Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Things I learnt about passkeys when building passkeybot

enzom.dev

Post reply on HN
Print view View original

141–150 of 152 posts

Re: Things I learnt about passkeys when building passkeybot

#141

Post by pseudalopex »

jeroenhd wrote: post #51
coldpie wrote: post #45

Earlier quoted context omitted.

It's fine for them to make suggestions for projects to improve their software. The problem is threatening clients with being banned because they don't agree with those suggestions. If a website is able to ban me because of the passkey client I'm using, then I'm just not going to use passkeys. It's too unreliable. > personally think the ability to export+import passkeys is a good thing from a backup point of view It's…

I don't see where he is threatening anybody? He's just stating the obvious. If you promise to store a key in a non-exportable format and then create a big export button, websites won't trust your software. > What happens if my PC goes down and I couldn't export my data? I just can't log in anywhere? Then you follow the procedure you would follow for when you'd forget your password. Probably a password reset through e…

> I don't see where he is threatening anybody?

The threat he relayed was more serious than the threat he made. But it is a threat when a person with influence suggests they may support a punishment.

> If you promise to store a key in a non-exportable format

There was no such promise. The people who wish Passkeys to replace passwords did not demand it yet even.

Re: Things I learnt about passkeys when building passkeybot

#142

Post by mariusor »

mindslight wrote: post #139
mariusor wrote: post #135

Earlier quoted context omitted.

In the end we all are allowed to just not use a product... aren't we? Vote with your wallet is still possible.

No? A few percent of people dissenting doesn't move the needle for the company analysts, all the "competitors" tend to move in lock step since their managements are all tuned into the same memestream, and using such systems has steadily become more de facto mandatory for many previously-unrelated tasks.

I don't want to "move the needle", I just want to not support scummy companies. It sounded like you did too, but my mistake.

Re: Things I learnt about passkeys when building passkeybot

#143

Post by mindslight »

mariusor wrote: post #142
mindslight wrote: post #139

Earlier quoted context omitted.

No? A few percent of people dissenting doesn't move the needle for the company analysts, all the "competitors" tend to move in lock step since their managements are all tuned into the same memestream, and using such systems has steadily become more de facto mandatory for many previously-unrelated tasks.

I don't want to "move the needle", I just want to not support scummy companies. It sounded like you did too, but my mistake.

I don't know what you mean? My first point was just about how our individual behavior is not going to affect companies' decisions. The subsequent points were about how it's becoming increasingly harder to avoid supporting any scummy companies.

And the more this behavior is normalized, the easier it is for governments to make it illegal for any site to not demand users' government-registered identities.

Re: Things I learnt about passkeys when building passkeybot

#144

Post by cycomanic »

jeroenhd wrote: post #51
coldpie wrote: post #45

Earlier quoted context omitted.

It's fine for them to make suggestions for projects to improve their software. The problem is threatening clients with being banned because they don't agree with those suggestions. If a website is able to ban me because of the passkey client I'm using, then I'm just not going to use passkeys. It's too unreliable. > personally think the ability to export+import passkeys is a good thing from a backup point of view It's…

I don't see where he is threatening anybody? He's just stating the obvious. If you promise to store a key in a non-exportable format and then create a big export button, websites won't trust your software. > What happens if my PC goes down and I couldn't export my data? I just can't log in anywhere? Then you follow the procedure you would follow for when you'd forget your password. Probably a password reset through e…

That's what I still don't understand. Why is "something you have" deemed more secure than "something you know". For a while everyone was harping on MFA, but suddenly passkeys came along and now SFA is fine as long as it's a passkey?

Re: Things I learnt about passkeys when building passkeybot

#145

Post by cycomanic »

xoa wrote: post #123
jeroenhd wrote: post #43

Earlier quoted context omitted.

The point of passkeys is that they're unexportable. Software implementations like Bitwarden/KeepassXC/etc. making them exportable go right against the point of the protocols. I personally think the ability to export+import passkeys is a good thing from a backup point of view, but he's not wrong in suggesting that companies actually using the high security features of passkeys will eventually block software implementa…

> The point of passkeys is that they're unexportable. Software implementations like Bitwarden/KeepassXC/etc. making them exportable go right against the point of the protocols. No, that is absolutely not the point. The points of using pub/priv keys for asymmetric auth instead of passwords (symmetric, manually generated auth) are: - Server-side (ie, central point) hacks no longer matter an iota from a user auth pov. N…

Thank you, you have been the first person to articulate why passkeys are actually an advantage. Everyone else I've read from was focusing on the client side and there I really don't see a significant advantage. In fact it seems it's a downgrade from MFA, so I never understood the push for passkeys.

Re: Things I learnt about passkeys when building passkeybot

#146

Post by godelski »

IgorPartola wrote: post #104
godelski wrote: post #86

Earlier quoted context omitted.

> So if I initially create an account from my MacBook and the passkey gets listed as “MacBook”, I then go to log in from my iPhone and it still uses the “MacBook” passkey because of iCloud sync. But this is confusing because I cannot have an iPhone key. Now try using a Windows or Linux computer... This is why I strongly prefer to not use OSX passkeys. How the fuck am I supposed to login on my nix machines if you only…

Which Linux? And are you saying Windows an Linux options are better or worse?

I more mean being someone that works in multiple ecosystems.

But FWIW, I have the least friction with Linux. But that's more that Windows and Apple have their walled gardens and that's where the friction comes from, though in different ways.

Re: Things I learnt about passkeys when building passkeybot

#147

Post by xboxnolifes »

godelski wrote: post #36

A few weeks ago I had a bug with bitwarden where every passkey wanted to load from the macbook instead of bitwarden. I ended up being locked out of a few accounts that didn't have OTPs as a fallback. Mostly inconsequential stuff like Twitter. I love passkeys, but they're still kinda hard to use. There's several sites that wont let you enroll multiple ones and it's easy for systems to step on each other like the afore…

> All my banking apps have SMS OTP fallbacks and that's no better than having only SMS OTP.

In terms of security, yes. But not in terms of convenience.

Re: Things I learnt about passkeys when building passkeybot

#148

Post by jeroenhd »

pseudalopex wrote: post #141
jeroenhd wrote: post #51

Earlier quoted context omitted.

I don't see where he is threatening anybody? He's just stating the obvious. If you promise to store a key in a non-exportable format and then create a big export button, websites won't trust your software. > What happens if my PC goes down and I couldn't export my data? I just can't log in anywhere? Then you follow the procedure you would follow for when you'd forget your password. Probably a password reset through e…

> I don't see where he is threatening anybody? The threat he relayed was more serious than the threat he made. But it is a threat when a person with influence suggests they may support a punishment. > If you promise to store a key in a non-exportable format There was no such promise. The people who wish Passkeys to replace passwords did not demand it yet even.

> There was no such promise. The people who wish Passkeys to replace passwords did not demand it yet even.

The specification states otherwise: https://www.w3.org/TR/webauthn-2/

    A credential private key is the private key portion of a credential key pair. The credential private key is bound to a particular authenticator - its managing authenticator - and is expected to never be exposed to any other party, not even to the owner of the authenticator.

Re: Things I learnt about passkeys when building passkeybot

#149

Post by jeroenhd »

cycomanic wrote: post #144
jeroenhd wrote: post #51

Earlier quoted context omitted.

I don't see where he is threatening anybody? He's just stating the obvious. If you promise to store a key in a non-exportable format and then create a big export button, websites won't trust your software. > What happens if my PC goes down and I couldn't export my data? I just can't log in anywhere? Then you follow the procedure you would follow for when you'd forget your password. Probably a password reset through e…

That's what I still don't understand. Why is "something you have" deemed more secure than "something you know". For a while everyone was harping on MFA, but suddenly passkeys came along and now SFA is fine as long as it's a passkey?

It's not more secure. It's as secure.

MFA is more secure: you combine multiple factors of authentication. You could do password + passkey, password + TOTP token (assuming such tokens are not exportable either), password + biometrics, passkey + biometrics, even TOTP + biometrics would be MFA.

I don't think anyone proposes replacing MFA with passkeys, most proponents are proposing replacing passwords with passkeys.

A second question is "is MFA still necessary when using passkeys", as passkeys are generally more secure than the Welcome1234! type passwords most people use. I'd argue that for quite a few non-critical services, it wouldn't be. More and more services have started requiring 2FA because the damage of accepting passwords alone was too great, and with passkeys I don't believe the same damage would occur.

It'd still be a good to offer the option. In fact, I think passwords should be offered as a second option; combining passkeys with something like TOTP would be close to useless as the same thing you use to validate the passkey probably also generates the TOTP codes.

Amazon actually does MFA with passkeys: you can log in with a passkey but it'll still ask you for a TOTP code. I'd rather combine password and passkey, but at least they're not completely turning off the additional layer of security.

Re: Things I learnt about passkeys when building passkeybot

#150

Post by wkat4242 »

ximm wrote: post #82
wkat4242 wrote: post #62

Earlier quoted context omitted.

It does not work for me on my Linux PC with Firefox, PayPal simply refuses to enrol passkeys and Amazon tries but then gives an error. I haven't tried chromium as I don't have it installed. I'll give it another try though. The last time was 1 year ago. I don't normally use Bitwarden so I have to set it up from scratch with vaultwarden etc.

This is probably a Linux issue. Mac OS and Windows implement the FIDO2 Platform API, which allows them to act as authenticators themselves. Linux does not. See https://github.com/linux-credentials .

With macOS and Windows I'm still stuck in corporate ecosystems though which was my point. I used to use Mac but I couldn't deal with the increasing iOSification and I only use windows now for gaming (VR) because it's such an awful OS.

But that's another point, I do use many OSes so being locked in to one ecosystem is not an option. I must also have the option to back up my credentials at all times (eg a cloud service will never suffice)

But yeah I should have mentioned Linux. I thought it was the norm here really especially among people advocating against corporate ecosystems.

Post reply on HN