Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys now support external providers

developer.apple.com

Post reply on HN
Print view View original

131–140 of 185 posts

Re: Passkeys now support external providers

#131

Post by arnarbi »

jiggawatts wrote: post #37

My method for judging the quality of software: Read the latest release notes, negate every statement, and think to yourself: "They were fine with it being like this until now." Passkeys have been advertised as a superior replacement to passwords, but really fundamental issues remain unaddressed. I have one (1) Windows PC and one (1) iDevice. Can I get these to sync? Will both be able to log me in to a Google Account?…

> Will both be able to log me in to a Google Account? Or do I need an Android phone for that?

Yes and no, respectively.

Re: Passkeys now support external providers

#132

Post by microtonal »

gjulianm wrote: post #21
ljlolel wrote: post #19

Earlier quoted context omitted.

The last one is a problem for a lot of use cases. Lots of sites have different domains (also for example when HBO max renamed to max). Plaid also relies on entering bank passwords on neobank sites and is widely used.

AFAIK, passkeys aren't really linked to a domain. It's old-school public-key verification, the server stores your public key and uses it to verify the signature of a challenge they send to your device on login. As long as the different domains/apps can share the public key you should be able to login. And for things like Plaid, I think banks are moving towards OAuth-style permissions, where you login to your bank and…

AFAIK, passkeys aren't really linked to a domain. It's old-school public-key verification, the server stores your public key and uses it to verify the signature of a challenge they send to your device on login. As long as the different domains/apps can share the public key you should be able to login.

The credentials are scoped to a relying party, which must be equal to the domain or registrable domain suffix:

https://www.w3.org/TR/webauthn-2/#scope

If this wasn't the case and it was old-school public-key verification, it would still be vulnerable to phishing, since the phishing site could just forward the challenges.

Re: Passkeys now support external providers

#133

Post by labcomputer »

ckastner wrote: post #10

Of all the recent publications with regards to passkeys, FIDO2, WebAuthn, etc., finally there's one with a simple and concise summary of the benefits: > Strong credentials. Every passkey is strong. They’re never guessable, reused, or weak. > Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers. > Safe from phishing. Passkeys are intrinsically linked with the app…

> Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers

That’s not quite true, though. What is true is that the server does not have a plaintext copy of your private keys. That’s a crucial difference.

The server has an encrypted copy of your private key, which your with token decrypts with its private key. That is how a usb key can store an unlimited number of U2F credentials: The USB key isn’t storing them at all. They are stored on the server you are authenticating to.

What this also means is that if there is a backdoor in the crypto algorithm used by your token and an attacker gets a copy of the server’s U2F credentials, then you are at risk of having your private key stolen.

Re: Passkeys now support external providers

#134

Post by [deleted] »

tialaramex wrote: post #29
gjulianm wrote: post #21

Earlier quoted context omitted.

AFAIK, passkeys aren't really linked to a domain. It's old-school public-key verification, the server stores your public key and uses it to verify the signature of a challenge they send to your device on login. As long as the different domains/apps can share the public key you should be able to login. And for things like Plaid, I think banks are moving towards OAuth-style permissions, where you login to your bank and…

> AFAIK, passkeys aren't really linked to a domain. It's old-school public-key verification, the server stores your public key and uses it to verify the signature of a challenge they send to your device on login. As long as the different domains/apps can share the public key you should be able to login. In principle the fancier systems with a user interface could add a feature where you can change the DNS names assoc…

[deleted]

Re: Passkeys now support external providers

#135

Post by awinter-py »

Ajedi32 wrote: post #95
jsmith99 wrote: post #2

Originally seen via https://reddit.com/r/Bitwarden/comments/141uxz1/iosipados_17... This is big news as vendor lock in and inability to use our own sync was one of the biggest issues bought up whenever Passkeys are discussed. Apple are now allowing external sync fabrics such as password managers.

Yeah, this is awesome. The devil's in the details though, do we know anything about exactly how they plan to support external providers? I'm cautiously optimistic; at least on the surface this sounds like exactly what I was hoping for.

I mean apple has a tried and true playbook for supporting external providers, I'm not worried

charge them random % of revenue, force them to funnel all transactions through apple, let random junior employees disable the 3rd party's bugfixes for reasons(tm), and eventually refuse to license new entrants because there are too many flashlight apps

I'm not worried

Re: Passkeys now support external providers

#136

Post by runeks »

mcherm wrote: post #86
arianvanp wrote: post #63

Earlier quoted context omitted.

How? you make claims that seem to have no substance. What extra vector does Passkeys add for tracking? I don't see any. Passkeys are an origin-bound login mechanism. Worst case is that somebody places a first-party cookie to keep you logged in after you authenticated with a passkey. which they and will already do today without your consent or without logging in. (First-party session cookies don't even need a cookie w…

Passkeys do not help track people between sites, but if they are used in places that passwords never were, it might increase tracking within a site. Hacker News, for instance, allows non-logged-in read-only usage. If Hacker News decided that Passkeys were so easy for the user that non-logged-in usage would be eliminated, then some degree of privacy would be lost. Personally, I don't think it is that much of a risk. I…

> If Hacker News decided that Passkeys were so easy for the user that non-logged-in usage would be eliminated, then some degree of privacy would be lost.

Not if you the user generates a new login upon every visit, which should be trivial.

Re: Passkeys now support external providers

#137

Post by zamadatix »

ndjdhdidve wrote: post #91

1. article says nothing about external identity providers. which is what everyone here wants. still fully locked in. 2. it only hints at the UI being open to other apps, approved in the app store of course, using their new undocumented api 3. the sharing features will probably happens over their central control. not over the UI implementers. so many misconceptions in these comments. specially mixing up passkeys with…

It starts out saying "Passkeys can now be synced using external providers", how does it say nothing about external providers? I'd love to see the detail as well but, lacking that, there is nothing in the article that says these takes are correct and the others misconceptions either.

Re: Passkeys now support external providers

#138

Post by JulianK »

labcomputer wrote: post #133
ckastner wrote: post #10

Of all the recent publications with regards to passkeys, FIDO2, WebAuthn, etc., finally there's one with a simple and concise summary of the benefits: > Strong credentials. Every passkey is strong. They’re never guessable, reused, or weak. > Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers. > Safe from phishing. Passkeys are intrinsically linked with the app…

> Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers That’s not quite true, though. What is true is that the server does not have a plaintext copy of your private keys. That’s a crucial difference. The server has an encrypted copy of your private key, which your with token decrypts with its private key. That is how a usb key can store an unlimited number of U2…

The idea behind private keys is that they are private and never sent anywhere so I believe your assertion that the server knows anything about your private key is incorrect.

Here's a link to Yubico with a visual diagram of how passkeys work: https://developers.yubico.com/Passkeys/How_passkeys_work.htm...

But fundamentally it's very similar to how all public/private stuff works. You send people the public key and sign stuff with the private key.

Re: Passkeys now support external providers

#139

Post by ezfe »

Ajedi32 wrote: post #95
jsmith99 wrote: post #2

Originally seen via https://reddit.com/r/Bitwarden/comments/141uxz1/iosipados_17... This is big news as vendor lock in and inability to use our own sync was one of the biggest issues bought up whenever Passkeys are discussed. Apple are now allowing external sync fabrics such as password managers.

Yeah, this is awesome. The devil's in the details though, do we know anything about exactly how they plan to support external providers? I'm cautiously optimistic; at least on the surface this sounds like exactly what I was hoping for.

> Password manager apps can save and offer passkeys on iOS, iPadOS, and macOS.

No reason to believe this would work differently than the existing affordances for 3rd party apps to offer passwords, which works well today

Re: Passkeys now support external providers

#140

Post by TheNewsIsHere »

kps wrote: post #119
TheNewsIsHere wrote: post #113

Earlier quoted context omitted.

1Password previously announced that mobile support for passkeys stored in 1Password was on its way later. I assume they had advanced knowledge of this announcement. I totally understand a pessimistic reading. In trying to roll out passkeys to everyone at once, and doing a poor job of UX and documentation clarity, all the major players bungled the 2022 launch. Not having some portability out of the gate absolutely cau…

That's good to hear. If cross-platform sync is possible, passkeys are definitely a better option for the 95% of crud that currently lives in browsers' password managers.

You mean this is annoying?

google.com (never save)

google.com (Jane.Doe)

google.com (Jane.Doe) (Grandma use this one)

google.com (never save)

google.com (Jane.Doe) (password missing)

google.com (Jane.Doe) *Your password may have been exposed in an online breach.

I fully agree with you. Passkeys solve a lot of usability problems, especially for the less technically adept, while solving so many password problems.

Edit: formatting nightmares

Post reply on HN