Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys for Infrastructure

goteleport.com

Post reply on HN
Print view View original

31–40 of 73 posts

Re: Passkeys for Infrastructure

#31

Post by vlovich123 »

Groxx wrote: post #26
ryukafalz wrote: post #13

Earlier quoted context omitted.

Passkeys (in the sense the article is referring to, which is to say FIDO2 passkeys) are explicitly portable between devices. And the difference is they're always unique per-site in a way that passwords are not necessarily. It's possible to approach the security of passkeys if you always use unique passwords per-site (with e.g. a password manager) but you're still then vulnerable to phishing unlike with passkeys.

Most password managers check the urls before filling.

That doesn't prevent phishing attacks where the user goes "uggh. my password manager isn't working again. I'm going to copy-paste the password in by hand".

Re: Passkeys for Infrastructure

#32

Post by sebk »

arianvanp wrote: post #6

I wish SSO providers were able to hook into this Passkey mechanism. Instead of storing Passkeys in iCloud for sync instead we could store them at the SSO provider

I'm with you here and have been parroting this in just about every Webauthn thread on HN, except maybe with the exception that I think it's password manager vendors who are more interested -- several of them have joined the FIDO alliance in the past year.

I think having an open sync fabric that is vendor agnostic will be important going forwards. Users have a multitude of devices, usually not from the same vendor, and hybrid transport is not enough to mitigate the fact that sync fabrics are not interoperable.

The risk is that password manager vendors will end up implementing virtual authenticators backed by software instead of a secure element like a Yubikey, Secure Enclave or TPM. I'd be interested in the the FIDO Alliance helping bring OS APIs to leverage secure elements to import and export key material that belongs to a particular third-party fabric. It's clearly a sensitive issue because establishing trust between devices, and thus a sync fabric, is a strong phishing target. I also speculate that password manager vendors (e.g. 1Password) and authenticator vendors (e.g. YubiCo) could mutually benefit from agreeing on some APIs to establish trust between authenticators and allow import/export, bypassing the OS vendors.

Re: Passkeys for Infrastructure

#33

Post by sebk »

tjoff wrote: post #28
sebk wrote: post #24

Earlier quoted context omitted.

Apple has pretty good security whitepapers about how it does end-to-end encryption for Keychain items like this. If you're more broadly concerned about Apple not honoring those, having (un)intentional vulnerabilities, or them having the ability to shut you off from your account, then you can always fall back to non-synced FIDO2 devices, like a Yubikey. The underlying technology in both is the same: WebAuthn. I'd imag…

> then you can always fall back to non-synced FIDO2 devices No, you can not. Because they are completely broken for a lot of use-cases, especially when you can only add one or two of them makes them worse than even passwords in many situations.

Even if they are broken you have the option, and you can decide which trade offs suit your use case.

Re: Passkeys for Infrastructure

#34

Post by goalieca »

zacharyvoase wrote: post #30

I see a few obstacles with Passkeys as-implemented: * They effectively entrust the keys to your entire digital life to (right now) either Google or Apple. Account compromise, or a ToS-related suspension, becomes catastrophic. * Domain changes happen (acquisitions, rebrands, etc.), and there is no way to share or migrate passkeys between domains. Right now the best you can do is a highly manual process involving the u…

1Password does have passkeys in the works. https://www.future.1password.com/passkeys/

Re: Passkeys for Infrastructure

#35

Post by tjoff »

sebk wrote: post #33
tjoff wrote: post #28

Earlier quoted context omitted.

> then you can always fall back to non-synced FIDO2 devices No, you can not. Because they are completely broken for a lot of use-cases, especially when you can only add one or two of them makes them worse than even passwords in many situations.

Even if they are broken you have the option, and you can decide which trade offs suit your use case.

Not sure you'll have the option for passwords much longer, no.

Re: Passkeys for Infrastructure

#36

Post by noahtallen »

A lot of comments in this thread are discussing vendor lock-in with Apple or Google.

1Password is working on passkey support already (https://www.future.1password.com/passkeys/) and I imagine others will follow suit. Vendor lock-in isn’t part of the spec, it just happens that in these early days, the OS-level authenticators are the main ones implemented (as are other hardware authenticators).

In the mid to long term (e.g. by the time websites start supporting this), I don’t think vendor lock-in will be a problem. It’s no worse currently than chrome or iCloud Keychain being your password manager, which has been part of the landscape for a very long time. Like password managers, there will be other options. The benefit is that unlike passwords, there is a standard API for “autofill credentials” rather than using an extension to update the DOM.

Re: Passkeys for Infrastructure

#37

Post by yoshuaw »

zacharyvoase wrote: post #30

I see a few obstacles with Passkeys as-implemented: * They effectively entrust the keys to your entire digital life to (right now) either Google or Apple. Account compromise, or a ToS-related suspension, becomes catastrophic. * Domain changes happen (acquisitions, rebrands, etc.), and there is no way to share or migrate passkeys between domains. Right now the best you can do is a highly manual process involving the u…

> Right now none of the Passkey syncing providers support anything like that (and I feel like they won't, because it'd be a huge vector for scams).

Within the Apple ecosystem Passkeys can be shared with contacts through AirDrop (no other methods are presently allowed). The Passkey is then copied directly from your Keychain to your contact’s Keychain.

Re: Passkeys for Infrastructure

#38

Post by account-5 »

Nope. I still can't see me using passkeys. Unless someone can explain how I use them without a Google/Apple/Microsoft account, or without being reliant on some third party and a hardware device then it's useless for me.

I would only ever use this if like my password manager the authenticator was software based (hardware independent), platform and vendor independent, open source, and offline.

Re: Passkeys for Infrastructure

#39

Post by barkerja »

zacharyvoase wrote: post #30

I see a few obstacles with Passkeys as-implemented: * They effectively entrust the keys to your entire digital life to (right now) either Google or Apple. Account compromise, or a ToS-related suspension, becomes catastrophic. * Domain changes happen (acquisitions, rebrands, etc.), and there is no way to share or migrate passkeys between domains. Right now the best you can do is a highly manual process involving the u…

> There's no way to migrate your passkeys between ecosystems.

The FIDO Alliance doesn't recommend that you migrate Passkeys, but instead, you have multiple passkeys across various platforms for the same "login".

See the following talk on this very thing: https://www.youtube.com/watch?v=SWocv4BhCNg

Re: Passkeys for Infrastructure

#40

Post by pat2man »

account-5 wrote: post #38

Nope. I still can't see me using passkeys. Unless someone can explain how I use them without a Google/Apple/Microsoft account, or without being reliant on some third party and a hardware device then it's useless for me. I would only ever use this if like my password manager the authenticator was software based (hardware independent), platform and vendor independent, open source, and offline.

Any password manager can support them. 1Password has announced a beta already.
Post reply on HN