Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden adds support for passkeys

bitwarden.com

Post reply on HN
Print view View original

151–160 of 172 posts

Re: Bitwarden adds support for passkeys

#151

Post by GoblinSlayer »

noman-land wrote: post #86
jerf wrote: post #51

Earlier quoted context omitted.

I hope they get over that. It's a blob of data. It's no more special than a TOTP secret or a conventional password, and I am completely uninterested in pretending otherwise because of a slick marketing campaign. It's a "thing I know" whether anybody likes it or not and you can't turn it into a "thing I have" just because you won't let me export it from this particular software. (Proof that it is a "thing I know": It…

I see this common refrain from people. How is writing something down so that you don't have to remember it a "thing you know"? You literally don't know it. A "thing you know" never leaves your brain, otherwise it becomes a "thing you have".

Password database is often protected with a master password, so accessing it requires a thing you know.

Re: Bitwarden adds support for passkeys

#152

Post by GoblinSlayer »

lxgr wrote: post #124
SheinhardtWigCo wrote: post #53

Earlier quoted context omitted.

You're not really vulnerable to phishing if you use a password manager with a browser extension. Cross-platform import/export for passkeys is considered a "nice-to-have" because you can always just add a new device via other established factors (email/SMS). So, what's the point, then? Why can't passkeys just be strings that I can extract via biometric authentication? The answer: everyone pushing this has a significan…

> Why can't passkeys just be strings that I can extract via biometric authentication? As much as that lock-in annoys me personally – I could absolutely see this become a tech support scam attack vector. "Please share your passkey with us for authentication by going to your device's settings and selecting the 'export passkey' option"... > you can always just add a new device via other established factors (email/SMS) T…

Rename "export passkey" to "backup passkey". Or backup whole database.

Re: Bitwarden adds support for passkeys

#153

Post by SAI_Peregrinus »

jerf wrote: post #91
noman-land wrote: post #86

Earlier quoted context omitted.

I see this common refrain from people. How is writing something down so that you don't have to remember it a "thing you know"? You literally don't know it. A "thing you know" never leaves your brain, otherwise it becomes a "thing you have".

It comes from the fact there are three fundamental ways to authenticate: a thing you know, a thing you have, a thing you are. You may not "know" a passkey or a TOTP token, but you are using computers in their most fundamental role as bicycles for the mind to "know" them for you. This means they still fit into "thing you know". Clearly a TOTP token is not a thing you are. Less clearly, it is not a thing you have. Pass…

> there are three fundamental ways to authenticate: a thing you know, a thing you have, a thing you are.

Rather observations of each of those things. A "thing you are" is in practice just a "thing you have". You have a finger, with a fingerprint on it. That gets measured, and that measurement can be faked or your finger can be taken from you.

And of course "things you have" can usually be duplicated with sufficient effort. Even "physically unclonable functions" just rely on process variation in semiconductor manufacturing, with sufficient effort (FIB workstation for manual trimming) it's likely possible to clone even those.

Re: Bitwarden adds support for passkeys

#154

Post by charcircuit »

afiori wrote: post #143
charcircuit wrote: post #135

Earlier quoted context omitted.

The server is not checking if you have a piece of paper. It is checking if you can produce a piece of information. If someone steals your paper, copies the password to their phone, and then returns your paper, then the attacker can log in without that piece of paper. In a true "something you have" if you have that something then it is impossible for someone to login to your account.

I agree with the general sentiment but every non-quantum "thing you have" can be duplicated. PS: I suspect that you could make a 2FA protocol capable of detecting duplication of the thing you have by having the app generate signed codes like "this is the n-th code I have generated" and have the server remember the n as a logical clock to detect duplicates and "time travel". AFAIK only bank-type apps would use somethi…

>but every non-quantum "thing you have" can be duplicated.

Not easily. Extracting keys from hardware keys is very hard to do.

Re: Bitwarden adds support for passkeys

#155

Post by wkat4242 »

lxgr wrote: post #129
wkat4242 wrote: post #73

Earlier quoted context omitted.

But. If you run your own vaultwarden there must be a way to export it.

Vaultwarden never sees the unencrypted vault contents though, does it? The way to export would be in the client applications, not the storage implementation.

Oh good point yes.

At least the clients are open source so it should be possible to write an exporter.

Re: Bitwarden adds support for passkeys

#156

Post by lxgr »

veeti wrote: post #145
lxgr wrote: post #124

Earlier quoted context omitted.

> Why can't passkeys just be strings that I can extract via biometric authentication? As much as that lock-in annoys me personally – I could absolutely see this become a tech support scam attack vector. "Please share your passkey with us for authentication by going to your device's settings and selecting the 'export passkey' option"... > you can always just add a new device via other established factors (email/SMS) T…

Can't we just put a 100px blinking red text that says "Do not share this with anyone or it's your own fault" and be done with it?

It would be great if that were actually 100% effective, but unfortunately phishing still happens despite such warnings.

In a situation where a message on a screen tells a person to do x, and a person on the phone tells them to disregard it because it’s a computer error or whatever and do y, some percentage of people will do y.

The only way to prevent that is for there to be only one option – the safe one. Sometimes that has unacceptable other implications of course; this might well be such a case.

Re: Bitwarden adds support for passkeys

#157

Post by andix »

minedwiz wrote: post #78
andix wrote: post #46

Earlier quoted context omitted.

Looks like it not really released yet. I still have 2023.9.x everywhere, and 2023.10 is the version with passkey support.

It's definitely out ( https://github.com/bitwarden/clients/releases/tag/browser-v2... just looks like browsers haven't approved it yet.

I don't want to start a philosphical discussion. But I still can't install the browser extension to use it, so I wouldn't consider it being "out".

Re: Bitwarden adds support for passkeys

#158

Post by andix »

archi42 wrote: post #96
andix wrote: post #49

Earlier quoted context omitted.

In theory the Bitwarden server (and Vaultwarden) shouldn't have any access to the passwords, so a data breach of the server should never disclose any contents of the vault. Vaultwarden "feels" safe to me, but I would also be interested if there is some possibility it could introduce some degraded security compared to the official Bitwarden server. My Vaultwarden instance is "hidden" on a subdomain that probably nobod…

1. If an attacker got your credentials, they'll probably also have the server URL. Reasoning: They probably infected your machine with infostealer malware and keylogged the password. Or are you using the exact same credentials someplace else? 2. If they can figure out your domain name, they can check crt.sh for "mysecrectvaultwarden.domain.tld". If that only reveals wildcard certs and they're really interested in you…

I know it's not really secure, it's just hidden to some extent. In a way that an average attacker probably wouldn't find it right away. If someone is really looking for it, it can be found.

A VPN would provide better security for sure. But also make it harder to use (VPN needed on all devices).

Re: Bitwarden adds support for passkeys

#159

Post by troyvit »

corytheboyd wrote: post #3
traviswt wrote: post #2

Bitwarden is underrated. Passwords run everything in our digital life. I will gladly take a UI compromise here and there for more trustworthiness.

I don’t even mind the UI honestly. It works. Some annoying UX here and there, but I can live with that. I happily pay for a subscription to support them.

Same here. We use 1Password at work and the braindead UI choices continuously surprise me compared to Bitwarden's simplicity.

Re: Bitwarden adds support for passkeys

#160

Post by halJordan »

yonixw wrote: post #39

From the FAQ [1]: > Q: Are stored passkeys included in Bitwarden imports and exports? > A: Passkeys are not included in imports and exports. I think it's the same for iCloud [2]. That is why I don't love it. I prefer a very long password, and Bitwarden "Device login" that will prompt in my iPhone that will require FaceID (So essentially I have bio login). And 2FA to lower hacking chances. I'm aware I'm still vulnerab…

It's just a false issue. You generate more key pairs when you have more devices. You get a new pw manager? Revoke the old ones and generate new ones. You get a new device? Revoke the old ones and generate new ones. Passkeys are a commodity.

It was a benefit that keys were device locked until the brain trust told you it was user hostile.

Post reply on HN