Passkeys will come at a cost

Post by Dylan16807 » Thu, Jul 13, 2023, 11:27 PM UTC

JohnFen wrote: post #139

jauntywundrkind wrote: post #127

Earlier quoted context omitted.

It'd be awesome if you could ask to enroll a variety of other devices all at once, without having them on hand. Requiring ongoing physical access to your crucial backups to do any account enrollment or changes seems like a way to make sure you have your crucial backup way too close to potential disasters. Ideally I wanty backup keys many states away from me. But then I can enroll them! But it feels like there could b…

That would certainly be very convenient, but it would also retain/reintroduce several of the security weaknesses that passkeys are intended to mitigate. The reality is that security is really, really hard. And it remains as true as ever that increased security comes at the cost of decreased convenience. My personal attitude is that I make different security/convenience tradeoffs for different things. I do have and us…

Post by sedatk » Thu, Jul 13, 2023, 11:33 PM UTC

jabbany wrote: post #142

sedatk wrote: post #128

Earlier quoted context omitted.

That's indeed scary. Losing your 2nd factor shouldn't block you from accessing your accounts indefinitely . There should at least be one recovery path outside 2FA be it "printed recovery keys", "email recovery", "support channels", or even (despite being fully insecure) SMS maybe with a grace period (like 48 hours). Backing up your 2FA secrets isn't user-friendly at all, and it's even harder after you've started usin…

This is definitely good advice. My point here is to note that "phones" are not a good 2nd factor, unfortunately, because they're not that durable and are kind of targets of theft. So moving to solely rely on phone sounds like a bad idea. In my case, this was not the end of the world since I use a Yubikey for Google rather than TOTP, so at least my core email services (which represent a huge identity provider) were fi…

Post by katbyte » Thu, Jul 13, 2023, 11:41 PM UTC

someplaceguy wrote: post #154

aseipp wrote: post #132

Earlier quoted context omitted.

You seem to be making up a bunch of scenarios that aren't really relevant (what if someone did this and that with sudo, what if the bytes were stored here). You don't want to understand the actual security model, which is fine, but only on Hacker News can someone say with confidence "actually unphishable public keys that can't be leaked, are not good for security." Again, you might as well be arguing against SSH keys…

I understood the parent poster to be saying that since his passwords are unique and are not stored anywhere, then if his device were to be compromised, the attacker could only steal a password once it is manually entered, in which case it wouldn't automatically compromise his other passwords. Conversely, if he were to use a password manager on his device to store passkeys, the attacker could compromise all his passke…

Post by wkat4242 » Thu, Jul 13, 2023, 11:47 PM UTC

saulrh wrote: post #15

vorpalhex wrote: post #4

Earlier quoted context omitted.

Is there a clear path to a yubikey device supporting 1000+ resident keys and doing so well in the near future? What does the cost look like? Are we talking $50 or $500?

Presumably Yubico's upgrade path is to tweak the form factor slightly so they can fit more than a few kb of memory into the thing. I know that it's possible, I can buy 50GB flash drives in the micro yubikey form factor, the ones that are just a rectangle of plastic that fits in under a USB-A port's tongue, and they only cost like $10. So it's probably just something that Yubikey needs to design into the next gen of k…

Post by wkat4242 » Thu, Jul 13, 2023, 11:51 PM UTC

Melown wrote: post #168

It's all about the FIDO2 hardware attestation. I'd rather use a FIDO2 authenticator with attestation. Call it a passkey or not, I don't want the to use the syncable passkeys without hardware attestation.