Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bringing passkeys to Android and Chrome

android-developers.googleblog.com

Post reply on HN
Print view View original

251–260 of 264 posts

Re: Bringing passkeys to Android and Chrome

#251

Post by webmobdev »

stavros wrote: post #171

The thread here seems like a dumpster fire to me. Everyone here is worrying about lock-in to an open standard, so I want to clarify things. WebAuthn is an open standard. It's a way for you to prove to a website that you have a specific private key. There's no lock-in, because the key is portable (unless you don't want it to be). There's no privacy issue, because the key is unique per website. There's no security issu…

> There's no privacy issue

There is a real privacy issue if online services will now force you to store your "passwords" on a device - whether it be in your phone or a password manager.

Re: Bringing passkeys to Android and Chrome

#252

Post by webmobdev »

woojoo666 wrote: post #143
throw10920 wrote: post #79

Earlier quoted context omitted.

Yup - GP made the mistake of treating HN as a single person with a coherent opinion. It's not, and it's extremely tiring and intellectually uninteresting to repeatedly see people doing that.

Your GP did not treat HN as a single person, they are simply pointing out population trends. And these trends are important when analyzing the dynamics of a democratic (upvote-based) content platform

HN is not really a pure "democratic (upvote-based)" system as moderators can (and do) "interfere" in the process - they can remove comments or bring a low ranking comment to the top of the discussion if they feel that a discussion on that might be more interesting for the HN crowd.

Re: Bringing passkeys to Android and Chrome

#253

Post by selykg »

tjoff wrote: post #226
selykg wrote: post #173

Earlier quoted context omitted.

You realize you can have multiple devices for Passkeys, right? It’s webauthn. Which means you can have one or more of the following, in any mix you wish: yubikey, iPhone, Android device, password manager that has said they’ll support this (1Password, Bitwarden, Dashlane, and probably more). Password managers will sync the private keys between devices as well. So, as long as you can access your password manager you sh…

You can't sync between yubikeys so not sure what that would add to the mix.

Bro, you're just being difficult here.

You have choices now, whereas before you had basically one.

Yubikey offers you a hardware device specifically for this purpose. It can't be copied and it really is the definition of something you know and something you have. It has pros and cons, one of those cons being that if you want to use them you are stuck having multiple devices, one for a backup.

Don't like that con? Well, play the game a little and you have additional options coming. Such as the solutions from password managers and platforms like Apple and iOS. Add your sites in a password manager and it'll sync between devices, you basically only have to add one single thing (your password manager) and as long as you have password manager access you can sign in to those sites anywhere that your password manager is available, and where it isn't you gain the QR code passkey option that is being added.

You can mix and match this to your hearts content. Want to use a Yubikey as a backup? Add the device to your sites, stash it away where necessary. Yes, the con of having to add it to each site is still there but it is an option. Want to use all of these? Sure can. Add your iOS device, your password manager, and your Yubikey.

Want to only use one? Just add that device. But you might be foot gunning yourself without backups depending on which you use.

Stop being difficult and just use your head a little.

Re: Bringing passkeys to Android and Chrome

#254

Post by acdha »

fleddr wrote: post #250
acdha wrote: post #172

Earlier quoted context omitted.

The flip side is that it’s incredibly easy to use, faster, and means you don’t have to worry about forgotten passwords or phishing. It’s like an order of magnitude faster than less secure MFA options, too.

Well, no, it isn't. Clearly you don't do old people tech support. Passkey? What's that? New word thus meaning unclear. Doesn't seem to ask for an actual pass-anything, so more confusion. No email identifier or thing to remember. How can I know log on at my other device? With a QR code? What on earth is that?

> Well, no, it isn't. Clearly you don't do old people tech support.

Actually, I do — in fact the largest system I work on supports predominantly older people with disabilities. I would strongly suggest that you consider whether your assessment of the relative difficulty levels is skewed familiarity with the existing problems with password systems.

> No email identifier or thing to remember. How can I know log on at my other device? > With a QR code? What on earth is that?

You still use your email address. This replaces passwords, not SSO, and QR codes are only used in some cases for some implementations where you might have restrictions on things like network connectivity. Try the demo here:

https://www.passkeys.io

Here's the signup process:

1. Enter your email address 2. Select the option to use a token 3. Approve your device's prompt (on iOS, this is a system dialog which explains that it's stored on all of your devices using iCloud Keychain and the site owner doesn't get any of your PII)

Note what's not there: picking a secure password, setting up MFA, remembering that password, and entering it reliably every time. You also can't get phished, which seems like something a lot of people would like.

We're familiar with the friction around passwords but consider how many hours a day humanity spends creating passwords, resetting them, dealing with typos, etc. If you support older people or especially those with disabilities, that process is a lot harder. For example, entering a password over a screen reader which meets most site's complexity requirements is terrible. Most non-WebAuthn forms of MFA are pretty painful that way, too, because it requires someone to switch apps, copy/paste or remember a code, switch back, etc. before it times out.

This won't be perfect on day one, I'm sure, but it's already easier and faster to use and that's only going to continue because now the system can be improved by the browser vendor rather than needing every site to agree on improvements.

Re: Bringing passkeys to Android and Chrome

#255

Post by tjoff »

selykg wrote: post #253
tjoff wrote: post #226

Earlier quoted context omitted.

You can't sync between yubikeys so not sure what that would add to the mix.

Bro, you're just being difficult here. You have choices now, whereas before you had basically one. Yubikey offers you a hardware device specifically for this purpose. It can't be copied and it really is the definition of something you know and something you have. It has pros and cons, one of those cons being that if you want to use them you are stuck having multiple devices, one for a backup. Don't like that con? Wel…

Not at all. The options truly suck and makes passwords seem like a godsend. Which it is, until you are forced to use these crappy solutions that only aid in you getting locked out of your digital life and where you have no control of your logins.

I truly hope there is something better coming out of this because this is a nightmare.

Re: Bringing passkeys to Android and Chrome

#257

Post by goalieca »

oezi wrote: post #225
goalieca wrote: post #59

Earlier quoted context omitted.

There will be services from 1password, yubikey, etc. This is actually great news!

I don't think this is possible. The browser doesn't allow other backends for key storage.

https://www.yubico.com/blog/a-yubico-faq-about-passkeys/

Re: Bringing passkeys to Android and Chrome

#258

Post by PassageNick »

webmobdev wrote: post #251
stavros wrote: post #171

The thread here seems like a dumpster fire to me. Everyone here is worrying about lock-in to an open standard, so I want to clarify things. WebAuthn is an open standard. It's a way for you to prove to a website that you have a specific private key. There's no lock-in, because the key is portable (unless you don't want it to be). There's no privacy issue, because the key is unique per website. There's no security issu…

> There's no privacy issue There is a real privacy issue if online services will now force you to store your "passwords" on a device - whether it be in your phone or a password manager.

The passkeys are stored in a Trusted Platform Module, and as far as I know, it is basically impregnable, even with access to the physical device.

Re: Bringing passkeys to Android and Chrome

#259

Post by novok »

stavros wrote: post #171

The thread here seems like a dumpster fire to me. Everyone here is worrying about lock-in to an open standard, so I want to clarify things. WebAuthn is an open standard. It's a way for you to prove to a website that you have a specific private key. There's no lock-in, because the key is portable (unless you don't want it to be). There's no privacy issue, because the key is unique per website. There's no security issu…

As long as you don't need master key escrow to essentially be with the vendor (ex google / apple), you can have the master key backed up elsewhere so you can pass the mud puddle test [0], and the vendor has no way to access the master key, I'm ok.

But push google / apple about solving mud puddle problems and it's curiously missing from their wallet implementations and they stutter around it when they give talks about FIDO2 and such and people ask them. It's the lock in direction they see everyone going towards that makes people uncomfortable.

[0] https://blog.cryptographyengineering.com/2012/04/05/icloud-w...

Re: Bringing passkeys to Android and Chrome

#260

Post by dickhardt »

dickhardt wrote: post #154
jjnoakes wrote: post #132

Earlier quoted context omitted.

I have over 500 online accounts. Imagine if all of them used a login method where I had to have backup devices registered, instead of just me backing up the credentials (like I do today with a password manager). With backup devices, whenever I upgrade or replace a device, I need to go to each of the 500+ online accounts and register the new device. This is much more work than a quick login to each site via my passwor…

I founded Hellō to solve this problem. A neutral service where you get to choose how to login, and how you can recover your Hellō Wallet. Done. See Show HN post I wrote this morning https://news.ycombinator.com/item?id=33178285

doh -- https://news.ycombinator.com/item?id=33177705
Post reply on HN