Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys and Modern Authentication

lucumr.pocoo.org

Post reply on HN
Print view View original

121–130 of 212 posts

Re: Passkeys and Modern Authentication

#121

Post by tptacek »

palata wrote: post #101
karmarepellent wrote: post #17

Earlier quoted context omitted.

This is incorrect. SSH certificates work just like x509 certificates in that regard. Also, with PubkeyAuthentication, there exist all kinds of ways to collect host keys before connecting to them for the first time and thus avoiding the trust-on-first-use problem. Especially in private networks where you control all the nodes.

SSH does have certificates, but in practice most people using SSH don't use SSH certificates and don't check the fingerprints. Not sure if we can say it's solved if nobody wants to use it by choice (certificates are probably mostly used in enterprise setups, but in my experience it's not even that common there).

If you have a small, stable number of hosts, an SSH PKI doesn't make a lot of sense. With a large fleet, and/or if you want to tie your fleet into an OIDC IdP, certificates are pretty common; the most common way of solving this problem, I think?

Re: Passkeys and Modern Authentication

#122

Post by tuckerman »

AndrewDucker wrote: post #96
tuckerman wrote: post #5

Earlier quoted context omitted.

Where is the line exactly though? If the password manager put up a big red notice when trying to export in plain text is that enough? If not, why not? I am sympathetic to the intent but the words of Patrick Henry come to mind too often in conversations like these. I love passkeys and appreciate secure defaults but I feel strongly that user freedom is a more fundamental requirement than preventing phishing attacks.

Because many end users will ignore that. And this technology is set up to prevent end users from hurting themselves, even if that constrains technologically capable ones.

My values are such that it’s inappropriate for a few folks at companies and random consortiums to make that decision on behalf of all society.

If KeepassXC wanted to enforce that world view for the safety of their users, it’s their right, but this is essentially a threat of blacklisting an entire password manager for adding a feature demanded by their users (who likely predominantly used by technically savvy users at that).

Re: Passkeys and Modern Authentication

#123

Post by xeonmc »

ajsnigrutin wrote: post #82
juancn wrote: post #18

Signing into my accounts on my children’s devices has turned from a straightforward process to an incredibly frustrating experience. I find myself juggling all kinds of different apps and flows. This strikes home for me, I'm the main gatekeeper of passwords and service accounts in my home. 2FA and passkeys are so annoying to juggle. My kids use prepaid numbers, once I changed one and forgot to tell Apple, when I real…

Passwords + OTP (stored in keepass or somewhere) is the win for me. Everything else is a security theatre and an UX pain.

I use my OTP secret as my account password, best of both worlds for portability!

Re: Passkeys and Modern Authentication

#124

Post by tuckerman »

palata wrote: post #104
hooverd wrote: post #84

Earlier quoted context omitted.

Effectively ceding control of your online identity is a feature? Would you be willing to bet real money that the passkey attestation feature will never be abused be these same companies ?

How is that effectively ceding control of your online identity? You can buy a security key (that does not have your name on it), have it generate a FIDO2 key and use it as a passkey. You can have 100 Yubikeys for 100 different websites if you want. But you can't ever export the private key from the Yubikey, and that's a feature. That's the whole point of the Yubikey.

I think there is a difference between a specific implementation of passkeys not allowing export as a feature and the article’s linked GitHub thread with a threat of potentially blacklisting an implementation if it allows export [1]. Imo users need the fundamental freedom to choose.

[1] https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

Re: Passkeys and Modern Authentication

#125

Post by esseph »

jrochkind1 wrote: post #85
tptacek wrote: post #71

Earlier quoted context omitted.

They're about the same. The important factor is phishing resistance (neither TOTP nor email links have that), and an account that has lost its primary email account is 99% of the time already boned. I would use TOTP in preference to email backup, but that's mostly an affectation. The reality is that TOTP has been obsolete for awhile now. It's a net negative for ordinary users that is kept front-of-mind for everyone b…

This is actually the first I've heard of this, re considering TOTP to be not worthwhile. Can you recommend some links to material for me to read to get up to speed with the argument?

TOTP is not phishing resistant, passkeys are. Also can screen grab TOTP.

Re: Passkeys and Modern Authentication

#126

Post by jesseendahl »

arccy wrote: post #109
dan-robertson wrote: post #29

What do security professionals think about passkeys? In particular, those who were not involved in designing them. Lots of the arguments in this article feel very much like the sort of thing one would expect from someone into open source (not saying they are wrong, and I think they are well explained here) but I feel they will inevitably be the product of different concerns than those a security practitioner might ha…

Pretty much everyone likes them? Nobody likes passwords, especially passwords by users. Passkeys essentially force the users to have some sort of password manager, whether third party, or OS / browser integrated. Plus they're unphishable in normal use. They're technically weaker than password + hardware key but stronger than anything else, including password + totp. Google Advanced Protection still wants you to have…

Google's Advanced Protection Program supports both passkeys and security keys.

Re: Passkeys and Modern Authentication

#127

Post by jesseendahl »

palata wrote: post #102
AlexandrB wrote: post #64

Earlier quoted context omitted.

Phishing is different (from the user's POV) than exporting a password and "giving it away". I don't see how phishing would be applicable to passkey exports.

> Phishing is different Nope, it's exactly that: tricking people into believing that they are exporting their passkey securely where actually they are sharing it with the attacker. > I don't see how phishing would be applicable to passkey exports. Phishing is applicable to everything humans can do: if you can ask a human to do it, you can phish a human to do it.

Not sure why this is being downvoted. This user (palata) is correct — phishing is any attempt by an attacker to trick a user into giving up sensitive information.

For anyone who is confused:

https://www.cloudflare.com/learning/access-management/phishi...

Re: Passkeys and Modern Authentication

#129

Post by jazzyjackson »

akazantsev wrote: post #80
unsnap_biceps wrote: post #37

Earlier quoted context omitted.

The walls are going to come down. KeyPassX supports passkeys and allows you to export them as you wish. 1Password and Apple Passwords have both said they're going to support exporting and importing of passkeys. Yes, it's awful during the transition period while the tech matures, but there is a path towards a great future.

> KeyPassX supports passkeys and allows you to export them as you wish. The last time I tried to use passkeys, the desktop was easy. What about mobile? There wasn't a local third-party password manager that could work with passkeys on Android.

Looks like bitwarden supported this since May 2024, and vaultwarden as well. Can be self-hosted, but you're looking for something that doesn't sync at all / local-only?

https://bitwarden.com/blog/bitwarden-passkeys-mobile/

https://vaultwarden.discourse.group/t/passkeys-in-bitwarden-...

Re: Passkeys and Modern Authentication

#130

Post by rlpb »

tptacek wrote: post #120
rlpb wrote: post #119

Earlier quoted context omitted.

OpenSSH supports DNSSEC-published host key fingerprints.

Leaving off everything else I think about DNSSEC, this is a baffling feature. DNS solves the problem of introducing unrelated counterparties, which is not the SSH host key problem --- people generally don't SSH into hosts they're not somehow affiliated with. This is what CA-based PKIs are made for, and OpenSSH has a good (non-X.509) certificate system already; lots of people use it to get e.g. SSO login for SSH. Tyin…

> people generally don't SSH into hosts they're not somehow affiliated with

git remote add ... git+ssh://user@github.com/... comes to mind as a counterexample, although I admit there aren't many of these examples and GitHub also supports authenticated https:// with git. GitHub don't publish SSHFP DNS records either it seems, but the feature is there in the client.

Post reply on HN