Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: They're not perfect but they're getting better

ncsc.gov.uk

Post reply on HN
Print view View original

111–120 of 145 posts

Re: Passkeys: They're not perfect but they're getting better

#111

Post by angry_octet »

gowld wrote: post #34
sam_lowry_ wrote: post #28

How are passkeys different from API keys or just random chains of characters? And why can't we have the use of such keys enforced by an EU legislation so that all businesses allow users to login using such strings of random characters? The world would then be a better place.

> How are passkeys different from API keys or just random chains of characters? Passkeys are encrypyed so they can't be simply copied off your device.

They can most definitely be copied off the device, and the decryption key is in memory.

Re: Passkeys: They're not perfect but they're getting better

#113

Post by eviks »

stavros wrote: post #78
abdullahkhalids wrote: post #64

Earlier quoted context omitted.

Passkeys do protect you from such mistakes in a way the current implementation of the browsers/password managers/web-specs don't. But that is after 10s of millions of dollars or more have been poured into the development of passkeys, resulting in new standard specifications, diverse implementations of password managers, etc. Now, imagine the counterfactual world where those same dollars were devoted to improving the…

Except we already are living in that counterfactual world. Companies haven't been sitting on their hands while lamenting how bad passwords are, we've spent many times more money trying to make passwords secure than we've spent on developing passkeys.

If we're living in that world, which websites block logins without a password manager?

Re: Passkeys: They're not perfect but they're getting better

#114

Post by angry_octet »

supportengineer wrote: post #41

Passkeys are great because they get sync'ed to all your devices, which makes it really easy to share access to those websites with other people ( who have access to devices on your account ). Like a spouse.

This is also a problem because the security boundary of passkey security is now the entire cloud of that provider... And every app on every device you're logged in to.

Re: Passkeys: They're not perfect but they're getting better

#117

Post by angry_octet »

I look forward to info stealers dumping Passkey apps and leakage via additional device enrollment, and not having clear mechanisms for rolling all your Passkeys.

Device attestation and signing transparency logs are quite necessary for users to have visibility of where/when Passkeys have logged in. Really they should also have key ratcheting so stolen keys become useless.

Re: Passkeys: They're not perfect but they're getting better

#119

Post by varjolintu »

josephcsible wrote: post #19
varbhat wrote: post #4

I agree. I use Bitwarden on my Samsung Android phone and also on my Linux desktop. Bitwarden currently supports passkeys on almost all the apps on my android including firefox. The same passkeys which i used to login on my phone can be used on my Linux desktop where i use Firefox with Bitwarden extension. What's now possible was not even possible at the start of this year. I haven't switched everything to passkeys bu…

> I read about Passkey comittee being against open source passkey managers during start of this year (can't reference it, sorry) but with open source password/key managers already supporting passkeys, i don't think it turned out to be true. Here's an Okta employee threatening to use the attestation (anti)feature of passkeys to block open-source implementations, because they allow you to export your passkeys: https://…

FYI: If you export your Bitwarden vault as plain JSON, passkeys are included in plain-text too. So, it works similar to KeePassXC.

Re: Passkeys: They're not perfect but they're getting better

#120

Post by joshuamorton »

throwawayffffas wrote: post #108
joshuamorton wrote: post #106

Earlier quoted context omitted.

I'm not sure what your point is here. How credentials are stolen today is irrelevant to the fact that today , right now, at this very moment, banks can and do already do the thing you're worried will be possible only due to the prevalence of passkeys.

Oh my point is that their device attestation thing is security theater. It's clearly just for getting that iso certification. It's a power play by the platform vendors. The vendors are literally saying: We now have this "security" feature and banks have to use it to be compliant and it only works on our platforms, so I guess you have to use our platform unless you want to be unbanked.

I mean, I would agree that it's not a particularly useful thing for consumer-phone-bank usecases, but that doesn't mean the feature is bad (or harmful).

Just to be clear, no one is saying

> banks have to use it to be compliant

nor are they saying

> it only works on our platforms

As far as I know, if systems were to use attestation it would be in a lot of senses more open than what attestation is available today (in the sense that more devices could use it). But also I don't think anyone who works on passkeys is saying banks need to support FIDO attestation to be "compliant".

Post reply on HN