Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

271–280 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#271

Post by ris »

toomuchtodo wrote: post #140
lxgr wrote: post #135

WebAuthN is great, but I can't help but feel that Passkeys are actually a step backwards. At least on iOS, there is no way of preventing them from being synced to iCloud, which is the opposite of what I want for high-stakes credentials like bank accounts or government e-signatures. I've tried to raise [1] a related issue (i.e. the inability for relying parties to opt out of credential syncing, if not an explicit requ…

How is this different than a password manager with encrypted cloud backup? Your recourse if someone breaks passkeys is legal, not technical. Security must be a balance with functionality, and this is a huge improvement over passwords. (Tangentially, it would be great if we got cryptographic digital identity cards like Estonia has for signatures but that’s more of a long term goal) Cloud sync (encrypted!) is important…

> Tangentially, it would be great if we got cryptographic digital identity cards like Estonia has for signatures but that’s more of a long term goal

Wonderful. Until every second web service starts to require a signature from such digital identity ("age verification" perhaps?) and that's the end of pseudonymity.

Re: Passkeys: The beginning of the end of the password

#272

Post by Moneyyyyy »

segmondy wrote: post #41

I'm still salty about this. Called it passkey too. http://www.multipasskey.com/susdemo/ . Built this 5-6yrs ago and applied to YC. Crickets. Hope to see this take off, with my approach I made it where you don't even need to "register", you can go to a site and just have an account. I did the fingerprint, face scan, PIN approach for more security, but my favorite was NFC ring. Basically you have an NFC ring you wear o…

At least Google does those things as an open standard.

So it should be easy for everyone else to do their own.

Re: Passkeys: The beginning of the end of the password

#273

Post by AlexandrB »

Gasp0de wrote: post #103
barkerja wrote: post #58

Earlier quoted context omitted.

Not if the Passkey was synced (ex: you used iCloud keychain). If the passkey was not synced, then I would have to assume it would be the same if you lost a physical hardware key.

How do you access iCloud without your passkey?

Complain loudly on Twitter and hope your tweet goes viral.

Re: Passkeys: The beginning of the end of the password

#275

Post by AlexandrB »

2OEH8eoCRo0 wrote: post #265

When a company rolls out something new and exciting that will improve your life, ask yourself: why are they spending money on this? Just stuffing more of our private lives into phones full of ads and tracking. Each time you unlock your phone Google makes money.

There is a less sinister motive available - reducing customer support costs - but the default of syncing everything to the cloud does give me pause.

Re: Passkeys: The beginning of the end of the password

#276

Post by awaythrow98765 »

Ajedi32 wrote: post #111
awaythrow98765 wrote: post #57

Those passkeys are either insecure or unreliable. Let me explain: Those passkeys are asymmetric cryptographic keypairs where the private key is securely stored on a device, unlockable (for use, not reading) only by convincing your devices security processor to do so by pin/fingerprint/pattern. Which in itself can be secure, given you do trust that magic security processor (which you shouldn't, see yesterday's news fo…

> Now one could allow backups of a passkey That's literally part of what makes a passkey a passkey (v.s. just a WebAuthn credential), so that's a given. > as insecure as a password No. Passkeys can't be phished, passwords can. Passkeys can't be cracked after a data breach. Passwords can. Passkeys can't be set to something easily guessable. Passwords can. Passkeys can't be written on a post-it note and taped to your m…

> No. Passkeys can't be phished, passwords can. Passkeys can't be cracked after a data breach. Passwords can. Passkeys can't be set to something easily guessable. Passwords can. Passkeys can't be written on a post-it note and taped to your monitor. Passwords can. Passkeys can't be reused across multiple sites. Passwords can.

Passkeys don't need to be cracked after a data breach of your backup provider, they are just usable, right there.

> There are so many ways passkeys are superior to user-memorized passwords from a security perspective, it's laughable to call them "as insecure as a password".

Passkeys are accessible permanently on some devices unencrypted or decryptable in the filesystem, if part of e.g. a backup. Whereas passwords are usually only accessible temporarily. That makes the attack surface top copy over some passkey far larger than for sniffing a password.

Re: Passkeys: The beginning of the end of the password

#277

Post by Scion9066 »

sys32768 wrote: post #216

Can we call it something other than passkey? That sounds suspiciously like password, but makes me picture a key fob. Biometics? Authentication device?

Pretty sure that's intentional. It's replacing something you know (a word) with something you have (a key stored on a device or some kind of account).

It doesn't necessarily need to use biometrics or be bound to a specific device, so those aren't quite accurate. Thus, passkey.

Re: Passkeys: The beginning of the end of the password

#278

Post by waboremo »

signal11 wrote: post #269
lxgr wrote: post #186

Earlier quoted context omitted.

> If Google/Amazon/Apple/Meta/whoever locks your account out, you now lose access everywhere. Fortunately, both iOS and Android also support "detachable passkeys" a.k.a. Yubikey and co. ("roaming authenticators" in WebAuthN/FIDO parlance). Unfortunately, only Android is planning to offer [1] a first-party Passkey provider API, because that's what I'll probably be using 99% of the time (finding my external authenticat…

> Fortunately, both iOS and Android also support "detachable passkeys" a.k.a. Yubikey and co That’s good to know. Although my concern would be, that’s really good for people who use YubiKeys, but regular people won’t, and they can then get bitten by account lockouts. Is there something regular users can do to use Passkeys (let’s say they use Google) and have some recourse if Google locks them out? Also, what happens…

Passkeys don't negate regular account recovery processes. Just as if you were to lose your password, you would have to talk to support.

Re: Passkeys: The beginning of the end of the password

#280

Post by AlexandrB »

lxgr wrote: post #135

WebAuthN is great, but I can't help but feel that Passkeys are actually a step backwards. At least on iOS, there is no way of preventing them from being synced to iCloud, which is the opposite of what I want for high-stakes credentials like bank accounts or government e-signatures. I've tried to raise [1] a related issue (i.e. the inability for relying parties to opt out of credential syncing, if not an explicit requ…

> Today, Google has sent me an email about their intention to deprecate their (device-bound) iOS authenticator

Is this the TOTP authenticator app that Google only started actively maintaining again in the last year or so? If that's the case, that's pretty funny timing.

Post reply on HN