Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

371–380 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#371

Post by aimor »

NikolaNovak wrote: post #345

Ignorant question: Are Passkeys, at some level of abstraction, permanently replacing "something you know" (password) with "something you have"? If I am in some kind of calamity (dropped my phone, got robbed, etc), and I come to a friendly person's house, it sounds to me like I simply would not be able to login to potentially critical services, no matter how much I know , because I don't have anything (the device that…

"And... am I the only person completely dreading this system? Passkeys sound... like a nightmare?"

It's already a bad dream for me. I can't stand all the 6-digit code I have to fetch to do things like: check email, schedule appointments, pay bills, just plain buy stuff. I'm glad we're long past the days of emailing users forgotten passwords in plaintext, but I'd prefer to accept less security for the convenience of being able to log into an account without proving my identity via phone.

Re: Passkeys: The beginning of the end of the password

#372

Post by shortcake27 »

JoshTko wrote: post #368

One weakness with passkeys is that a person can't login to an account with just information that they know. I.e. they need a authorised device. Given that devices can be lost, it seems that folks that only own one device should not use Passkeys. Most passkey users should probably have a minimum of three biometric enabled - authorized personal devices if they want to use passkeys. This might be the biggest roadblock t…

The goal from all vendors is absolutely to have passkeys backed up to the cloud. In fact, passkeys on iOS required iCloud Keychain to be enabled. Then the only issue is reauthorisation with the vendor when the only trusted device is lost. It would be surprising if vendors didn’t cater for this scenario.

Re: Passkeys: The beginning of the end of the password

#373

Post by sparkie »

pphysch wrote: post #130
hdiehdis wrote: post #53

Earlier quoted context omitted.

i say this every time this is mentioned... all these thing are mostly to help advertisers and fight spam and reduce cost on their servers. theres a million ways to provide this functionality without relying on vendor lock in. they are pretty much working as a mini certificate authority/vendor. instead of vetting clients and giving them CAs, they just run your credit card for some hardware or subscription, and validat…

> theres a million ways to provide this functionality without relying on vendor lock in. they are pretty much working as a mini certificate authority/vendor. Identity systems aren't too technically difficult, the challenge is properly rolling them out and getting mass adoption. Which means getting vendors/users on board. It's a problem solved by power and politics, not technological innovation.

I recall Mozilla tried something similar around a decade ago, which was a good solution but didn't get any adoption. There's also been approaches like OpenID which were once popular, where you can have a single login, but they have the problem of third-parties aggregating the sites you visit. Who uses OpenID today? It's all been replaced by facebook or google login.

Part of the difficulty of using secure credentials is sharing them between devices. It's easier to involve a third-party like Google who can do this for you. The big-tech doesn't actually want to solve the problem entirely because they want some form of control: Either locking you into their service, or aggregating the sites you log into, or both.

They also want your biometrics, and keep pushing the narrative that biometrics are for authentication, but biometrics should only represent identity, not authority.

Re: Passkeys: The beginning of the end of the password

#374

Post by jdeibele »

I've lost a lot of confidence in Apple's keychain. I had been using iCloud Keychain and backing up username and password into BitWarden.

I say "had been" because 189 lines of garbage entries are in iCloud Keychain and I can't get them out. They look like this:

Title,URL,Username,Password,Notes,OTPAuth www.amazon.com (MEoEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECJeL6XzO81KJBCA02+DHVDASQ5Y3hOVrhGjCxV9Mv9qSEOc7uod7iKS3Rw==),https://www.amazon.com/,MEoEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZI...,, (repeat for various sites 188 times)

I've tried deleting them multiple times but they always come back. I've filed Feedback with Apple but no acknowledgement of the problem. There's no hint as to whether the problem is with one of my devices or with iCloud.

I've switched over to BitWarden entirely. At some point, I guess I try deleting the keychain and starting over but I really am concerned about using something that allows an error like this.

Re: Passkeys: The beginning of the end of the password

#375

Post by JohnFen »

lxgr wrote: post #361
jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

How about: "Passkeys are digital keys that can be securely stored either in a physical device (such as a Yubikey) or in an online account (such as iCloud Keychain or Google Passwords)"? Thinking about this some more, maybe we should start calling Yubikey etc. keyrings, rather than keys, given that they can store multiple independent passkeys securely?

Yubikeyrings? I like it.

Re: Passkeys: The beginning of the end of the password

#377

Post by pas »

dotancohen wrote: post #288
skybrian wrote: post #209

Earlier quoted context omitted.

I don’t know about privacy, but the lockout risk doesn’t seem worse than losing your phone or Yubikey. You should have multiple independent ways to log in for any account you care about. Passkey will be one way. Possibly two ways, if you have both Android and iOS devices and you register both? (I assume Android and iOS remain independent.)

So if passkey is just yet another way to log in, then all the security aspects are moot, no? The attacker could still attack the other login methods. E.g., even if the passkey is a secure surface, it does not replace the insecure attack surfaces.

ideally the site requires 2FA for those, or sends a confirmation email and makes you wait a few hours, etc.

Re: Passkeys: The beginning of the end of the password

#378

Post by esquivalience »

__MatrixMan__ wrote: post #370
mk89 wrote: post #357

Earlier quoted context omitted.

You need to click on the link that is in the post: https://blog.google/technology/safety-security/one-step-clos... > Instead, your phone will store a FIDO credential called a passkey which is used to unlock your online account. The passkey makes signing in far more secure, as it’s based on public key cryptography and is only shown to your online account when you unlock your phone. It looks like a token stored on your…

Why not call it a private key then, we've been handling those since the 70's. They don't need to be rebranded, they need to be taught in high school with the same words we've always used to talk about them.

Why not call passwords private words? We've been using words even longer.

The answer is that they're being used to pass an authentication challenge. Pass + key is no different.

Re: Passkeys: The beginning of the end of the password

#379

Post by xdennis »

shadowgovt wrote: post #321
berkle4455 wrote: post #310

Earlier quoted context omitted.

It’s a password that Google controls so when they incorrectly ban you from their services you lose access to literally everything. Or if you drop your phone in a lake you’re out of luck too.

It's the second one, not the first one. The protocol is private key stored on your hardware; public on the service you're authing to. Google doesn't have a way to MITM that, but if you lose the machine storing the private key, best have another way to auth. (Note: some implementations, including Chrome on Android, do allow sync and sharing of the key, but IIUC even if Google bars you access to your account, the phone…

> Google doesn't have a way to MITM that

Google controls the software so it can MITM.

Post reply on HN