Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys now support external providers

developer.apple.com

Post reply on HN
Print view View original

31–40 of 185 posts

Re: Passkeys now support external providers

#31

Post by drtgh »

Lukas_Skywalker wrote: post #13
drtgh wrote: post #11

Earlier quoted context omitted.

Whichever way you look at it, in every sense, password managers are a really bad, bad idea. Besides that, it is not needed to force you to press your finger; the delinquent needs only to have access to the device for to fool the sensor with a brute force, 2 hours in the worse of the cases with the simplest techniques. Although its easier to take your finger prints from a glass or something you used for to avoid the w…

I would argue that password managers are not a "in every sense a really bad, bad idea" for a lot of reasons. Let's look at password reuse for example. As soon as you have more than a few dozen logins, the possibilities are mostly either reusing one or few passwords, or writing them down. Reusing is objectively bad, and for writing them down, the password manager makes it easy to use a really long and random password,…

Password managers makes the user life easier, at a big price if the master password gets compromised, as all the passwords get compromised at same time, in an unified way that by other methods would require much more specialization and effort for to gather together.

If that passwords are stored in internet even worst, one can take for sure those passw-managing servers are juicy targets, it is a countdown until the server will get compromised.

If the user is only storing the pass of chat forums, I think then is one thing the attacker probably will ignore, if the reverse engineering of one of those sites using user's name is not in the secondary target list.

Anyway, to use a unique password for every server, account, etc is a must do from the beginning of time, even for the temporal forum one had to register for to use a few minutes. It is the first computing directive. It's just the password managers are not accomplishing the objective of such directive.

Re: Passkeys now support external providers

#32

Post by ttul »

supriyo-biswas wrote: post #7
ttul wrote: post #3

This is a smart move by Apple. Authentication infrastructure is necessarily cross platform. It doesn’t generate revenue for Apple, but the lack of cross platform auth would limit enterprise adoption of Apple products.

Passkeys (otherwise known as WebAuthn) isn’t an Apple specific standard though.

Absolutely. 1Password is betting heavily on being the passkey clearing house for enterprise. I think what Apple is doing here is saying that companies like 1Password can do this for their flavor of WebAuthn too.

Re: Passkeys now support external providers

#33

Post by devsda »

jsmith99 wrote: post #2

Originally seen via https://reddit.com/r/Bitwarden/comments/141uxz1/iosipados_17... This is big news as vendor lock in and inability to use our own sync was one of the biggest issues bought up whenever Passkeys are discussed. Apple are now allowing external sync fabrics such as password managers.

> Apple are *now* allowing external sync

There is no guarantee that this will be permanent. It can be revoked citing x number of reasons.

Also, lets wait until the implementation details are available. If it requires providers having a native app on the device where Apple has control on who and what to allow, there's only an illusion of choice.

Re: Passkeys now support external providers

#34

Post by arianvanp »

ljlolel wrote: post #19
ckastner wrote: post #10

Of all the recent publications with regards to passkeys, FIDO2, WebAuthn, etc., finally there's one with a simple and concise summary of the benefits: > Strong credentials. Every passkey is strong. They’re never guessable, reused, or weak. > Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers. > Safe from phishing. Passkeys are intrinsically linked with the app…

The last one is a problem for a lot of use cases. Lots of sites have different domains (also for example when HBO max renamed to max). Plaid also relies on entering bank passwords on neobank sites and is widely used.

They're actively working on an extension on WebAuthn that supports these kind of 3D-Secure usecases.

https://www.w3.org/TR/secure-payment-confirmation/ https://github.com/w3c/webauthn/issues/1667

Re: Passkeys now support external providers

#35

Post by drtgh »

misnome wrote: post #17
drtgh wrote: post #11

Earlier quoted context omitted.

Whichever way you look at it, in every sense, password managers are a really bad, bad idea. Besides that, it is not needed to force you to press your finger; the delinquent needs only to have access to the device for to fool the sensor with a brute force, 2 hours in the worse of the cases with the simplest techniques. Although its easier to take your finger prints from a glass or something you used for to avoid the w…

> Whichever way you look at it, in every sense, password managers are a really bad, bad idea. Okay, how about, the actual problem they solved: Reusing a single, simple password on every site, shared behind an email login. That doesn’t sound like a really, really bad idea.

At what point did password managers invent the idea of using a different password for each account? That is computing basics from the beginning. They didn't solve a problem, they just increased the lottery prize if the master password gets compromised.

Every body can continue down-voting, but that fact is not going to change.

Re: Passkeys now support external providers

#36

Post by whatyesaid »

xmdx wrote: post #28

Is the whole idea of syncing passkeys a bad idea? Or at least a less secure idea. Someone explained to me that passkeys are hardware backed, each passkey is stored on device and tied to the hardware, so even if someone managed to get access to it, they would also need the hardware to get it to work. These software based keys that can be synced are less secure as a result. Then it just becomes like a password again. I…

I think passkeys + 2FA is enough. Just enforce 2FA for any important service and it will be fine, if you don't force it then people who aren't as tech savvy will not do it or people may forget.

For anything non-important I actually use sign in with Google, so.

Re: Passkeys now support external providers

#37

Post by jiggawatts »

My method for judging the quality of software: Read the latest release notes, negate every statement, and think to yourself: "They were fine with it being like this until now."

Passkeys have been advertised as a superior replacement to passwords, but really fundamental issues remain unaddressed.

I have one (1) Windows PC and one (1) iDevice. Can I get these to sync? Will both be able to log me in to a Google Account? Or do I need an Android phone for that? Can I use an iDevice to authenticate with an Azure AD app? Can I recover the passkeys on a lost iDevice without having to pay Apple for a new device to restore the backup? Etc...

I guarantee many more release notes that could be summarised as: "Now supports a common scenario!"

Re: Passkeys now support external providers

#38

Post by mariusor »

drtgh wrote: post #35
misnome wrote: post #17

Earlier quoted context omitted.

> Whichever way you look at it, in every sense, password managers are a really bad, bad idea. Okay, how about, the actual problem they solved: Reusing a single, simple password on every site, shared behind an email login. That doesn’t sound like a really, really bad idea.

At what point did password managers invent the idea of using a different password for each account? That is computing basics from the beginning. They didn't solve a problem, they just increased the lottery prize if the master password gets compromised. Every body can continue down-voting, but that fact is not going to change.

> if the master password get compromised.

... and if a copy of the password wallet has been obtained.

Re: Passkeys now support external providers

#39

Post by vladvasiliu »

tialaramex wrote: post #29
gjulianm wrote: post #21

Earlier quoted context omitted.

AFAIK, passkeys aren't really linked to a domain. It's old-school public-key verification, the server stores your public key and uses it to verify the signature of a challenge they send to your device on login. As long as the different domains/apps can share the public key you should be able to login. And for things like Plaid, I think banks are moving towards OAuth-style permissions, where you login to your bank and…

> AFAIK, passkeys aren't really linked to a domain. It's old-school public-key verification, the server stores your public key and uses it to verify the signature of a challenge they send to your device on login. As long as the different domains/apps can share the public key you should be able to login. In principle the fancier systems with a user interface could add a feature where you can change the DNS names assoc…

I may be wrong here, but since the yubikey and similar don't actually store anything site-specific, it means they just respond to a challenge, right? What they prove is that they own a specific private key.

So if the website bundles its domain in the challenge, it can make sure that the client signed the challenge for itself, and the client can verify that it signs the challenge for the current domain.

So now, if the service's domain were to change, it would presumably be aware of it and incorporate it in the new challenge, which the client would sign, since it's browsing the correct domain, with the same private key used before.

Is this not how it works?

Re: Passkeys now support external providers

#40

Post by Rygian »

ckastner wrote: post #10

Of all the recent publications with regards to passkeys, FIDO2, WebAuthn, etc., finally there's one with a simple and concise summary of the benefits: > Strong credentials. Every passkey is strong. They’re never guessable, reused, or weak. > Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers. > Safe from phishing. Passkeys are intrinsically linked with the app…

> Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers.

It's still an attack scenario to keep in mind. If a server can be tricked into storing the wrong public key, authentication is defeated.

Post reply on HN