Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys now support external providers

developer.apple.com

Post reply on HN
Print view View original

101–110 of 185 posts

Re: Passkeys now support external providers

#101

Post by lost_tourist »

ckastner wrote: post #10

Of all the recent publications with regards to passkeys, FIDO2, WebAuthn, etc., finally there's one with a simple and concise summary of the benefits: > Strong credentials. Every passkey is strong. They’re never guessable, reused, or weak. > Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers. > Safe from phishing. Passkeys are intrinsically linked with the app…

Are they safe from Apple shutting down your account? Seems like an all your eggs in one basket problem, with passwords I can back up and always retrieve them locally.

Re: Passkeys now support external providers

#102

Post by Ajedi32 »

spuz wrote: post #93

One thing I don't understand about offering passkey login for your email is how you would go about recovering an account if you lost access to the device which holds your passkey? Google states: "When you create a passkey, you opt in to a passkey-first, password-less sign-in experience.". This seems to imply that you will not be able to use your old password if you ever lost your phone. Do Google still offer backup p…

Think of passkeys as being the same as a password database. The provider can offer whatever recovery mechanism they want, and sites that use passkeys can continue to offer account recovery methods completely independent of their use of passkeys.

As for what Google does specifically with their implementation, I'm not sure. I personally plan to use KeepassXC's implementation, whenever that comes out, with my own custom database backup strategy.

Re: Passkeys now support external providers

#103

Post by devsda »

cassianoleal wrote: post #41
devsda wrote: post #33

Earlier quoted context omitted.

> Apple are *now* allowing external sync There is no guarantee that this will be permanent. It can be revoked citing x number of reasons. Also, lets wait until the implementation details are available. If it requires providers having a native app on the device where Apple has control on who and what to allow, there's only an illusion of choice.

Pretty sure "now" in this context means "starting now". Once people start relying on this, it will take a lot more than just citing reasons to revoke it without causing massive blowback.

I don't mean revoking 3rd party support entirely.

We don't know the implementation details yet but if this requires Apple vetting and whitelisting the providers then it can always be revoked for technical, business, political or any other reasons.

Re: Passkeys now support external providers

#104

Post by TheNewsIsHere »

lost_tourist wrote: post #101
ckastner wrote: post #10

Of all the recent publications with regards to passkeys, FIDO2, WebAuthn, etc., finally there's one with a simple and concise summary of the benefits: > Strong credentials. Every passkey is strong. They’re never guessable, reused, or weak. > Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers. > Safe from phishing. Passkeys are intrinsically linked with the app…

Are they safe from Apple shutting down your account? Seems like an all your eggs in one basket problem, with passwords I can back up and always retrieve them locally.

Passkeys were designed from the start to enable portability if desired. The rollout has been a mess though, so it’s been very effective in causing a lot more confusion than needed.

From the page:

> What’s new

> Now people can share passwords and passkeys from iCloud Keychain with their trusted contacts. *Password manager apps can save and offer passkeys on iOS, iPadOS, and macOS*. Enterprises can take advantage of passkeys thanks to Managed Apple ID support for iCloud Keychain. And administrators can manage which devices passkeys sync to using Access Management controls in Apple Business Manager and Apple School Manager.

Emphasis is my own.

Dashlane and 1Password both support passkeys, and you can export your data from both services. I am certain more will follow as more third party support arrives for managing passkeys.

Re: Passkeys now support external providers

#105

Post by notpushkin »

theshrike79 wrote: post #64
jabbany wrote: post #53

Earlier quoted context omitted.

Are you saying they don't use any physical keys? That would be surprising to me... I've found it really easy to teach non-technical people how to use U2F tokens. Just tell them it's like a door key but instead of plugging it in and turning, you plug it in and touch. That's all there is. It's been much more intuitive* to my older family members than SMS codes (that sometimes get lost), authenticator apps (that have a…

The difference is that I can know with significant certainty that shoving my house key in a random lock won't copy the form of my key and send it to a 3D printer where a thief will get it and use it to access my house. How can I know that won't happen when I use my USB dongle on a random coffee shop public computer?

> I can know with significant certainty that shoving my house key in a random lock won't copy the form of my key and send it to a 3D printer

Are you sure? https://www.minutekey.com/products/key-copy-kiosk/

Re: Passkeys now support external providers

#106

Post by notpushkin »

drtgh wrote: post #31
Lukas_Skywalker wrote: post #13

Earlier quoted context omitted.

I would argue that password managers are not a "in every sense a really bad, bad idea" for a lot of reasons. Let's look at password reuse for example. As soon as you have more than a few dozen logins, the possibilities are mostly either reusing one or few passwords, or writing them down. Reusing is objectively bad, and for writing them down, the password manager makes it easy to use a really long and random password,…

Password managers makes the user life easier, at a big price if the master password gets compromised, as all the passwords get compromised at same time, in an unified way that by other methods would require much more specialization and effort for to gather together. If that passwords are stored in internet even worst, one can take for sure those passw-managing servers are juicy targets, it is a countdown until the se…

How do you remember unique, strong passwords for a couple dozen sites?

Re: Passkeys now support external providers

#107

Post by kps »

TheNewsIsHere wrote: post #104
lost_tourist wrote: post #101

Earlier quoted context omitted.

Are they safe from Apple shutting down your account? Seems like an all your eggs in one basket problem, with passwords I can back up and always retrieve them locally.

Passkeys were designed from the start to enable portability if desired. The rollout has been a mess though, so it’s been very effective in causing a lot more confusion than needed. From the page: > What’s new > Now people can share passwords and passkeys from iCloud Keychain with their trusted contacts. *Password manager apps can save and offer passkeys on iOS, iPadOS, and macOS*. Enterprises can take advantage of pa…

That emphasized sentence is key. Pessimistically, it could mean that password managers can ‘save’ only to the Apple OS passkey store, acting as an intermediary transport, without being able to provide cross-platform vendor-agnostic sharing.

Re: Passkeys now support external providers

#108

Post by clairity »

theshrike79 wrote: post #62
rickdeckard wrote: post #55

Earlier quoted context omitted.

It's also a convenient workaround to synchronize information about your online-behavior, while still being able to state publicly that your browser-history is never processed to profile you. Upvoting this because it's a view worth sharing (and I'm sure you'll be downvoted just because of your baseless claim that Apple is concerned about something as dirty as profit /s)

Apple is making filthy amounts of money just from hardware and app sales. All of their attempts at targeted advertising have been rounding errors at best. And they know that complete unbreakable privacy is the place where Google (an ad company) can never ever fully follow no matter what kind of lip service they do in their keynotes about privacy.

all of apple's recent growth is coming from its content ("services") business, which means it's hot to track you for advertising purposes. passkeys provide another stone in their walled garden to be able to track you but keep others from doing so as effectively, which on balance contributes to its competitive advantage.

make no mistake that this is the direction apple is headed. it's been clear for the last 5 years or so, since hardware sales have leveled off. perhaps the goggles will dampen the velocity a bit, but i'm very skeptical that the AR/VR market is mature enough to have that effect in the near future.

Re: Passkeys now support external providers

#109

Post by cassianoleal »

devsda wrote: post #103
cassianoleal wrote: post #41

Earlier quoted context omitted.

Pretty sure "now" in this context means "starting now". Once people start relying on this, it will take a lot more than just citing reasons to revoke it without causing massive blowback.

I don't mean revoking 3rd party support entirely. We don't know the implementation details yet but if this requires Apple vetting and whitelisting the providers then it can always be revoked for technical, business, political or any other reasons.

I would expect this to be modelled after the API for password managers, in which case there's no vetting or whitelisting. Or if there is, it's pretty open as a lot of software uses it, both closed and open source.

Re: Passkeys now support external providers

#110

Post by snagg »

Ajedi32 wrote: post #102
spuz wrote: post #93

One thing I don't understand about offering passkey login for your email is how you would go about recovering an account if you lost access to the device which holds your passkey? Google states: "When you create a passkey, you opt in to a passkey-first, password-less sign-in experience.". This seems to imply that you will not be able to use your old password if you ever lost your phone. Do Google still offer backup p…

Think of passkeys as being the same as a password database. The provider can offer whatever recovery mechanism they want, and sites that use passkeys can continue to offer account recovery methods completely independent of their use of passkeys. As for what Google does specifically with their implementation, I'm not sure. I personally plan to use KeepassXC's implementation, whenever that comes out, with my own custom…

This is an area with the specs contrast with the vendors.

The WebAuthn specs recommends to register multiple passkeys/credentials per device and assume that once a credential is lost it might not be recoverable.

Apple and other vendors using keychains/wallets are effectively offering the option to delegate the recovery of the passkey to the recovery of the account with them (eg: the iCloud account).

In case it is of interest, we wrote a long blogpost on the topic: https://www.slashid.dev/blog/passkeys-security-implementatio...

Post reply on HN