Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys now support external providers

developer.apple.com

Post reply on HN
Print view View original

181–185 of 185 posts

Re: Passkeys now support external providers

#181

Post by echeese »

danShumway wrote: post #149
echeese wrote: post #118

Earlier quoted context omitted.

> I have one (1) Windows PC and one (1) iDevice. Can I get these to sync? Or do I need an Android phone for that? Yes. In Chromium-based browsers, at least. Your browser will display a QR code which you scan with your phone. Your phone will display a list of accounts you can sign in with, you select one, authenticate, and you're logged in. Firefox support isn't here yet.

Passkey proponents have played really fast and loose with the word "sync" in my experience. No reasonable outside observer would call this syncing, it's cross-device sign-in. It's like saying you can sync your OTP-provider to your desktop computer because when you go to log into a website you manually copy the code into a form. That's not how most people understand the word "sync." What people are excited about here…

my mistake

Re: Passkeys now support external providers

#182

Post by anderspitman »

withinboredom wrote: post #159
anderspitman wrote: post #145

Earlier quoted context omitted.

Do 1password/fastmail have functionality built in for this or do you just manually generate your emails based off a wildcard?

Yes. It’s built-in. https://1password.com/fastmail/

That's awesome

Re: Passkeys now support external providers

#183

Post by MayeulC »

theshrike79 wrote: post #64
jabbany wrote: post #53

Earlier quoted context omitted.

Are you saying they don't use any physical keys? That would be surprising to me... I've found it really easy to teach non-technical people how to use U2F tokens. Just tell them it's like a door key but instead of plugging it in and turning, you plug it in and touch. That's all there is. It's been much more intuitive* to my older family members than SMS codes (that sometimes get lost), authenticator apps (that have a…

The difference is that I can know with significant certainty that shoving my house key in a random lock won't copy the form of my key and send it to a 3D printer where a thief will get it and use it to access my house. How can I know that won't happen when I use my USB dongle on a random coffee shop public computer?

A random lock (or a street-level camera FWIW [1]) would be better positioned to extract enough data to reproduce the key.

U2F tokens are "Trusted Platform Modules" of sorts. The keys themselves are never visible to the devices you plug them in. They are capable of answering challenge/responses, and having the URL part of the challenge prevents phishing[2].

I am much more comfortable not typing any password on a public computer.

[1]: https://www.wired.com/2015/09/lockpickers-3-d-print-tsa-lugg...

[2]: https://en.wikipedia.org/wiki/Universal_2nd_Factor#Advantage...

Re: Passkeys now support external providers

#184

Post by kahnclusions »

labcomputer wrote: post #133
ckastner wrote: post #10

Of all the recent publications with regards to passkeys, FIDO2, WebAuthn, etc., finally there's one with a simple and concise summary of the benefits: > Strong credentials. Every passkey is strong. They’re never guessable, reused, or weak. > Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers. > Safe from phishing. Passkeys are intrinsically linked with the app…

> Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers That’s not quite true, though. What is true is that the server does not have a plaintext copy of your private keys. That’s a crucial difference. The server has an encrypted copy of your private key, which your with token decrypts with its private key. That is how a usb key can store an unlimited number of U2…

This is incorrect, according to Apple’s developer docs, which states that only the public key is sent to servers. They emphasise this as a benefit: your key can’t be leaked because servers only ever receive your public key.

The private key never leaves your device except to be encrypted and synced to your other devices using iCloud Keychain.

Re: Passkeys now support external providers

#185

Post by labcomputer »

JulianK wrote: post #138
labcomputer wrote: post #133

Earlier quoted context omitted.

> Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers That’s not quite true, though. What is true is that the server does not have a plaintext copy of your private keys. That’s a crucial difference. The server has an encrypted copy of your private key, which your with token decrypts with its private key. That is how a usb key can store an unlimited number of U2…

The idea behind private keys is that they are private and never sent anywhere so I believe your assertion that the server knows anything about your private key is incorrect. Here's a link to Yubico with a visual diagram of how passkeys work: https://developers.yubico.com/Passkeys/How_passkeys_work.htm... But fundamentally it's very similar to how all public/private stuff works. You send people the public key and sign…

You may want to dig into the documentation a bit more.

First, ask yourself a simple question: How can a Yubikey store an unlimited number of FIDO2/U2F credentials. The official Yubikey documentation literally claims that Yubikeys can do that. Not “a lot”. Not “more than you’ll ever need”. Not 10k. Not 10M. Not 10G. Unlimited.

Gosh, maybe I should use a Yubikey for mass storage on the cheap! I wonder why nobody has done this?

Second, you’ll want to dig into what is the contents of the “key handle” that is passed from the server, through the user agent, to the key. Hint: Despite the HN hive mind, I’m not wrong.

Post reply on HN