Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

251–260 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#251

Post by secabeen »

9dev wrote: post #215
qzx_pierri wrote: post #27

Earlier quoted context omitted.

I’m in the same boat. Using Passkeys gives the user less control. The last thing I need is another layer of complexity when dealing with credentials. This seems like a solution created for people too lazy to generate and track secure secrets (using a password manager). It also seems like a way companies like Google would lock people into their browser.

Well, passkeys come with another very interesting property: they make it entirely useless to obtain the database of user credentials from services. It only contains public keys specific to a single service, so you cannot use them anywhere else. Additionally, private keys are stored on secure storage in client devices (or need to be decrypted themselves using a second factor), so there’s pretty much 0% risk of mass cr…

> they make it entirely useless to obtain the database of user credentials from services. It only contains public keys specific to a single service, so you cannot use them anywhere else.

This is also the case for anyone using unique passwords per site, which is the standard for password vault users. Not much of a win there.

> Additionally, private keys are stored on secure storage in client devices (or need to be decrypted themselves using a second factor)

Also exactly the same as password vaults, but we still stress about Lastpass losing their encrypted vault DB.

I agree that Passkeys appear to bring the benefits of Password Vaults to people not currently using them in a fairly easy way. However, I worry about access to those passkeys when access to the Passkey provider is lost/revoked.

Re: Bitwarden Acquires Passwordless.dev

#252

Post by selykg »

kevwil wrote: post #246
penciltwirler wrote: post #49

One can easily self host a bitwarden server on digitalocean. https://bitwarden.com/blog/digitalocean-marketplace/ However, I'm curious what y'all think about the cost. A digitalocean droplet for the recommended specs (4 GiB memory) is $24/month. This is hard to stomach when you compare with Bitwarden Premium which is <$1/month. I guess it depends on how much you value your own data.

It makes me think (dangerous, I know) ... I find it odd to use the term "self host" when referring to a third-party cloud. It's someone else's servers and network and electric bill, after all. Pedantry aside, yeah that seems expensive given the amount of convenience offered. But much more convenient than setting up a server in your basement with a UPS and external backup drives and such.

Self hosting is a scale. But the point is you have the ability to host it how you want. Whether that be on a cloud service that you just throw a docker container at, to a VPS with root, to a bare metal machine co-hosted, to in your basement, the choice is yours.

Re: Bitwarden Acquires Passwordless.dev

#253

Post by selykg »

heresjohnny wrote: post #101

Interesting demo. What happens though if the device holding the private key is lost? Or Apple decides to shut down your iCloud? Is there a backup option, similar to backup codes for OTP?

> Or Apple decides to shut down your iCloud?

This is probably testable as it is. They sync to iCloud Keychain, as is my understanding anyway.

How are the rest of your passwords stored in iCloud Keychain when your account is hosed? Do you lose those or does it just turn off syncing? I'd imagine it turns off syncing but keeps the keychain around unless you delete the iCloud Account from the device. That's a whole different ballgame of potential bad decisions though.

Re: Bitwarden Acquires Passwordless.dev

#254

Post by TacticalCoder »

PassageNick wrote: post #36
xwowsersx wrote: post #3

Could someone clarify what the relationship between passkeys and WebAuthn is? Is it that Passkey is the Apple, Google, Microsoft implementation (commercialization?) of WebAuthn? If so, does it add anything on top of WebAuthn that makes it differ in some fundamental way? Also, are passkeys how WebAuthn is most commonly actually used in practice? Apologies for the noob questions.

(Full disclosure: I work at https://passage.id ) WebAuthn is the short name for the "FIDO Alliance Web Authentication Protocol". "Passkey" is the trade name (that Apple tries to own) for the "stuff" that results from using the WebAuthn protocol. At it's root, a passkey is really the private key portion of that "stuff" that is kept. So yes, in practice, a passkey is the result of a WebAuthn implementation. MS, Apple,…

Do old Yubikeys and similar U2F devices, which do still work for webauthn, still work for sites that a going to require a "passkey"?

Or are MS+Google+Apple doing an "embrace, extend and extinguish" on webauthn?

Are the "small adjustements that ever so slightly reduces the security" sufficient to effectively kick security keys hardware vendor out of the game?

Re: Bitwarden Acquires Passwordless.dev

#255

Post by secabeen »

tunesmith wrote: post #161
secabeen wrote: post #158

Earlier quoted context omitted.

The entire finance industry has a disdain for "lifestyle businesses", that just generate enough profits for the founders and employees to live on, but will never generate an exit beyond that. I get why, but for utility products, a solid lifestyle for the employees and a useful product for users is enough, and should be enough.

Lifestyle businesses have a big flaw in American culture though; our safety net is not enough to make "meets expenses" a tenable long-term approach. We basically have to aim for a big wad of savings for later in life, which incentivizes going for exits and cash-outs.

Perhaps, I would hope that a sustainable lifestyle business would be able to pay employees and founders enough to build a comfortable retirement nest egg through savings, investments, and compound interest.

Re: Bitwarden Acquires Passwordless.dev

#256

Post by WorldMaker »

secabeen wrote: post #250
WorldMaker wrote: post #224

Earlier quoted context omitted.

Just like TOTP (used for most 2FA) the best practice for websites accepting passkeys will be to support as many passkeys as you wish to enroll. So you could enroll into your account some device associated with your Apple ID and some device associated with your Microsoft Account and some device associated with your Google Account and some browser associated with your Firefox Account and use any of those for recovery.…

Best practice is unlikely to help here, as people just aren't going to register passkeys from multiple services unless it happens automatically. I might bother to enroll multiple passkeys for my bank, but I'm unlikely to do it often. Are Passkeys exportable and re-importable by another service, site, or system? As described above, if my Google Account is terminated by Google without recourse (which absolutely happens…

It should start to happen automatically. Apple, Google, and Microsoft have all stated the goal that they are hoping for deep inter-operation across all of a user's devices, regardless of ecosystem.

If you are truly paranoid that your major device accounts are subject to termination without recourse (which if that happens you generally have lots of other problems and should maybe cause you to rethink your other trust relationships with such vendors and which devices you are buying), you can build your own Passkeys with WebAuthn standards and roll your own recovery/backup strategy. (Most FIDO compatible WebAuthn keys already work today anywhere Passkeys are supported, Passkey is just the "brand name" for those standards plus a soon-to-be-standard Bluetooth LTE handshake plus Vendor-guided backup and recovery plus whatever cross-device ecosystem "interop" standards the Big 3 eventually settle on.)

Re: Bitwarden Acquires Passwordless.dev

#257

Post by jlundberg »

ithkuil wrote: post #83

The demo on the homepage is available only on chrome. I tried both safari and firefox on macos and I can't see the " Experience Passwordless.dev in action" link there.

Worked for me in Safari on macOS if you have iCloud keychain activated.

Or more correctly: I got so far but stopped because I prefer to have my keychain locally :)

Re: Bitwarden Acquires Passwordless.dev

#258

Post by dicknuckle »

hoboris wrote: post #179
waymon wrote: post #156

Earlier quoted context omitted.

I used to do this. Now I self host vaultwarden since it allows me to use that database with faceID. Can keepass do that?

I use the Strongbox iOS client. It reads .kdbx files, integrates with apple sign-in features, and supports faceID. https://apps.apple.com/us/app/strongbox-password-manager/id8...

I use the Keepass2Android and it integrates with the OS fingerprint reader, so it's likely the same for faceunlock but I don't use that.

Re: Bitwarden Acquires Passwordless.dev

#259

Post by TacticalCoder »

xwowsersx wrote: post #3

Could someone clarify what the relationship between passkeys and WebAuthn is? Is it that Passkey is the Apple, Google, Microsoft implementation (commercialization?) of WebAuthn? If so, does it add anything on top of WebAuthn that makes it differ in some fundamental way? Also, are passkeys how WebAuthn is most commonly actually used in practice? Apologies for the noob questions.

Can't help much but originally webauthn came from Fido2 and old Fido devices, like old yubikeys, which only supported U2F, were de facto compatible with webauthn (as in: webauthn was only an upgrade server side).

Now Google killed U2F in Chrome (and hence Chromium etc.) but you can migrate your webserver to use webauthn instead of U2F and your users' old U2F keys shall keep working.

For the "new" webauthn, called passkeys, which is a modified webauthn: I've got no clue.

It's not clear to me if old hardware security keys shall keep working or if we'll all be forced to use software keys protected by Google/Apple/Microsoft.

Re: Bitwarden Acquires Passwordless.dev

#260

Post by brandon272 »

hn_throwaway_99 wrote: post #248
brandon272 wrote: post #241

Earlier quoted context omitted.

Yes, according to what 1Password is telling us. But as we've seen, what these companies say and what they actually do in practice are not always aligned. And oftentimes customers are inserting a lot of their own assumptions into the mix, not only with respect to vault encryption but vault storage and operational security.

> Yes, according to what 1Password is telling us. But as we've seen, what these companies say and what they actually do in practice are not always aligned. That's just not accurate: 1. First off, all the encryption happens client-side. It is possible for anyone so inclined to validate how 1P and LP are doing their encryption. 2. The deficiencies in LP's encryption approach were well known for years. My point it, yes,…

1Password's client side encryption is occurring within it's proprietary, closed-source product, so I'm not sure how the end to end process can be completely validated.

With respect to your confidence in 1Password's code and encryption methodology, would you be willing to send me your 1Password vault so that I can have a look at it?

Post reply on HN