Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

371–380 of 789 posts

Re: Passkeys: A shattered dream

#371

Post by vel0city »

Arelius wrote: post #361
vel0city wrote: post #308

Earlier quoted context omitted.

Somewhat personal ancedote, but I've had pretty good experiences with Yubikeys. I've had one on my daily keychain for over a decade now. Its been run through clothes washing machines too many times to count, I've left it out in rainstorms, its been baked in the sun on hot summer days multiple times, its been dropped in pools, its been run over by a car, I've dropped it some pretty significant heights while hiking. It…

Maybe it’s the old USB version? I haven’t had so much luck… I had a couple of nanos, and those broke pretty quick. More recently, I switched to a usb-c version…. And while it still works and stays attached to the key ring. The plastic housing has broken already. I got a corp branded one now, that I’m trying and seems a touch more robust

I've only had the full USB-A style ones. Every device I've had that I've needed a yubikey with has either a USB-A or supported NFC. The >1 decade device is a Yubikey NEO, I recently got a Yubikey 5 USB-A variant and also have one of those FIDO-only blue Security keys in USB-A.

What kind of failures did you have for the nanos? They just became unresponsive? Did they suffer any obvious physical failure or any particular kind of event cause their failure?

Re: Passkeys: A shattered dream

#372

Post by SkyPuncher »

joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

They’re basically an advanced username/password that’s automatically generated by your device. I believe one of the benefits is they require an encryption component that is known only by the devices that you own. This is better than a password that’s stored on a server and can be lost.

Re: Passkeys: A shattered dream

#373

Post by Repulsion9513 »

saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

Go buy a Yubikey?

Re: Passkeys: A shattered dream

#374

Post by Edmond »

joshstrange wrote: post #134

I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not in…

Here's a primer on the basic idea: https://blog.codesolvent.com/2015/07/why-not-signed-password...

Re: Passkeys: A shattered dream

#375

Post by NoMoreNicksLeft »

vel0city wrote: post #333
NoMoreNicksLeft wrote: post #317

Earlier quoted context omitted.

> You shouldn't necessarily "sync" your passkeys across all your devices; each device should have its own passkey. Then if you lose a device (or that one device gets compromised), you revoke the one key and everything else is fine. If he's storing his passkey in his password manager, it wouldn't matter that he lost the device. They can't get to it, it's AES-somebigassnumber-ed up the wazoo. If the passkey is cached o…

That's assuming the user does have a strong passphrase to protect their local password safe and the device wasn't compromised while the password safe was in an unlocked state. If an attacker managed to get root on my machine right now, they'd get my whole password safe as its currently decrypted and in memory. However, they wouldn't be able to access any of my passkeys.

And if they get the passkey's private key, when you're signing some ticket to send off to prove identity? That has to be unlocked for that too, it's in memory somewhere.

Then they privilege escalate, lock out all your other devices after adding a new one, it's the same issue. And it's opaque, reinforces the ideas that users are too stupid to do anything right, so that we shouldn't even try.

Re: Passkeys: A shattered dream

#376

Post by sedatk »

crote wrote: post #201
stavros wrote: post #142

Earlier quoted context omitted.

> I want to still use a username/password and the Yubikey. Why?

Because of the whole "multi-factor" thing, and not making account recovery impossible? Passkeys are always going to be less secure than username + password + Webauthn, why would you intentionally make your account less secure and give yourself a massive failure mode in the process?

If you can recover your account solely with your username and password, then what security does your Yubikey provide?

Re: Passkeys: A shattered dream

#377

Post by donatj »

Mindless2112 wrote: post #286
donatj wrote: post #129

The problem with passkeys, beyond the painful UX that will scare any casual users away and the fact that they are being wielded as an extreme vendor lock-in mechanism is just that the design and implementation is so over complicated with second system syndrome. If you’re going to push a replacement for passwords and want it to be universal, it should be EASY to implement. Even if the backing cryptography is complex,…

If you want passkeys without Javascript, leave a thumbs-up on [1]. [1] https://github.com/w3c/webauthn/issues/1255

Good to know, thank you for the link!

Re: Passkeys: A shattered dream

#378

Post by whymauri »

victor106 wrote: post #365
tunesmith wrote: post #362

Every time I see a long inscrutable discussion about Passkeys, I see a weird avoidance of the "something you know" part of security. Here in the US, courts and law enforcement have every right to get your username, fingerprint, retina scan, face ID, whatever. But they don't have the right to extract something from your brain. Unless I'm missing something basic (which at this point, I don't think is my fault since thi…

> But they don't have the right to extract something from your brain. Most folks store passwords in password managers and don't use their brains to retrieve them.

password managers are growing, but I'm not sure that 'most' people use them. Maybe 'most' software engineers or techies, but the average person probably has no idea what a password manager is.

Re: Passkeys: A shattered dream

#379

Post by Repulsion9513 »

orbisvicis wrote: post #266
AlexandrB wrote: post #208

Earlier quoted context omitted.

It didn't have to be this way, but the hype train won over practical considerations: https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-tu...

Why couldn't a non-resident security key send it's public key as username? And the response contains the actual username and private key.

Privacy. The idea, IIRC, was to have separate identifying material for each site.

Re: Passkeys: A shattered dream

#380

Post by Fire-Dragon-DoL »

SkyPuncher wrote: post #367
victor106 wrote: post #365

Earlier quoted context omitted.

> But they don't have the right to extract something from your brain. Most folks store passwords in password managers and don't use their brains to retrieve them.

But my password manager locks….requiring something stored in my brain.

Doesn't your password manager use biometrics to unlock though?
Post reply on HN