Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bringing passkeys to Android and Chrome

android-developers.googleblog.com

Post reply on HN
Print view View original

231–240 of 264 posts

Re: Bringing passkeys to Android and Chrome

#231

Post by oezi »

Mindless2112 wrote: post #181
stavros wrote: post #171

The thread here seems like a dumpster fire to me. Everyone here is worrying about lock-in to an open standard, so I want to clarify things. WebAuthn is an open standard. It's a way for you to prove to a website that you have a specific private key. There's no lock-in, because the key is portable (unless you don't want it to be). There's no privacy issue, because the key is unique per website. There's no security issu…

> If you don't like Google or Apple, use your favorite password manager. Unless the service you are trying to use requires that you use a particular model of authenticator, which the service provider can enforce via attestation.

Isn't it even worse? Browser vendors don't even offer any way to not use their baked-in authenticator? With WebAuthn they offered at least the options of using a security key via Bluetooth/NFC/Bluetooth as alternatives to the device authenticator. I don't see that option with passkeys.

So, there seems no way to use a password manager with passkeys.

Re: Bringing passkeys to Android and Chrome

#232

Post by oezi »

pabs3 wrote: post #229
oezi wrote: post #222

Earlier quoted context omitted.

...a (good) tutorial for website developers

Yes, but it has a lot of info on how they work.

Yes, the tutorial is good, but as often only discusses the server side and javascript side of the standard and doesn't talk about the client device side.

Re: Bringing passkeys to Android and Chrome

#233

Post by throwaway41597 »

skybrian wrote: post #217
throwaway41597 wrote: post #148

Earlier quoted context omitted.

The lock-in is very real and relevant. Websites already have a hard time to get users to sign up, so requiring them to enroll backup authenticators (which they won't have) is not going to work. Printing or writing down backup codes is even worse from a UX point of view. IIRC the spec has a flag to hint that the passkey is backed up (in iCloud or your Google account) so the relying party (website) knows whether backup…

That's a good point, but on the other hand, this "lock in" doesn't seem worse from how Chrome generates and saves passwords now? It would be ideal to set up backup auth before you need it, but you could also do it when you decide to move off Google. So, not really a lock. It's a vulnerability, though, if you lose access to the Google account for some reason.

Chrome allows you to export saved password in CSV (chrome://settings/passwords) So I'd say it is a regression in this regard. You won't be able to switch to an other browser easily, you'll have to go to each websites and change/add authentication methods as far as I know.

Re: Bringing passkeys to Android and Chrome

#234

Post by stavros »

xg15 wrote: post #227
stavros wrote: post #171

The thread here seems like a dumpster fire to me. Everyone here is worrying about lock-in to an open standard, so I want to clarify things. WebAuthn is an open standard. It's a way for you to prove to a website that you have a specific private key. There's no lock-in, because the key is portable (unless you don't want it to be). There's no privacy issue, because the key is unique per website. There's no security issu…

> There's no lock-in, because the key is portable (unless you don't want it to be). > There's no security issue, because it's unphishable and can be unstealable if it's in hardware. You mean, you can (in theory) choose whether you'd rather have a lock-in or a security issue. Both options are mutually exclusive, you can't have them both at the same time.

No, I don't. You don't have to use Google's thing, use an open source password manager that syncs via Dropbox or whatever. Same thing, different vendor.

Re: Bringing passkeys to Android and Chrome

#235

Post by stavros »

oezi wrote: post #228
stavros wrote: post #171

The thread here seems like a dumpster fire to me. Everyone here is worrying about lock-in to an open standard, so I want to clarify things. WebAuthn is an open standard. It's a way for you to prove to a website that you have a specific private key. There's no lock-in, because the key is portable (unless you don't want it to be). There's no privacy issue, because the key is unique per website. There's no security issu…

> EDIT: If you want to try it, I just verified that https://www.pastery.net/ works great with Passkeys even though I haven't touched the code in a year. It does not work with Chrome on Android.

Ah, thanks, I'll look into it.

Re: Bringing passkeys to Android and Chrome

#236

Post by stavros »

oezi wrote: post #221
stavros wrote: post #175

Earlier quoted context omitted.

Yes, you can. It's an open standard. Bitwarden can (and probably will) just support it.

I don't see how that would work without integration into browsers.

It won't, there is integration into browsers for this right now.

Re: Bringing passkeys to Android and Chrome

#237

Post by stavros »

pabs3 wrote: post #205
stavros wrote: post #178

Earlier quoted context omitted.

Firefox has supported WebAuthn for years.

It doesn't support passkeys though. They are software-only WebAuthn, while Firefox only supports USB device WebAuthn.

Sorry, I meant on mobile (where the OS handles the auth). Desktop probably doesn't, you're right.

Re: Bringing passkeys to Android and Chrome

#238

Post by stavros »

quadrifoliate wrote: post #192
stavros wrote: post #171

The thread here seems like a dumpster fire to me. Everyone here is worrying about lock-in to an open standard, so I want to clarify things. WebAuthn is an open standard. It's a way for you to prove to a website that you have a specific private key. There's no lock-in, because the key is portable (unless you don't want it to be). There's no privacy issue, because the key is unique per website. There's no security issu…

> The thread here seems like a dumpster fire to me. Everyone here is worrying about lock-in to an open standard. There is a certain fiddling-while-Rome-burns quality to this comment. The blog post is not about the open standard, it explicitly focuses on a specific company's products. People are naturally worried about this even though the standard may be open, because we are at historically high levels of platform lo…

Right, but that's like Gmail coming out and people complaining about another proprietary product locking people in. There are two issues with the current comments:

1. Absolutely nobody currently uses WebAuthn. I'm extremely excited about the popularization, which, unfortunately, requires big players to get behind it.

2. The comments feel very "oh my God this car I'm driving is heading towards the edge of the cliff even faster". Don't use Google, they're unreliable and evil. While I'm very excited about Passkeys popularizing WebAuthn, I don't think anyone should ever rely on Google for authentication, so just don't use them and use Bitwarden instead, if/when it supports Passkeys.

A vendor coming up with an implementation of a great standard isn't the problem, the fact that people use it is the problem.

Re: Bringing passkeys to Android and Chrome

#239

Post by xg15 »

stavros wrote: post #234
xg15 wrote: post #227

Earlier quoted context omitted.

> There's no lock-in, because the key is portable (unless you don't want it to be). > There's no security issue, because it's unphishable and can be unstealable if it's in hardware. You mean, you can (in theory) choose whether you'd rather have a lock-in or a security issue. Both options are mutually exclusive, you can't have them both at the same time.

No, I don't. You don't have to use Google's thing, use an open source password manager that syncs via Dropbox or whatever. Same thing, different vendor.

Sure I can. But then, if an attacker gains access to my device, so can they. They can just set the phone to sync with their own cloud service.

Phishing would also be back on the table: The phishers' narrative would just change to something like "Dear $user, we're upgrading our systems. For technical reasons, please change your sync target to $url, otherwise you will lose access to all your logins. Yours truly, Dropbox"

My understanding was that many of the advertised security properties of passwordless logins stem from the property that no one, not even the owner of the account has access to the key. This renders phishing impossible because the user cannot physically give away the key even if they wanted to.

But that solution is fundamentally incompatible with copying the key to anywhere else.

Re: Bringing passkeys to Android and Chrome

#240

Post by mimi89999 »

stavros wrote: post #235
oezi wrote: post #228

Earlier quoted context omitted.

> EDIT: If you want to try it, I just verified that https://www.pastery.net/ works great with Passkeys even though I haven't touched the code in a year. It does not work with Chrome on Android.

Ah, thanks, I'll look into it.

It's a known issue with Android. You need to install Play Services beta. It will work flawlessly.
Post reply on HN