Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toward a Passwordless Future

privacyguides.org

Post reply on HN
Print view View original

21–30 of 70 posts

Re: Toward a Passwordless Future

#21

Post by grammarxcore »

The big thing missing from the article is how a device that contains many passkeys is any different from a password manager that enforces security settings. I don’t worry about passwords my password manager generates getting compromised because I use at least 24 random characters (assuming my password manager is using a cryptographically secure PRNG that guarantees some level of randomness, giving us more than 128 bits). Assuming I use that to manage the password to my email, I really only have to worry about my password manager key being compromised. I only used my password manager on trusted devices so I really only have to worry about my trusted devices being compromised.

If I use passkeys, I have to worry about my trusted devices being compromised. According to the article, “as long as you can remember your phone password, you can log in to your accounts.” That sounds like my password manager. The other benefits also sound like a combination of my password manager and privacy focus. I’m not saying this is bad; I just don’t see how it’s different from a security-conscious status quo.

Re: Toward a Passwordless Future

#22

Post by kemotep »

I wish first and foremost that all my accounts could support passkeys/passwordless sign ins instead of only like 12/60.

My second wish would be that passkeys should be as easy to work with as ssh keys. Somehow, they tend to be more complicated. Asking you if you want to use your phone or security key (when you have neither, you are using a password manager) and often failing to immediately detect your preferred method of storing them, defaulting to Google, Microsoft, or Apple's solutions.

Re: Toward a Passwordless Future

#23

Post by precommunicator »

skybrian wrote: post #13
leipert wrote: post #6

Earlier quoted context omitted.

What if the provider of the major implementation decides to shut you out of your account?

Well, it's true that a password manager is a single point of failure. If you have two password managers then they can serve as backups for each other. Unfortunately that means you have to register each account twice.

Just use a password manager that allows you to have a local copy of everything (e.g. KeePass) and just back it up as any other file

Re: Toward a Passwordless Future

#24

Post by precommunicator »

ajsnigrutin wrote: post #5
tptacek wrote: post #3

Earlier quoted context omitted.

The same thing that happens if you enroll in 2FA and lose your 2FA cred: you go into a complicated account recovery process. For this reason, at the huge providers, when you enable 2FA (or Passkeys) you usually have to set up a recovery buddy account or something like it.

But if that "buddy account" is 'passworded' by the same passkey device? Getting a new sim card with the same number is easy, you just go to your mobile provider with your ID card, and you're done in five minutes. I mean still... the article mentions a "single point of failure" as a bad thing with other methods, but forgets about it here.

Easy if you're in the same country as the provider. Not so easy if you're on the other side of the planet.

Re: Toward a Passwordless Future

#27

Post by sdsd »

Cool but this (ie pw's) isn't how to steal accounts anyway. Eg when wanting to use AI models for free, just spin up a github dork, no passwords required. Eg, /"Authorization: Bearer xai-.+"/ gives free Grok API key. Try a few until one works and viola.

Plug in the API key and now my app is grokified. or if I'm really wanting that classic experience, ask the free version of grok to spin up a react interface that uses the api key, and then plug in. Wow.

Or if really desperate, make a quick fake NPM package, ask rando dev to npm install it bc its not working with their FOSS project or whatever, say nvm it works now! And it exfiltrates the API key someone wants.

I'd never do any of this bc I'm a latter day saint, but maybe I would if I needed a key in a jiffy who even knows

Re: Toward a Passwordless Future

#28

Post by TheBicPen »

immibis wrote: post #20
acdha wrote: post #14

Earlier quoted context omitted.

That depends on whether you need to have an active account to use your existing devices. For example, an Apple user would need to migrate before things fall out of sync but they have a full copy on every device. The fallback path here is what you’d do with any other MFA loss. It’s not a federated login system so you’d be looking at some kind of account recovery process for each of the sites where you used your passke…

> The fallback path here is what you'd do with any other MFA loss. Which, in many cases, is avoid MFA because it's less secure. Yes, less secure because availability is part of security. And I don't have a better plan to store all those recovery codes than to store all those passwords. So the attacker can still get in with the same effort, but I have to keep getting my phone. No thank you.

I agree that storing recovery codes is a pain point, but they're fundamentally different from passwords in that you don't need to use them for each login. That allows you to put them in cold storage, whether that's an encrypted flash drive, a piece of paper, a box buried in your back yard, or whatever else you want. Doing the same thing for information you need on each login would be ridiculous, but for a once-in-a-blue-moon recovery situation, the lack of convenient access is fine.

Re: Toward a Passwordless Future

#29

Post by tonyhart7 »

grammarxcore wrote: post #21

The big thing missing from the article is how a device that contains many passkeys is any different from a password manager that enforces security settings. I don’t worry about passwords my password manager generates getting compromised because I use at least 24 random characters (assuming my password manager is using a cryptographically secure PRNG that guarantees some level of randomness, giving us more than 128 bi…

well if your hardware is compromised using passwd manager or passkeys is not different at all

for now phone hacked = say goodbye to work,banking etc is not ideal yes but in the future where you can implant chips under skin??? now we talking

Re: Toward a Passwordless Future

#30

Post by sureIy »

ajsnigrutin wrote: post #2

So... what happens with passkeys if you lose/break/someone_steals your phone? I'm talking about normal users, without backups.

They're screwed, but that already happens. You have no idea how many people lose their phone or forget some password and just get a new phone/account, without trying to recover the old one.

Parents who lost their child's photos and are like oh well.

Assuming a normal user doesn't use the same password everywhere (which means everyone already knows their password), the alternative is saving them. Lost password or lost passkey doesn't make much difference.

Computing literacy is low so people will just suffer the consequences.

Post reply on HN