Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale doesn't want your password

tailscale.com

Post reply on HN
Print view View original

301–310 of 316 posts

Re: Tailscale doesn't want your password

#301

Post by [deleted] »

gcr wrote: post #205
throw0101b wrote: post #189

Earlier quoted context omitted.

> I've spent about 10 minutes Googling, and I'm still not sure how I backup and restore passkeys. In the Apple ecosystem your passkey is / can be sent to your iCloud Keychain, which you can restore when you can a replacement device (and keep using on non-lost/stolen devices): * https://support.apple.com/en-ca/guide/iphone/iph82d6721b2/io... * https://www.google.com/search?q=apple+passkey+icloud

This doesn’t address the issue if OP needs temporary access via an Android device.

[deleted]

Re: Tailscale doesn't want your password

#302

Post by brookst »

NikolaNovak wrote: post #244
brookst wrote: post #216

Earlier quoted context omitted.

Thank you. It is disheartening that so many HN readers would rather imagine how passkeys work, and freak out at their own imaginings, than just learn the real thing.

Somewhat fair criticism, but also somewhat unfair. A lot of us are trying to read up and understand, and so we post questions in forums like these with knowledgeable folks, in hopes to enhance our understanding and reduce our concern. One counter point though is that... if there is a new lifesaving technology, and even the somewhat IT literate / somewhat geeky / folks who WANT to understand it, are struggling... it m…

No complaints with questions, but many of the questions are in the form of assertions that are incorrect.

"Does that mean that passkeys can't be shared between users or devices?" is a 100% reasonable question.

"Passkeys are a step backward because they can't be shared between users or devices" is not really a question, it's an opinion based on imagination.

And passwords are just as complex. How do you securely share a login with another user?

Yes, there's complexity, but it's complexity born of a change in paradigm. The actual new thing is either equally simple or simpler than traditional passwords, once you factor in scenarios like backup, transfer, multi-device sync, sharing, etc. It's just different.

Re: Tailscale doesn't want your password

#303

Post by brookst »

barbazoo wrote: post #242
stavros wrote: post #221

Earlier quoted context omitted.

Yep, that's what frustrates me as well, especially for a technology that will be a massive gift to both security and usability.

Have a look around this thread. Lots of smart people having difficulties figuring out how this works. This is a bad sign. It shouldn't be this hard to figure out the basics.

> It shouldn't be this hard to figure out the basics

Why not? There are lots of great things in the world that are easy and a joy to use, but fairly challenging to learn the technical details of. The electricity grid, airplanes, microwave ovens, you name it. Tons of straightforward user experiences that take some work to understand.

Re: Tailscale doesn't want your password

#304

Post by drdaeman »

JohnFen wrote: post #298
stavros wrote: post #281

Earlier quoted context omitted.

The issue, though, is attestation doesn't really do much for the site either. It's not like the bank wants to enable attestation because it's somehow more secure. It's only useful in cases where a company wants to say "we only want you to use Yubikeys because that's what HR has approved", not so much for sites mandating what their customers should use. This is a bit like worrying that sites will block 1password and o…

Attestation can be more detailed than just what brand of hardware key you use. Banks probably don't care. But attestation also informs what the capabilities are. What banks (or others) might care about is whether or not you're using a TPM or equivalent to store your key in, and attestation can tell them that.

Fortunately, it seems that major providers don't support attestation. If no one provides attestation capabilities, no one would request it, not even someone as anti-user as a bank.

Re: Tailscale doesn't want your password

#305

Post by snagg »

zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

The short answer is that it's non standard and it depends on where the passkeys are stored. To be precise, the original WebAuthn standard did not account for a recovery mechanism at all and instead recommended adding multiple credentials to an account.

Practically if the passkeys are stored in your iCloud Keychain, they are automatically synced across your Apple devices and the recovery mechanism is the recovery mechanism for iCloud.

Similar consideration for Google/Chrome and other password managers.

We wrote a relatively long blogpost about this + implementation and threat modeling considerations in case it's interesting: https://www.slashid.dev/blog/passkeys-security-implementatio...

Re: Tailscale doesn't want your password

#306

Post by dzikimarian »

NikolaNovak wrote: post #210
dzikimarian wrote: post #183

Earlier quoted context omitted.

You can set up as many as you want, so just register your phone as one and your PC as other. Eg. using Windows Hello. If you loose or compromise one device, you just delete it as a passkey - rest is still working. If you loose all of them at the same time somehow, there's usually fall back to password or some kind of reset process.

For every account thought, correct? Like, I can keep all my passwords in a password manager. And then copy and replicate that database however I want to. With passkeys, I'd need to set up and authenticate additional devices... for every of hundreds of accounts I have? Am I wrong? Like if I have an android tablet and iPhone and windows PC and a Linux PC (as I do) that's half a dozen setups for each and every account?…

As mentioned by other you can use solution, that propagates your passcode credentials across devices - probably most password managers will offer this soon. I wouldn't, because you loose separation in case of compromise of one device, but if you do - it's still on par with security level of today's password managers with cloud sync.

Also you don't really have to set up everything everywhere all at once - passwords still work and you can use phone passkey on PC via QR.

Re: Tailscale doesn't want your password

#307

Post by lukeschlather »

mike_d wrote: post #121
lukeschlather wrote: post #80

Earlier quoted context omitted.

Could you give an example? That support article doesn't mention anything about it. I do recall reading something about that recently, but I read the article and it it made no mention of what syncing passkeys actually means. It sounds like theoretically I could write an app that uses the same APIs Apple uses to sync encrypted credentials between TPMs. But "however you please" sounds suspiciously like "however you plea…

It has been a while since I have dug into it, but from what I remember it works roughly like this: You login to iCloud which gives your device write access to iCloud storage. The device creates a private key inside the TPM, and uploads the public key. When you add a new device, one of your existing devices has to use its hardware key to sign your new devices key. It also must be signed by a second key derived from yo…

I'm sure that works for passwords. I am skeptical that it works with passkeys. It's unclear to me if the CSV will include passkeys. It's additionally unclear to me if I enroll in some website with a passkey stored in my Keychain, and then export and import that password into some other password manager, if the website will accept a login from the exported passkey. Definitely, there's the "attestation" piece and services might choose not to accept the passkey if the attestation has changed. You can blame the service - but it seems like an intentional design goal here. And it has been said that Apple didn't want attestation, maybe it will be removed, but it's there and it seems likely to be used.

Re: Tailscale doesn't want your password

#308

Post by warkdarrior »

zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

> How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device?

You get a new device, create new passkeys, and re-enroll into the online service again.

> And, for Yubikey, how do you backup?

See above.

> Do you need multiple Yubikeys?

Yes.

> Do you need to manually make a copy of every keys? How do you know if the copy is synced with the main one?

Apple's and Google's solutions both sync the passkeys via their cloud services. You cannot sync passkeys to Yubikeys, AFAIK.

Re: Tailscale doesn't want your password

#309

Post by iknowstuff »

JohnFen wrote: post #274
iknowstuff wrote: post #34

Earlier quoted context omitted.

It presents a qr code you can scan with the other device. You can try it on https://passkeys.io

> It presents a qr code you can scan with the other device. What about devices that have no camera?

SOL

Re: Tailscale doesn't want your password

#310

Post by kdklol »

tptacek wrote: post #286
kdklol wrote: post #173

Earlier quoted context omitted.

I knew I should've explained myself in more detail. Sorry. >Basically you need to trust more vendors of security solutions than before Yes and no. You may have to trust the vendor of your hardware key, or you can get one that has open source firmware, like NitroKey. Regarding the number of trusted parties - it depends. To have a account that use passwords, you must trust them to handle your password well. You can mit…

You say "even non-existant DNSSEC" here, but, as a reminder: virtually none of the most popular/important/commercial/whatever-ranking-you-like zones on the Internet are signed. DNSSEC signing is not the norm.

Not quite true, many popular services do have it. Especially the big ones.

The thing is, I was mentioning DNSSEC as a "full disclosure". Any attack enabled by non-validated DNSSEC on passkey applies to any other form of verification too. I just wanted to make sure I'm not overselling the technology, it's not a silver bullet, but it's orders of magnitude better than anything else.

Post reply on HN