Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

321–330 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#321
post #5

Slightly offtopic, but I really find the Bitwarden Clients to be lacking in the feature department. I switched to Bitwarden a few month ago and the client has evolved (for me) ever since. There are a few basic features missing, such as that if I search for something I wrote in the notes of password, that the client shows the according password. I get that the open-source model implies that everyone can contribute and…

Adding on to this. I've watched Bitwarden with interest, but I won't be moving to it anytime soon. Nor can I recommend it to others in good conscience since there's a basic UX issue that makes it easy to accidentally lose generated passwords.

https://community.bitwarden.com/t/persistent-bitwarden-ui-an...

A recent response to this issue was that "it's a feature, not a bug". I've been waiting to see it added to their roadmap, but it's missing from the 2023 roadmap. So I guess I will have to wait another year

Re: Bitwarden Acquires Passwordless.dev

#322

Not sure if this is new information or not, but this post mentions that Bitwarden is planning to support passkeys starting in 2023. That's great, since AFAIK all existing passkey implementations are tied to a specific browser or OS, and have no way to export the keys, which isn't great for a program designed to own the keys to your digital life. I'm hopeful Bitwarden will solve that problem, and that their example wi…

> That's great, since AFAIK all existing passkey implementations are tied to a specific browser or OS…

1Password and Dashlane have both announced support for generating/using passkeys via their browser extensions.

It is a good thing that bitwarden is looking at this too.

Re: Bitwarden Acquires Passwordless.dev

#323

Interesting demo. What happens though if the device holding the private key is lost? Or Apple decides to shut down your iCloud? Is there a backup option, similar to backup codes for OTP?

Just like TOTP (used for most 2FA) the best practice for websites accepting passkeys will be to support as many passkeys as you wish to enroll. So you could enroll into your account some device associated with your Apple ID and some device associated with your Microsoft Account and some device associated with your Google Account and some browser associated with your Firefox Account and use any of those for recovery.…

[deleted]

Re: Bitwarden Acquires Passwordless.dev

#324

Earlier quoted context omitted.

On iOS this seems to use the iCloud Keychain which is slick but how would I then login to sites using Firefox or any computer that doesn’t have access to my keychain? The reason I use a 3rd party manager is precisely this reason.

Sites should likely let you enroll multiple such passkeys from different vendors (add a Microsoft Account passkey from your PC, a Google one from your Chromebook, etc). Apple already supports Keychain sync with Edge on Windows and I believe that already supports Passkey access. Also, I believe I heard rumor that "Sign in with Apple" (their existing OpenID Connect account system) will also eventually support helping y…

> Sites should likely let you enroll multiple such passkeys from different vendors (add a Microsoft Account passkey from your PC, a Google one from your Chromebook, etc).

This sounds good, except how would it actually work?

I register in on my iPhone, it uses a key kept on that phone/iCloud. I log in via Safari on MacOS and it works because of iCloud sync.

Now I go to login using Edge on Windows. How can the website find out that I'm the same user as the iPhone/Safari user since I can't sync my key, and I can't enroll my MS Hello ID (or whatever Windows uses) on my Mac or iPhone?

Re: Bitwarden Acquires Passwordless.dev

#325
post #215

Earlier quoted context omitted.

Well, passkeys come with another very interesting property: they make it entirely useless to obtain the database of user credentials from services. It only contains public keys specific to a single service, so you cannot use them anywhere else. Additionally, private keys are stored on secure storage in client devices (or need to be decrypted themselves using a second factor), so there’s pretty much 0% risk of mass cr…

> they make it entirely useless to obtain the database of user credentials from services. It only contains public keys specific to a single service, so you cannot use them anywhere else. This is also the case for anyone using unique passwords per site, which is the standard for password vault users. Not much of a win there. > Additionally, private keys are stored on secure storage in client devices (or need to be dec…

> Also exactly the same as password vaults, but we still stress about Lastpass losing their encrypted vault DB.

The stress was because Lastpass databases were only partly encrypted and the encryption was not based on random keys.

Re: Bitwarden Acquires Passwordless.dev

#326
post #226

Earlier quoted context omitted.

Shameless plug to my own passkey manager, which is 100% open source: https://bulwark.id One of the big challenges to passkeys right now is that they aren’t as versatile as passwords, but this doesn’t have to be the case. Passkeys should be able to be exported and stored anywhere you want (ideally in an open source solution). Bulwark Passkey supports that right now, but I’m glad that other products are also providing…

The problem is that big companies don't want them to be as versatile. They don't trust us to manage our credentials. Hence FIDO2 and Passkeys feature 'attestation' that allows them to only accept 'trusted' implementations. This accreditation is a crypto process so it can't be faked. So, you can't just put your keys in any app you wish, like you can with TOTP. There will be strong pressure to just 'go with the flow' e…

This sounds like an antitrust issue. Similar to Microsoft windows and the explorer browser.

Re: Bitwarden Acquires Passwordless.dev

#328

Could someone clarify what the relationship between passkeys and WebAuthn is? Is it that Passkey is the Apple, Google, Microsoft implementation (commercialization?) of WebAuthn? If so, does it add anything on top of WebAuthn that makes it differ in some fundamental way? Also, are passkeys how WebAuthn is most commonly actually used in practice? Apologies for the noob questions.

Web Authentication works by having devices that provide authentication factors (authenticators), and providing APIs to register some authenticator with a website, or prove presence of a previous authenticator.

The authenticators allow for this registration and proof via generated public key pairs. These key pairs along with other configuration are referred to as Web Authentication Credentials.

There are several modes you can request, such as user verification (perform an additional non-possession factor, such as prompting for a PIN or biometric). You can choose between a model where you challenge authenticators based on previous registration handles, or "ask into the void" if any authenticator thinks there's a valid credential registered for the site. That second mode is called a discoverable credential.

A passkey is a discoverable credentials which supports user verification.

The term isn't trademarked, and just is meant to describe 'a more secure alternative to passwords', but there are a minimal set of features supported. The hope is, like passwords, society will get to a point where we don't have to explain what a passkey is. Support is typically provided by the same software and integration as a password manager.

It doesn't require any capability which was not in Web Authentication Level 2, the prior spec. That said, the platform vendors appear to be taking a much more opinionated idea on how things should be used, and what sort of capabilities (and security posture) should be exposed via the authenticators exposed by their browsers/operating systems.

Most particularly, passkeys are expected to be backup-eligible - e.g. that there is some sort of back-end storage and recovery mechanism. This likely is tied to some sync fabric provided by the platform.

This provides a better user experience in many cases, and reduces the burden on websites to do account recovery (say, if you lose your security key or buy a new cellphone). An authenticator like a Yubikey 5 which supports the other features but does not support backups generates credentials called "single device passkeys" to distinguish this behavior.

Web Authentication Level 3 should eventually expose this backup information to websites, as it is likely a relying party will want to know that the user credential is somewhat 'robust' before they take any sort of migration step like offering to delete any password-based credentials previously used on an account.

In terms of how it is most commonly used - there is significant established usage of WebAuthn, which also supports the functionality of old U2F keys as second factors to a password-based login, such as on sites like Google and Github.

In terms of the 'usernameless and passwordless multi-factor' authentication provided by passkeys, it is expected that the commitment by Apple/Google/Microsoft to support this system will drive adoption, and that it will become the dominant mode of operation. This is all relatively new though - Apple and Google launched toward the end of last year with new backup-capable passkey implementations and new platform-level UX.

That said, the backup eligibility concerns more traditional organizations who are concerned about having Apple/Google/Microsoft clouds as part of their attack surface. The cloud synchronization means that it is debatable whether it meets their needs of considering the phone as a physical factor. And Apple at least offers the ability to 'share' passkeys with contacts over proximity wireless, which interferes with some regulatory requirements. A certain amount of evolution may be needed for them to accept a credential from an authenticator with these characteristics as a sole factor.

Re: Bitwarden Acquires Passwordless.dev

#329

Earlier quoted context omitted.

Passkeys are effectively software security keys, stored in whatever keychain you're using (Chrome or iCloud Keychain or otherwise); for the major implementations you're hearing about, the goal of their implementation is improving the UX by syncing your passkeys between devices, so as long as you can access your passkey keychain, you won't have to worry about losing your security key for that website. As for how "pass…

It’s cool but until Apple lets Firefox use said keychain I’m not going to use it.

Firefox should have a platform entitlement that lets them just delegate to Apple's implementation when available. This is I believe what they do on Windows.

Re: Bitwarden Acquires Passwordless.dev

#330

Could someone clarify what the relationship between passkeys and WebAuthn is? Is it that Passkey is the Apple, Google, Microsoft implementation (commercialization?) of WebAuthn? If so, does it add anything on top of WebAuthn that makes it differ in some fundamental way? Also, are passkeys how WebAuthn is most commonly actually used in practice? Apologies for the noob questions.

(Full disclosure: I work at https://passage.id ) WebAuthn is the short name for the "FIDO Alliance Web Authentication Protocol". "Passkey" is the trade name (that Apple tries to own) for the "stuff" that results from using the WebAuthn protocol. At it's root, a passkey is really the private key portion of that "stuff" that is kept. So yes, in practice, a passkey is the result of a WebAuthn implementation. MS, Apple,…

> WebAuthn is the short name for the "FIDO Alliance Web Authentication Protocol".

Web Authentication is a standard from the W3C, with original contributions from FIDO Alliance and a lot of collaboration with members. It is very much not a FIDO standard.

FIDO has their own branding, marketing, and certification, as well as the CTAP protocol which builds on top of WebAuthn and describes how to communicate to an externalized authenticator (e.g. a USB or NFC security keyfob). They also work on several standardization efforts in other areas, such as IoT device onboarding and identity verification for documents.

> "Passkey" is the trade name (that Apple tries to own) for the "stuff" that results from using the WebAuthn protocol.

A passkey is a non-trademarked term (at least by Apple/Google/Microsoft) for a Web Authentication credential that has been registered with a site, that provides user verification, discoverability, and (optionally) backup eligibility characteristics.

In layperson terms, it is "a more secure alternative to a password" provided by their password manager. In particular, that security is strong phishing resistance as well as breach-resistance (e.g. greatly limits the impact of a copy of a website credential data dump)

Post reply on HN