Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys will come at a cost

fy.blackhats.net.au

Post reply on HN
Print view View original

281–290 of 600 posts

Re: Passkeys will come at a cost

#281

Post by NoZebra120vClip »

heavyset_go wrote: post #274
NoZebra120vClip wrote: post #257

Earlier quoted context omitted.

> Yes, that’s resident (or “discoverable”) keys the article author is talking about. No, I said I'm using a Yubico Security Key. This is not a Yubikey. This key has no storage. How can it possibly store resident keys? The YubiKey Manager app can't even connect to this key. It's very basic, it has no TOTP slots, it has no configuration, it only does FIDO2. How would resident keys get in there in the first place? The a…

You can use the Yubico Authenticator app's WebAuthn feature on the desktop to see resident credentials on their Security Key product, same thing with Chrome/Chromium's security key settings pane.

Nope. I have Windows Yubico Authenticator v5.1.0, and with the Security Key plugged in, all screens blank.

In Chrome 114.0.5735.199 on Windows 10 Pro, there is no "security key settings pane". The closest thing available is "Privacy and Security -> Security -> Manage phones (control which phones you use as security keys.)"

However, in terms of resident credentials, I thank the GP and I stand corrected, because Yubico's own specs say that this key sports 25 slots. I wonder how many are currently in use, and which version of the CTAP protocol it is using...

Re: Passkeys will come at a cost

#282

Post by makeitdouble »

NotYourLawyer wrote: post #244
makeitdouble wrote: post #185

Earlier quoted context omitted.

Isn't the physical key a whole computing device with high grade storage ? I can't imagine those using cheap consumer grade off the shelf storage parts.

Whether it’s on-die or a separate chip, flash is just dirt cheap nowadays.

Is it ?

Looking at this for instance, we're still around 1 USD per GB for a reliable storage chip: https://www.amazon.com/Kingston-Industrial-32GB-microSDHC-Ad...

Re: Passkeys will come at a cost

#283

Post by smaudet »

Consider also the option, that you dont need any security...

This over-the-top nonsense for garbage accounts really needs to stop.

I agree with some of the "opt-in" stuff but really, the default should be no passwords, no passkeys, nothing.

IFF you need to secure something, your password manager can offer a password of "good enough" quality.

This is a very simple problem with an overengineered mess around it - but the sec folks like it overcomplex, so they can charge more...

Re: Passkeys will come at a cost

#284

Post by FeepingCreature »

j16sdiz wrote: post #260
JohnFen wrote: post #118

Earlier quoted context omitted.

> I personally think these things absolutely should be able to be exported & backed up separately. I agree. The usual response is that you don't need to do this because you can have multiple hardware keys that authenticate to the same services, so you can store one as a backup. But managing that sounds like a real pain in the butt to me (honestly, the entire passkey system sounds like a real pain in the butt to me --…

> ... you can have multiple hardware keys that authenticate to the same services, so you can store one as a backup. Just some problem: As a backup, I would prefer to store it _away_ from my main hardware key. Everytime I sign up a new service, I need to go fetch the backup and update it...

Yeah the best would be if you could use one key to bless another as an explicit backup key in advance.

Re: Passkeys will come at a cost

#286

Post by jabbany »

stronglikedan wrote: post #212
jabbany wrote: post #91

Earlier quoted context omitted.

This is a terrible idea though. I had the misfortune of getting into a cycling accident which broke my phone display (completely lost display output and touch input), and it meant I lost access to all my OTP 2FAs for a couple of days (which is actually kind of scary). I was able to fix it myself by getting parts and going through an ifixit guide (right to repair anyone? ;-), after which I promptly exported my 2FA see…

> KeePass, which apparently supports them, who knew... Bitwarden, too. I no longer have to worry about not having my phone on me, or even having to take it out of my pocket.

>I no longer have to worry about not having my phone on me, or even having to take it out of my pocket.

I mean, I appreciate the convenience but can't help feel like this is cheating...

The whole point of 2fa was to verify you had the 2fa device and this basically defeats that.

Re: Passkeys will come at a cost

#288

Post by bombolo »

cbsmith wrote: post #280
patmorgan23 wrote: post #230

Earlier quoted context omitted.

Yeah, except physical devices get lost, stolen or damaged. So there needs to be some accounts recovery procedure/alternative auth mechanisms.

...and there are, and they're remarkably similar to what you do with Yubikeys: you have extra keys, and when you lose one, you uses the other to get in, and then you invalidate the old keys (although in the physical world, this means getting a new lock and a new set of keys, instead of just getting one new key and removing the lost key as a valid key).

Except you'd have to invalidate a yubikey on countless websites.

Re: Passkeys will come at a cost

#289

Post by cycomanic »

wkat4242 wrote: post #173
Ajedi32 wrote: post #27

Is it even a good idea to use physical security keys as passkeys in the first place? Passkeys are meant to be a password _replacement_, and for that you probably want the 2-factor properties afforded by phones or desktops which usually require "something you know" or "something you are" to unlock in addition to the "something you have" afforded by physically possessing them. IMO physical security keys are better left…

> Passkeys are meant to be a password _replacement_, and for that you probably want the 2-factor properties afforded by phones or desktops which usually require "something you know" or "something you are" to unlock in addition to the "something you have" afforded by physically possessing them Yes because the keys have a PIN just for this usecase. Similar to the ATM card or SIM card you already know

The impression that I get though is that the PIN's are typically short (especially if we have to enter them every time it is to access the key). Now, how physically save are hardware keys that the actual private key can't be extracted from them? In contrast to an ATM or SIM we essentially rely on the device to enforce the "max number of attempts", not an external entity.

Once the key is extracted brute forcing the PIN is not a problem, because it likely is going to be simple. Unless somehow the devices are going to enforce long PINs.

Re: Passkeys will come at a cost

#290

Post by nazgulsenpai »

dwaite wrote: post #262
marwatk wrote: post #83

Earlier quoted context omitted.

Hardware tokens (Yubikeys, etc) are signed by their vendor. They support attestation which allows q site to disallow vendors not in a white list. Some banks (Vanguard was/is one) actually enforce this preventing all but a handful of hardware keys from working with their 2FA.

From https://www.chromium.org/security-keys/ : > Chrome’s users have an interest in ensuring a healthy and interoperable ecosystem of Security Keys. To this end, public websites that restrict the set of allowed Security Keys should do so based on articulable, technical considerations. They should regularly update their set of trusted attestation roots that meet their policies (for example, from the FIDO Metadata Serv…

So Google will be the arbiter? What could go wrong...
Post reply on HN