Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

311–320 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#311

Post by howinteresting »

michaelt wrote: post #192
lxgr wrote: post #153

Earlier quoted context omitted.

> use this to tether and lock you in to their platform. You could say this about Google's proprietary authenticator app in the past, but now that they support Passkeys, arguably the opposite is true. Importantly, you can now (with FIDO CTAP 2.2 and tunnel services [1]) use an out-of-platform Passkey to log into your account cross-device, e.g. you can use an iOS Passkey to log into an account on a Windows Chrome insta…

The article says "Instead, passkeys let users sign in to apps and sites the same way they unlock their devices: with a fingerprint, a face scan or a screen lock PIN." Does that not rather imply that, if I log in with faceid on an iphone, my login will be tied to my ability to faceid on an iphone, and hence only available on iphones and macs? As a user, that's sounding a lot like platform lock-in to me. And as a devel…

What it does imply is that if you store your passkeys on Apple's keychain, migrating to Android becomes that much harder. (I assume that Google will provide an implementation of passkeys on iOS when that becomes available as an API, but it will be a cold day in hell before Apple provides access to its keychain on Android.)

The solution is to not use Apple's keychain for passkeys (and really not use Apple's proprietary services for anything at all), but we can't depend on people to have that foresight.

Re: Passkeys: The beginning of the end of the password

#312

Post by Dalewyn »

jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

Passwords will never be supplanted unless the new challenger can satisfy all of the following:

* Easy to understand. (A password is just a word/phrase/string of characters only you know.)

* Easy to use. (Using a password only requires remembering and typing it in when prompted.)

* Convenient. (Only your ability to remember and type required. No other tools or gadgets required.)

* Simple. (All of the above.)

If something needs an essay to describe itself, it's not killing off passwords.

Re: Passkeys: The beginning of the end of the password

#313

Post by howinteresting »

voxic11 wrote: post #197
michaelt wrote: post #192

Earlier quoted context omitted.

The article says "Instead, passkeys let users sign in to apps and sites the same way they unlock their devices: with a fingerprint, a face scan or a screen lock PIN." Does that not rather imply that, if I log in with faceid on an iphone, my login will be tied to my ability to faceid on an iphone, and hence only available on iphones and macs? As a user, that's sounding a lot like platform lock-in to me. And as a devel…

No passkeys are just normal private keys. You can store those private keys in a particular platform's secure key store which on phones can be decrypted/made usable when you unlock the device. But there is nothing stopping you from transferring these keys to a different device if you wish.

How exactly would you transfer your iOS passkeys to Android? Please provide an enumerated list of steps.

Re: Passkeys: The beginning of the end of the password

#314

Post by 8organicbits »

Zamicol wrote: post #289

On my website, I'm doing authentication via simple public key authentication using Coze. No passwords. No email. No Google. Just public key authentication with private keys in possession of the user. https://github.com/Cyphrme/Coze

I've always expected end users would struggle to manage private keys. What sort of users does your website have?

Re: Passkeys: The beginning of the end of the password

#315

Post by CatWChainsaw »

The technology of passwords has been around for millennia, never perfect, not terrible enough to throw out wholesale. As I said somewhere else, the democracy of authentication, the best of several imperfect options. Certainly I'm not securing anything of mine behind my phone (can be broken) or my face (can also be broken) on a proprietary system under Google's fickle control, when my brain is less likely to be broken (and if it's not, I'll have much bigger problems to worry about than getting into my accounts).

Re: Passkeys: The beginning of the end of the password

#316

Post by microtonal »

laegooose wrote: post #308
TulliusCicero wrote: post #302

Earlier quoted context omitted.

This goes into more detail: https://developers.google.com/identity/passkeys As far as I can tell: it's a system of private keys stored on devices, in order to transmit a key you also need to unlock a device (e.g. phone) with some other method like a PIN or fingerprint/face scan. Combine those two things and it means a would-be hacker would need both the physical device as well as the local authentication for that dev…

Can it be uses on both Android and iOS? What about desktop machines with no fingerprint sensor or faceID? What happens if user loses the only device on which passkey was enrolled?

In principle it can be synced between any is, it just depends on the cloud/implementation. Eg. 1Password is currently adding Passkey support, that would probably work on any device they have browser plugins and the private key material is stored and synced through 1Password vaults.

Re: Passkeys: The beginning of the end of the password

#317

Post by compiler-guy »

dcow wrote: post #179
SadWebDeveloper wrote: post #173

This looks and feels like passwords with extra steps... I mean now i need to "store, manage and secure" my per-user-certificate sorry "my passkey" myself and if its get compromised its my fault, how are passkeys more "secure" than enforcing a secure long password that the user can't change unless he met certain conditions and its conveniently stored inside the password manager i just built. What happens if i lost all…

The solution, for you, is a cloud synced passkey manager, possibly a custodial one. A password manager with strong passwords is weaker than a password manager with passkeys, because passkeys use asymmetric crypto and passwords+2fa involve exchanging a shared secret over an insecure channel at some point (yes I'm considering 1-sided TLS an "insecure" channel here). Trust the security experts when they say passkeys are…

> Trust the security experts when they say passkeys are more secure.

I trust the security experts when they say passkeys resist various attacks better than current systems...

> Now, solving the UX to make it match that of passwords plus managers today is the problem, agree.

... but poor UX makes it likely the users will end up doing things that are less secure, not adopting them at all, or messing things up themselves in such a way that they lock themselves out of their accounts.

So until the UX issues are fixed, "more secure" only in the narrow definitions that sophisticated security folks worry about. If the folks I support blow it, it doesn't matter that some mostly theoretical MITM attack was prevented.

Re: Passkeys: The beginning of the end of the password

#318

Post by witcH »

segmondy wrote: post #41

I'm still salty about this. Called it passkey too. http://www.multipasskey.com/susdemo/ . Built this 5-6yrs ago and applied to YC. Crickets. Hope to see this take off, with my approach I made it where you don't even need to "register", you can go to a site and just have an account. I did the fingerprint, face scan, PIN approach for more security, but my favorite was NFC ring. Basically you have an NFC ring you wear o…

https://www.tokenring.com/

Re: Passkeys: The beginning of the end of the password

#319

Post by echeese »

laegooose wrote: post #308
TulliusCicero wrote: post #302

Earlier quoted context omitted.

This goes into more detail: https://developers.google.com/identity/passkeys As far as I can tell: it's a system of private keys stored on devices, in order to transmit a key you also need to unlock a device (e.g. phone) with some other method like a PIN or fingerprint/face scan. Combine those two things and it means a would-be hacker would need both the physical device as well as the local authentication for that dev…

Can it be uses on both Android and iOS? What about desktop machines with no fingerprint sensor or faceID? What happens if user loses the only device on which passkey was enrolled?

It can be used on both Android and iOS. Desktop machines can display a QR code which you scan with your device. Passkeys are backed up to the cloud using E2E encryption. If you get locked out of that device, you can do the same thing as when you lose your password.
Post reply on HN