Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

111–120 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#111

Post by Ajedi32 »

awaythrow98765 wrote: post #57

Those passkeys are either insecure or unreliable. Let me explain: Those passkeys are asymmetric cryptographic keypairs where the private key is securely stored on a device, unlockable (for use, not reading) only by convincing your devices security processor to do so by pin/fingerprint/pattern. Which in itself can be secure, given you do trust that magic security processor (which you shouldn't, see yesterday's news fo…

> Now one could allow backups of a passkey

That's literally part of what makes a passkey a passkey (v.s. just a WebAuthn credential), so that's a given.

> as insecure as a password

No. Passkeys can't be phished, passwords can. Passkeys can't be cracked after a data breach. Passwords can. Passkeys can't be set to something easily guessable. Passwords can. Passkeys can't be written on a post-it note and taped to your monitor. Passwords can. Passkeys can't be reused across multiple sites. Passwords can.

There are so many ways passkeys are superior to user-memorized passwords from a security perspective, it's laughable to call them "as insecure as a password".

> One could allow multiple instances of authorized passkeys, but those would be even more insecure than passwords, because malicious software on your device could create evil new key instances.

What? Malware stealing your password is "more secure" than malware registering it's own malicious key to each individual site it wants access to?

Re: Passkeys: The beginning of the end of the password

#112

Post by wepple »

mmcnickle wrote: post #21

The linked security blog post[1] has a lot more of the technical details and can clear up some of the questions/confusion that people have added in the comments. [1] https://security.googleblog.com/2023/05/so-long-passwords-th...

+1 everyone should read that - 60% of comments on this thread are explained away by reading this.

Re: Passkeys: The beginning of the end of the password

#113

Post by petedoyle »

dgrin91 wrote: post #5

How is this more secure? They say "with a fingerprint, a face scan or a screen lock PIN", but basically all phones let you fall back to PINs if you dont want to do face or fingerprints. Pins are flat out not secure - typically just 4 digits. Yeah its probably better than 80% of people having "password123", but it seems strictly worse than a password + password manager? Or at least just having proper 2FA.

This has been bothering me, a lot. Google talks [1] about how Passkey replication is e2e encrypted between devices, but AFAICT they're just using a pin + key derivation. A six digit pin is like 20 bits of entropy before a KDF. [2]

Has anyone seen any docs that might help characterize how much entropy the keys have for e2e encryption (Android/iOS)?

I must be missing something, because I can't see how Google would call something e2e encrypted if the keys only have like 30-35 bits of "effective" entropy after a KDF. But that seems like it's the case??

    [1] "From the user's point of view, this means that when using 
    a passkey for the first time on the new device, they will 
    be asked for an existing device's screen lock in order to 
    restore the end-to-end encryption keys"
[1] https://security.googleblog.com/2022/10/SecurityofPasskeysin...

[2] https://www.omnicalculator.com/other/password-entropy?c=SGD&...

Re: Passkeys: The beginning of the end of the password

#114

Post by Scion9066 »

karaterobot wrote: post #108

> the same way they unlock their devices: with a fingerprint, a face scan or a screen lock PIN I am not a cryptographer: why would a 6-digit screen lock PIN with this system be any safer than a 6-digit numeric password on the web (i.e. not very)?

Generally, most devices don't encrypt/protect your data with that 6-digit PIN directly. They store the important secrets like device encryption keys in some kind of secure enclave/processor that does things like rate limit the PIN attempts to prevent brute-forcing. What the fingerprint or face scan is doing is just unlocking that secured data a different way.

Re: Passkeys: The beginning of the end of the password

#115

Post by alwaysbeconsing »

warkdarrior wrote: post #97
vlovich123 wrote: post #10

Earlier quoted context omitted.

Sure. But am I still locking my ability to access that account permanently to Google? Can I login via Chrome on an Apple/Windows platform and add a passkey there? I’m also a bit worried that this permanently entrenches these as the platform vendors because no one is going to port to a new platform unless you’re already a major tech company (maybe).

You are confusing the location where passkeys are stored (your Android, your iPhone, your Yubikey) and where they can be used (to access your Gmail account).

I don't think they are; they're effectively asking whether accounts will support multiple passkeys. This is a reasonable question IMO: if the protocol is not well-designed different services (account providers) may have different rules about how many passkeys can be attached to your account in their system. (E.g. "2 passkeys ought to be enough for anybody!") And for how they can be managed: removed and updated, particularly.

Re: Passkeys: The beginning of the end of the password

#116

Post by oasisbob »

Gasp0de wrote: post #94

There is a legal advantage that passwords have that passkeys and FIDO and so on do not have. In civilized countries, no one can force you to hand over a password (as you have a right to not incriminate yourself). That does not hold for property which can be confiscated or even biometric attributes which can be taken against your will legally. Theoretically, passkeys could still offer this advantage if they are stored…

> In civilized countries, no one can force you to hand over a password (as you have a right to not incriminate yourself).

Which countries?

In the US, the intersection between 5th amendment rights and password disclosure is not complete. You can be forced to disclose a password in certain circumstances here.

Re: Passkeys: The beginning of the end of the password

#117

Post by hk1337 »

I don't mean this to be negative as much as an observation but it seems like it's Google's version of "Sign in with Apple ID"? Apple ID only works with Apple devices though, so I wonder if will work for any device? Perhaps it will work better on Android but can be implemented for other devices?

Re: Passkeys: The beginning of the end of the password

#118

Post by judge2020 »

hk1337 wrote: post #117

I don't mean this to be negative as much as an observation but it seems like it's Google's version of "Sign in with Apple ID"? Apple ID only works with Apple devices though, so I wonder if will work for any device? Perhaps it will work better on Android but can be implemented for other devices?

No. This is the fido2 / webauthn standard, where the device itself generates new keys for each website and the device uses these stored keys to perform public key authentication to log into websites. For some ecosystems (namely iCloud Keychain) it syncs these key pairs between devices.

They already have "sign in with google" which directly links sites to your Google account. This is not that.

Re: Passkeys: The beginning of the end of the password

#119

Post by EGreg »

segmondy wrote: post #41

I'm still salty about this. Called it passkey too. http://www.multipasskey.com/susdemo/ . Built this 5-6yrs ago and applied to YC. Crickets. Hope to see this take off, with my approach I made it where you don't even need to "register", you can go to a site and just have an account. I did the fingerprint, face scan, PIN approach for more security, but my favorite was NFC ring. Basically you have an NFC ring you wear o…

Contact me and let’s add it to https://qbix.com/platform and ecosystem so it is not captured by Big Tech corporations.

We have a lot to talk about and exchange information.

greg at the domain qbix.com

Re: Passkeys: The beginning of the end of the password

#120

Post by judge2020 »

awaythrow98765 wrote: post #57

Those passkeys are either insecure or unreliable. Let me explain: Those passkeys are asymmetric cryptographic keypairs where the private key is securely stored on a device, unlockable (for use, not reading) only by convincing your devices security processor to do so by pin/fingerprint/pattern. Which in itself can be secure, given you do trust that magic security processor (which you shouldn't, see yesterday's news fo…

Maybe for browsers on Windows it'll default to storing the key purely on-device, but especially with iCloud Keychain the key is not encrypted by the on-device processor.

This does not make it as "insecure as a password". It does mean you can use root/OS access to exfiltrate keys, but it closes the following security holes that affect passwords:

- keyboard sound-based exfiltration[0]

- visual exfiltration (someone recording you enter your password, or looking over your shoulder and memorizing it)

- credential stuffing, where people who reuse passwords get pwned when the same leaked password is used on other websites

0: https://www.independent.co.uk/tech/cyber-security-passwords-...

Post reply on HN