Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: They're not perfect but they're getting better

ncsc.gov.uk

Post reply on HN
Print view View original

101–110 of 145 posts

Re: Passkeys: They're not perfect but they're getting better

#101

Post by joshuamorton »

throwawayffffas wrote: post #98
stavros wrote: post #76

Earlier quoted context omitted.

The person there requested that KeePassXC don't let users export their keys in plaintext , which seems reasonable. He asked that the software encrypt the keys with a user-selected password before exporting, so someone stealing the files wouldn't have the keys to literally all of the user's sites. That doesn't seem unreasonable to me.

Not really dude, if I can't export in plaintext I can't pick the encryption I have to use whatever keepassxc will do. I can't pipe it to gpg and encrypt it with my key. And on the other hand I can only load them to another keepass instance I can't switch credential managers. If you are worried your system is running malware that will steal your plaintext keys, well bad news they can steal the encrypted keys and keylo…

> If you are worried your system is running malware that will steal your plaintext keys

No, I'm not worried about this since I do not and will not copy my keys.

I'm worried about my friends or family using the most secure options possible (passkeys) and still getting phished because they paste their plaintext secrets into a scam site.

Re: Passkeys: They're not perfect but they're getting better

#102

Post by throwawayffffas »

joshuamorton wrote: post #101
throwawayffffas wrote: post #98

Earlier quoted context omitted.

Not really dude, if I can't export in plaintext I can't pick the encryption I have to use whatever keepassxc will do. I can't pipe it to gpg and encrypt it with my key. And on the other hand I can only load them to another keepass instance I can't switch credential managers. If you are worried your system is running malware that will steal your plaintext keys, well bad news they can steal the encrypted keys and keylo…

> If you are worried your system is running malware that will steal your plaintext keys No, I'm not worried about this since I do not and will not copy my keys. I'm worried about my friends or family using the most secure options possible (passkeys) and still getting phished because they paste their plaintext secrets into a scam site.

Even without copyable keys, if your friends and family can be tricked into pasting their plain text keys into a scam site, they can be tricked into pasting their encrypted keys and their associated password to a scam site.

The point of encryption at rest is to protect your data if your device is accessed by a third party. Not from user action.

Re: Passkeys: They're not perfect but they're getting better

#103

Post by throwawayffffas »

joshuamorton wrote: post #100
throwawayffffas wrote: post #97

Earlier quoted context omitted.

It's not really Netflix. Its Microsoft, Apple and Google. So say goodbye to using teams on Linux. Using Microsoft365 on any hardware that is not Microsoft approved. Or logging in to your bank without an iPhone or an android. We will surely complain but the bank will say that we only support secure devices and that means iPhones and Android, and how come you are making a big deal about it just buy one of these two eve…

> Or logging in to your bank without an iPhone or an android. This is already possible (and common!) many banking apps, for better or worse, use device attestation features that require varyingly official copies of android. Were you already complaining about this?

It's definitely worse. Banking credentials are stolen the old fashion way, phishing.

Re: Passkeys: They're not perfect but they're getting better

#104

Post by petre »

ajnin wrote: post #35

> websites which [...] also want to know how the passkey is being handled by the user’s device to keep their accounts safe This is exactly where passkeys go too far. "to keep their accounts safe" is always the excuse used to reduce the freedoms of users. Web sites have no business deciding how things are handled on user devices but it's precisely what passkeys enable. The boundary of control of a website used to stop…

> Web sites have no business deciding how things are handled on user devices but it's precisely what passkeys enable.

On the contrary, their operators can decide whatever they like, but I won't be visiting them if they go the passkeys route. I can live w/o Netflix or Disney just fine.

Your PII will leak off their platform anyway.

Re: Passkeys: They're not perfect but they're getting better

#105

Post by joshuamorton »

throwawayffffas wrote: post #102
joshuamorton wrote: post #101

Earlier quoted context omitted.

> If you are worried your system is running malware that will steal your plaintext keys No, I'm not worried about this since I do not and will not copy my keys. I'm worried about my friends or family using the most secure options possible (passkeys) and still getting phished because they paste their plaintext secrets into a scam site.

Even without copyable keys, if your friends and family can be tricked into pasting their plain text keys into a scam site, they can be tricked into pasting their encrypted keys and their associated password to a scam site. The point of encryption at rest is to protect your data if your device is accessed by a third party. Not from user action.

> Even without copyable keys, if your friends and family can be tricked into pasting their plain text keys into a scam site, they can be tricked into pasting their encrypted keys and their associated password to a scam site.

The point is that data shouldn't really be copyable, but a backup should at least be encrypted.

Ideally you don't have or need a key transfer mechanism, because sites have the ability to register multiple keys and you add or remove devices by adding or removing new keys, and you recover a backup to the same passkey-manager.

"Please upload the backup of your password manager and enter the root password" is not a thing you should ever do, and reasonable users, even technically incompetent ones understand that. The only people who want that behavior to be possible are weird power users whose desire makes it easier for anyone who uses such a password-manager to be phished.

Like, I've had this conversation before on this site, and my personal rule of "I should never copy a private key, and I should certainly never copy a private key between devices or onto a cloud" remains something I'm confident in. If I need a private key used across devices, I can trust it to a key-management scheme like the ones built into Signal or the various passkey managers I use. I don't want to manually copy my signal cypher-data between devices either!

Re: Passkeys: They're not perfect but they're getting better

#106

Post by joshuamorton »

throwawayffffas wrote: post #103
joshuamorton wrote: post #100

Earlier quoted context omitted.

> Or logging in to your bank without an iPhone or an android. This is already possible (and common!) many banking apps, for better or worse, use device attestation features that require varyingly official copies of android. Were you already complaining about this?

It's definitely worse. Banking credentials are stolen the old fashion way, phishing.

I'm not sure what your point is here. How credentials are stolen today is irrelevant to the fact that today, right now, at this very moment, banks can and do already do the thing you're worried will be possible only due to the prevalence of passkeys.

Re: Passkeys: They're not perfect but they're getting better

#107

Post by throwawayffffas »

joshuamorton wrote: post #105
throwawayffffas wrote: post #102

Earlier quoted context omitted.

Even without copyable keys, if your friends and family can be tricked into pasting their plain text keys into a scam site, they can be tricked into pasting their encrypted keys and their associated password to a scam site. The point of encryption at rest is to protect your data if your device is accessed by a third party. Not from user action.

> Even without copyable keys, if your friends and family can be tricked into pasting their plain text keys into a scam site, they can be tricked into pasting their encrypted keys and their associated password to a scam site. The point is that data shouldn't really be copyable, but a backup should at least be encrypted. Ideally you don't have or need a key transfer mechanism, because sites have the ability to register…

> I don't want to manually copy my signal cypher-data between devices either!

Yes you. Others do. Whenever I switch laptops the first thing to do is copy over all ssh keys. I am not going to roll a new key and add it to 100 servers.

A couple of years back I switched password managers, I didn't go over 1000 sites and changed all my passwords, my password manager exported a plaintext file and I had it imported in the other after a small transformation step.

> "Please upload the backup of your password manager and enter the root password" is not a thing you should ever do, and reasonable users, even technically incompetent ones understand that.

No they don't and if they did they would also understand not to upload their plaintext credentials.

Security for the lowest denominator cannot be used as an excuse for locked down computing for everyone or at least it shouldn't. At some point we have to put on our big boy/girl pants and know the implications of what we are doing.

Re: Passkeys: They're not perfect but they're getting better

#108

Post by throwawayffffas »

joshuamorton wrote: post #106
throwawayffffas wrote: post #103

Earlier quoted context omitted.

It's definitely worse. Banking credentials are stolen the old fashion way, phishing.

I'm not sure what your point is here. How credentials are stolen today is irrelevant to the fact that today , right now, at this very moment, banks can and do already do the thing you're worried will be possible only due to the prevalence of passkeys.

Oh my point is that their device attestation thing is security theater.

It's clearly just for getting that iso certification.

It's a power play by the platform vendors.

The vendors are literally saying:

We now have this "security" feature and banks have to use it to be compliant and it only works on our platforms, so I guess you have to use our platform unless you want to be unbanked.

Re: Passkeys: They're not perfect but they're getting better

#109

Post by eviks »

ianburrell wrote: post #20
greenicon wrote: post #17

Earlier quoted context omitted.

Passkeys cannot be phished. Other than that they shouldn't have a big advantage for a more professional user with unique, long, and random passwords. For the common user it should be a great upgrade, giving all these advantages with better UX.

Another is that passkeys are single login and sites don’t use 2FA. Not having to get out TOTP or receive SMS is worth it. Basically, any site that does 2FA should take passkeys.

You can store 2fa in a password manager except for the dumb sms-bases ones, but that's still an extra step

Re: Passkeys: They're not perfect but they're getting better

#110

Post by eviks »

greenicon wrote: post #17
abdullahkhalids wrote: post #11

Earlier quoted context omitted.

So the same passkey is being used on multiple devices, rather than different devices (actually applications) having distinct passkeys. Doesn't that defeat one of the centrals aims of passkeys? In what ways is your setup different than random passwords in bitwarden - what's the additional security?

Passkeys cannot be phished. Other than that they shouldn't have a big advantage for a more professional user with unique, long, and random passwords. For the common user it should be a great upgrade, giving all these advantages with better UX.

Password autofill also provides that protection as it won't match on phishing domain
Post reply on HN