Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: They're not perfect but they're getting better

ncsc.gov.uk

Post reply on HN
Print view View original

11–20 of 145 posts

Re: Passkeys: They're not perfect but they're getting better

#11

Post by abdullahkhalids »

varbhat wrote: post #4

I agree. I use Bitwarden on my Samsung Android phone and also on my Linux desktop. Bitwarden currently supports passkeys on almost all the apps on my android including firefox. The same passkeys which i used to login on my phone can be used on my Linux desktop where i use Firefox with Bitwarden extension. What's now possible was not even possible at the start of this year. I haven't switched everything to passkeys bu…

So the same passkey is being used on multiple devices, rather than different devices (actually applications) having distinct passkeys.

Doesn't that defeat one of the centrals aims of passkeys? In what ways is your setup different than random passwords in bitwarden - what's the additional security?

Re: Passkeys: They're not perfect but they're getting better

#13

Post by burnte »

nabla9 wrote: post #5

Losing your device and not having any passwords is like losing your fingerprints. >Device loss scenarios >Users are largely unsure about the implications for their passkeys if they lose or break their device, as it seems their device holds the entire capability to authenticate. To trust passkeys as a replacement for the password, users need to be prepared and know what to do in the event of losing one – or all – of t…

Just not having the right device with you is crippling. IMO Passkeys need more work. I'd really like to see accounts support multiple passkeys. I'd prefer biometrics that are device independent. I just don't like the idea of replacing something someone can steal (a password) with something else someone can steal (a phone).

Re: Passkeys: They're not perfect but they're getting better

#14

Post by scratcheee »

oldestofsports wrote: post #2

So then I should store all my passkeys in a vault that I protect with a single password, how are passkeys safer?

The article explains the weaknesses of the password-centric approach:

> whether by phishing or exploiting the fact the passwords are weak or have been reused

1. Phishing is harder when you only ever enter your password into 1 place, and that one place is designed to be secure and consistent.

2. Much easier to have exactly 1 strong password than unique strong passwords for every website.

Is it better than a vault full of random passwords? Probably not, beyond pressuring the user into using the more secure method

Re: Passkeys: They're not perfect but they're getting better

#15

Post by abdullahkhalids »

etskinner wrote: post #7
oldestofsports wrote: post #2

So then I should store all my passkeys in a vault that I protect with a single password, how are passkeys safer?

Let's assume your vault/login has these properties: - You have a strong unlock password that you don't use anywhere else - You have a second factor set up for unlocking the vault (TPM in the device you're using, Yubikey, TOTP, etc.) - The service you're logging into has good account recovery hygeine The benefit, assuming those things, is that the passkey is phishing-resistant and social-engineering-resistant. If a us…

My password manager (keepassxc) has a browser extension that only lets you autocomplete the password on a page if the url matches the one stored in the database.

Sure I could manually copy the password from the database, but in practice, this is fairly good security. It also doesn't treat the user as an always-idiot, which is a good thing in my book.

Re: Passkeys: They're not perfect but they're getting better

#16

Post by 0cf8612b2e1e »

nabla9 wrote: post #5

Losing your device and not having any passwords is like losing your fingerprints. >Device loss scenarios >Users are largely unsure about the implications for their passkeys if they lose or break their device, as it seems their device holds the entire capability to authenticate. To trust passkeys as a replacement for the password, users need to be prepared and know what to do in the event of losing one – or all – of t…

Also requires the device allows backup of passkeys. The infamous post where keepass was threatened if they were to continue to allow users to backup their own keys.

Re: Passkeys: They're not perfect but they're getting better

#17

Post by greenicon »

abdullahkhalids wrote: post #11
varbhat wrote: post #4

I agree. I use Bitwarden on my Samsung Android phone and also on my Linux desktop. Bitwarden currently supports passkeys on almost all the apps on my android including firefox. The same passkeys which i used to login on my phone can be used on my Linux desktop where i use Firefox with Bitwarden extension. What's now possible was not even possible at the start of this year. I haven't switched everything to passkeys bu…

So the same passkey is being used on multiple devices, rather than different devices (actually applications) having distinct passkeys. Doesn't that defeat one of the centrals aims of passkeys? In what ways is your setup different than random passwords in bitwarden - what's the additional security?

Passkeys cannot be phished.

Other than that they shouldn't have a big advantage for a more professional user with unique, long, and random passwords. For the common user it should be a great upgrade, giving all these advantages with better UX.

Re: Passkeys: They're not perfect but they're getting better

#18

Post by AlexandrB »

velcrovan wrote: post #10
oldestofsports wrote: post #2

So then I should store all my passkeys in a vault that I protect with a single password, how are passkeys safer?

So your real issue here is with credential managers, but I'll bite. In most cases the vault is not protected only with your master password, but with other cryptographic info that prevents the vault from being opened on untrusted devices. If one of your trusted devices is compromised, I guess you have other issues.

Uhhh, how does that interact with:

> Users are largely unsure about the implications for their passkeys if they lose or break their device, as it seems their device holds the entire capability to authenticate. To trust passkeys as a replacement for the password, users need to be prepared and know what to do in the event of losing one – or all – of their devices.

Re: Passkeys: They're not perfect but they're getting better

#19

Post by josephcsible »

varbhat wrote: post #4

I agree. I use Bitwarden on my Samsung Android phone and also on my Linux desktop. Bitwarden currently supports passkeys on almost all the apps on my android including firefox. The same passkeys which i used to login on my phone can be used on my Linux desktop where i use Firefox with Bitwarden extension. What's now possible was not even possible at the start of this year. I haven't switched everything to passkeys bu…

> I read about Passkey comittee being against open source passkey managers during start of this year (can't reference it, sorry) but with open source password/key managers already supporting passkeys, i don't think it turned out to be true.

Here's an Okta employee threatening to use the attestation (anti)feature of passkeys to block open-source implementations, because they allow you to export your passkeys: https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

Re: Passkeys: They're not perfect but they're getting better

#20

Post by ianburrell »

greenicon wrote: post #17
abdullahkhalids wrote: post #11

Earlier quoted context omitted.

So the same passkey is being used on multiple devices, rather than different devices (actually applications) having distinct passkeys. Doesn't that defeat one of the centrals aims of passkeys? In what ways is your setup different than random passwords in bitwarden - what's the additional security?

Passkeys cannot be phished. Other than that they shouldn't have a big advantage for a more professional user with unique, long, and random passwords. For the common user it should be a great upgrade, giving all these advantages with better UX.

Another is that passkeys are single login and sites don’t use 2FA. Not having to get out TOTP or receive SMS is worth it.

Basically, any site that does 2FA should take passkeys.

Post reply on HN