Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toward a Passwordless Future

privacyguides.org

Post reply on HN
Print view View original

31–40 of 70 posts

Re: Toward a Passwordless Future

#31

Post by freeone3000 »

grammarxcore wrote: post #21

The big thing missing from the article is how a device that contains many passkeys is any different from a password manager that enforces security settings. I don’t worry about passwords my password manager generates getting compromised because I use at least 24 random characters (assuming my password manager is using a cryptographically secure PRNG that guarantees some level of randomness, giving us more than 128 bi…

Passwords are still leakable, guessable, and can be phished. Passkeys are “second-factor-only”: your device responds to a challenge and acts in a similar capacity to a yubikey. The private keys contain much more entropy than a password, never leave the device, and the challenges and responses are both signed with site-specific keys so they can’t be phished. So from a security perspective, a lot is gained.

From a user perspective, instead of trying to get the dang webform to autofill, I just smile for a second and become authenticated.

Re: Toward a Passwordless Future

#32

Post by freeone3000 »

mathematicaster wrote: post #17
lillecarl wrote: post #10

I really don't want to use Passkeys until they can be stored in my password manager of choice on Linux, Android and Windows.

I don't want to use passkeys until I can chose and verify that they are device bound.

KeepassXC famously has no network sync of any kind and supports passkeys.

Re: Toward a Passwordless Future

#36

Post by PaulKeeble »

lillecarl wrote: post #10

I really don't want to use Passkeys until they can be stored in my password manager of choice on Linux, Android and Windows.

I was enthused when it first got added to KeypassXC but after a few attempts I couldn't get it working and haven't bothered since. Something fundamentally isn't quite working here and I am not a big fan of the workflow for them its entirely out of my hands and I am not a fan of that.

Re: Toward a Passwordless Future

#37

Post by voxl »

freeone3000 wrote: post #31
grammarxcore wrote: post #21

The big thing missing from the article is how a device that contains many passkeys is any different from a password manager that enforces security settings. I don’t worry about passwords my password manager generates getting compromised because I use at least 24 random characters (assuming my password manager is using a cryptographically secure PRNG that guarantees some level of randomness, giving us more than 128 bi…

Passwords are still leakable, guessable, and can be phished. Passkeys are “second-factor-only”: your device responds to a challenge and acts in a similar capacity to a yubikey. The private keys contain much more entropy than a password, never leave the device, and the challenges and responses are both signed with site-specific keys so they can’t be phished. So from a security perspective, a lot is gained. From a user…

Until you lose the device. Or you're given security codes and those are again, leakable and guessable. No normal user is going to accept their phone being stolen and losing access to their bank account. It's bitcoin as unregulated fiat levels of wishful thinking

Re: Toward a Passwordless Future

#40

Post by gruez »

mathematicaster wrote: post #17
lillecarl wrote: post #10

I really don't want to use Passkeys until they can be stored in my password manager of choice on Linux, Android and Windows.

I don't want to use passkeys until I can chose and verify that they are device bound.

Use a hardware token (eg. yubikey) then?
Post reply on HN