Computerphile added a passkey video today https://www.youtube.com/watch?v=xYfiOnufBSk
I just watched this, it is very good.
Things I learnt about passkeys when building passkeybot
111–120 of 152 posts
Re: Things I learnt about passkeys when building passkeybot
#112Earlier quoted context omitted.
The point of passkeys is that they're unexportable. Software implementations like Bitwarden/KeepassXC/etc. making them exportable go right against the point of the protocols. I personally think the ability to export+import passkeys is a good thing from a backup point of view, but he's not wrong in suggesting that companies actually using the high security features of passkeys will eventually block software implementa…
Both things can be true: 1) that they're enforcing these specs for technical reasons, not because they want vendor lock-in 2) a result of these decisions in the long term is vendor lock-in
I agree with this, but I think the spec author's public statements means we don't need to give them the benefit of the doubt. People have repeatedly pointed out how this will result in vendor lock-in, and their response is either "yep, working as intended" or "we don't want to talk about this anymore." They're just steamrolling ahead with support from all the Big Tech companies. It's a really ugly situation =/
Re: Things I learnt about passkeys when building passkeybot
#113Earlier quoted context omitted.
How else would you make the private key unexportable and the passkey uncopyable?
You wouldn't, and still passkeys don't require this.
Passkeys don't require it, but relying-parties may: https://github.com/keepassxreboot/keepassxc/issues/10407#iss... If enough RPs ban clients that let users manage their own data in the name of "security," then it is effectively required by passkeys. The passkey spec could have been written to be resilient against this type of abuse, but instead this abuse is explicitly considered a feature of the spec.
Re: Things I learnt about passkeys when building passkeybot
#114A few weeks ago I had a bug with bitwarden where every passkey wanted to load from the macbook instead of bitwarden. I ended up being locked out of a few accounts that didn't have OTPs as a fallback. Mostly inconsequential stuff like Twitter. I love passkeys, but they're still kinda hard to use. There's several sites that wont let you enroll multiple ones and it's easy for systems to step on each other like the afore…
If you're using Firefox, it's a known bug and you can fix it by reverting the bitwarden extension and then wait for the fix.
Re: Things I learnt about passkeys when building passkeybot
#115Earlier quoted context omitted.
I don't think this is a security vs usability thing. A lot of UIs are intentionally confusing. Apple wants you to use iCloud passkeys, Microsoft wants you to use Microsoft Account passkeys, Google wants you to use Google passkeys. Even if you have a dedicated USB device plugged in, browsers keep defaulting to the cloud accounts. Bitwarden's approach is to simply hijack the passkey request before the browser can respo…
I remember once I was working for a big tech and we had windows computers. I tried to use Hello so I could login with my fingerprint. It broke outlook for some reason. So I switched to a Yubi key since they were offering. Every login was the same: fails -> try again or try different method -> list of methods (including "security key") -> ok -> tap security key -> ok It would not let me set the key as the default and…
If your desktop browser has Bluetooth access you can scan a barcode with an iPhone.
Re: Things I learnt about passkeys when building passkeybot
#116Earlier quoted context omitted.
It's likely that the websites need your actual government issued credentials are not your twitters and your hacker news, but government websites that actually need to link the web user to the citizen. As an example my country has a portal that you use as a citizen to book appointments to government institutions, keeps you updated about the status of your requests, allows you to securely upload scans for additional do…
until your gov decides that websites need to age-check everyone with the equivalent of showing some ID...
Or corpos decide the time is ripe to force users to do it, so they can better optimize their surveillance targeting. Google has been nagging me with a periodic Android popup for like a decade to "add my birthday to help them comply with the law". Eventually that tack of borderline misleading will turn into an outright demand.
Re: Things I learnt about passkeys when building passkeybot
#117Earlier quoted context omitted.
it's possible with CPU secure attestation, but it's not something you will encounter on regular personal computers. the capability is there, but it would he massively inconvenient, since it requires a lot of lockdown might be the next generation of anti-cheats though
Apple is already shipping remote attestation in Safari in the form of Private Access Tokens ( https://developer.apple.com/news/?id=huqjyh7k ), though Cloudflare's trial for that has ended. Safari authenticates and attests itself against Apple, who hands out tokens to your browser, which in turn get used to bypass CAPTCHAs and other anti spam filters. There's no direct remote attestation implementation for passkeys ye…
> remote attestation for web browsers has been around for a few years now.
May it always remain niche.
A world in which open source browsers are unusable for most people and new entries to the browser market are all but impossible sounds terrible.
Re: Things I learnt about passkeys when building passkeybot
#118Earlier quoted context omitted.
There are two problems with passwords. Reuse, and site breaches. The solution to the former is the same as passkeys: credential managers. Passkeys genuinely solve the second, in exchange for a vastly less comprehensible system (see all the uncertainty people have even here on HN) that doesn't support many of the ways people want to use authentication tokens.
No, the biggest issue with passwords is phishing. You can't phish a passkey.
Sort of. Passkeys push the phishing to the account recovery or passkey enrollment process.
Re: Things I learnt about passkeys when building passkeybot
#119Re: Things I learnt about passkeys when building passkeybot
#120Earlier quoted context omitted.
Apple doesn't do attestation, so effectively this feature is dead in the water.
Per the article, Apple does do attestation. By default attestation is off unless you have enterprise management turned on. But the existence of attestation means Apple could at any time in the future make attestation on by default and suddenly our devices control our secrets more than we do.
No, Apple can't suddenly start doing attestation in the future by default because that would instantly kill all the passkeys that have already been created on Apple devices without attestation. It would be as if a home security company went around and changed all the locks they had installed on their customers' front doors. It would be instant suicide as a trusted vendor.