidBITS

#12

Post by alwillis »

cetacean wrote: post #8

> But imagine a world in which you can securely log in to websites using any current browser on any device running any modern operating system, without having to create, remember, type, and protect passwords. It’s relaxing just to think about. This is such a weird thing to say... it really isn't all that relaxing tbh, like why not just use a password manager separately or through browser? What's relaxing about handin…

Hate to say it, but I personally don't feel comfortable storing all of my logins on Apple or Google's servers. Sorry, not for me.

If you have multiple Apple devices, for example, you don't have to use iCloud Keychain for passkeys if you're that paranoid, regardless of how convenient it is. All I can say is Keychain is pretty badass; I have no qualms about using it [1].

If you're on a cruise and you accidentally drop your iPhone into the ocean, you could buy a new one at the next port—or when you get back home—and do Apple's restore process and you're back in business in 10 minutes. All of your logins, credentials, certificates, etc. are encrypted with a key Apple doesn't have, so they can't access or give it to anyone else even if they were presented with a search warrant by law enforcement [2].

And also what happens if the public private key pair is compromised?

It's called a public key for a reason; it can't be compromised, right? The public key replaces your username when logging in; both are public information.

The private key never leaves your device, so there's no opportunity for a sketchy website or fishing attack to get it. And it certainly can't be intercepted like SMS codes can be.

You know how people get fooled into logging into a fake site who's domain is one character different than the authentic domain? A password manager doesn't help you with that but passkeys are cryptographically attached to a domain, so it can't be used on a site masquerading as your bank's website.

They criticize 2FA as flawed in the article, but how common are the SMS vulnerabilities that they talk about?

You're kidding, right? These are the first 3 hits on google: [3] [4] [5]

[1]: https://support.apple.com/guide/security/keychain-data-prote...

[2]: https://support.apple.com/guide/security/secure-icloud-keych...

[3]: "Why Using SMS Authentication for 2FA Is Not Secure"—https://securityboulevard.com/2021/12/why-using-sms-authenti...

[4]: "Why 2FA SMS is a Bad Idea"—https://blog.sucuri.net/2020/01/why-2fa-sms-is-a-bad-idea.ht...

[5]: "Can We Stop Pretending SMS Is Secure Now?"—https://krebsonsecurity.com/2021/03/can-we-stop-pretending-s...

Re: Why Passkeys Will Be Simpler and More Secure Than Passwords – TidBITS

#13

Post by alwillis »

cetacean wrote: post #8

> But imagine a world in which you can securely log in to websites using any current browser on any device running any modern operating system, without having to create, remember, type, and protect passwords. It’s relaxing just to think about. This is such a weird thing to say... it really isn't all that relaxing tbh, like why not just use a password manager separately or through browser? What's relaxing about handin…

Apple's video is pretty helpful; jump to the 25:16 mark to get into the nitty gritty [1].

[1]: https://developer.apple.com/wwdc22/10092

Re: Why Passkeys Will Be Simpler and More Secure Than Passwords – TidBITS

#14

Post by pkulak »

alwillis wrote: post #12
cetacean wrote: post #8

> But imagine a world in which you can securely log in to websites using any current browser on any device running any modern operating system, without having to create, remember, type, and protect passwords. It’s relaxing just to think about. This is such a weird thing to say... it really isn't all that relaxing tbh, like why not just use a password manager separately or through browser? What's relaxing about handin…

Hate to say it, but I personally don't feel comfortable storing all of my logins on Apple or Google's servers. Sorry, not for me. If you have multiple Apple devices, for example, you don't have to use iCloud Keychain for passkeys if you're that paranoid, regardless of how convenient it is. All I can say is Keychain is pretty badass; I have no qualms about using it [1]. If you're on a cruise and you accidentally drop…

> You know how people get fooled into logging into a fake site who's domain is one character different than the authentic domain? A password manager doesn't help you with that

It does though, since it will refuse to auto fill.

But I get it. Still not as robust.

Re: Why Passkeys Will Be Simpler and More Secure Than Passwords – TidBITS

#15

Post by pkulak »

atonse wrote: post #5

I’d use this when 1password rolls it out. My concern was about how it works if you switch/upgrade devices, and overall it seems like the keys are stored in the keychain (probably as certs?) which means they can be backed up outside iCloud.

Exactly my sentimonies. I have an iPhone, and this seems nice, but it if makes logins a PITA on my Linux machines, I’m out.

Re: Why Passkeys Will Be Simpler and More Secure Than Passwords – TidBITS

#16

Post by iggldiggl »

RL_Quine wrote: post #7
Spivak wrote: post #4

Passkeys are such a great idea that is for sure going to be ruined by implementers clinging stupidly hard to their “secure enclaves” making them a huge PITA to actually use. It should be as simple as storing your private keys in your password manager, browser keychain, in a folder, or USB stick, Yubikey, or anywhere the user damn well pleases. You should be able to easily export presigned tickets for recovery, suppor…

That's not really how they're meant to be used. Want multiple keys? Register multiple devices. Copying the same key around willy nilly just means you can't revoke access selectively. Not being able to export keys and mishandle them is kind of a design goal rather than a limitation.

So every time I sign up somewhere I need to dig out all devices (including possible off-site backups if I was really thorough?) and sign them all up, too? If yes, then that doesn't sound particularly enticing…
Post reply on HN