Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toward a Passwordless Future

privacyguides.org

Post reply on HN
Print view View original

41–50 of 70 posts

Re: Toward a Passwordless Future

#41

Post by 0xbadcafebee »

Passkeys are not a panacea. They're an amalgam of multiple standards that half the time aren't implemented right or not fully supported. It's the industry's attempt to design-by-committee a one-size-fits all solution to many, many different problems. News flash: one-size-fits-all fits nobody well.

Passwords are a perfectly fine single factor. Add more factors to get more security, in specific use cases where they make sense. Passkeys don't fill the use case that a single-factor like passwords do.

Password Managers are also perfectly fine when combined with multiple factors and attack mitigations (and are certainly no worse than Passkeys we have now, key access managed by a central piece of software/key control/authorization). They solve many different use cases without breaking others. They're customizable, and not overly-dependent on standards. They are a loosely-coupled interface. They can be synchronized for multiple device/site access. They can be upgraded to support an infinite amount of security mechanisms. They can be changed in backwards-compatible ways, and they don't force one-size-fits-all on anybody. They even support Passkeys without forcing you to use them (though of course lots of Passkey software ignores the fact that you might have a password manager, and forces you to use the browser's Passkey store or nothing).

You want to uniquely identify a device? Fingerprint it on login. Having a separate passkey per device isn't any better, because if the attacker can get the device fingerprint, they can also probably get the passkey, because they have access to the device. And password reset still has to be a thing, because we all lose devices, backup codes, etc, so it's not like there isn't an easier attack anyway.

How is the passkey that much better than client-side certificates from 15 years ago? That was abandoned because of all the problems around key management; and now you want to bring back key management?!

Please stop trying to solve a problem by creating more problems. This is all about use cases. Just let users, and companies, decide what use cases they'll support. Don't force everyone to use a crap solution just because it makes big corporations happy.

Re: Toward a Passwordless Future

#42

Post by zabzonk »

A password, and extra secret information on things like my bank account have always worked well for me. I simply cannot stand 2FA using a smartphone. Why? Because I don't have or want one. Luckily, my bank allows use of a landline for 2FA, which works perfectly, but I dread the day they stop supporting it.

Also, the whole bloody thing with passwords is noxious. I don't want to login to your site, I just want to read some stuff.

Re: Toward a Passwordless Future

#43

Post by AlotOfReading »

freeone3000 wrote: post #31
grammarxcore wrote: post #21

The big thing missing from the article is how a device that contains many passkeys is any different from a password manager that enforces security settings. I don’t worry about passwords my password manager generates getting compromised because I use at least 24 random characters (assuming my password manager is using a cryptographically secure PRNG that guarantees some level of randomness, giving us more than 128 bi…

Passwords are still leakable, guessable, and can be phished. Passkeys are “second-factor-only”: your device responds to a challenge and acts in a similar capacity to a yubikey. The private keys contain much more entropy than a password, never leave the device, and the challenges and responses are both signed with site-specific keys so they can’t be phished. So from a security perspective, a lot is gained. From a user…

"Leakable" isn't a purely negative property. It's the same thing you can use to provide access to a trusted spouse, and ensures a trivial solution to the "lost device" problem when traveling.

Re: Toward a Passwordless Future

#44

Post by callc »

I am largely unconvinced of the downsides of passwords presented in the article. Especially the historical angle. Old != bad. In fact, it is a testament to the fact the the password system is simple enough to be done analog, easily understood without any training.

My question to the people here is are passkeys actually the future? Or are they an over-hyped over-engineered being forced on everyone? I say this as someone not knowing much of passkeys. And I'm not a fan of the "holier than thou" feeling from people proselytizing passkeys. Take the public's / user's doubts seriously. You wouldn't break into someone's home and force them to get a different lock mechanism for their safe, or front door.

---

Counter-points to "password bad"

> Password Overload

Use a password manager.

> Email Requirement

Passwords don't require email. Email is a used as user ID commonly. You can also use other mechanisms such as "store this long key in your records and if you forget your U+PW then use it for recovery".

> Single Point of Failure ... email acts as a one-stop shop for attackers looking to hack your accounts, either by getting into your email account itself or by sending you convincing password reset emails that send you to a phishing page ...

I agree. Solely having "what you know" info makes phishing possible.

> Service Provider Negligence

A weak argument that could be applied anywhere to "but I don't trust them to do the right thing". All we need is good U+PW auth libraries and clear education like https://thecopenhagenbook.com/. Give actually big fines for companies that have breaches, then magically security will get better.

> Human Error ... passwords rely on randomness to be secure, but they also rely on humans to generate them... Humans are very bad at generating random numbers

Use a password manager. This article reeks of a wannabe expert tone with the certainty, finality, and generality (I can speak confidently yet have an out because I used the word "most" or "possibly"!) of its claims.

> Imagine if every time you connected to a website with HTTPS, you had to come up with your own encryption key. Would that be a secure system?

I can't take the author seriously with these arguments. Put your big boy/girl pants on and use your brain, stop using hypothetical straw-mans to easily knock down.

Re: Toward a Passwordless Future

#45

Post by sedatk »

The article praises passkeys for not even needing email for login, but omits to mention recovery flow. How do you recover your account if you lost your access to the passkey provider, and you didn't provide an email address?

So, I think "not even needing email" is unlikely for foreseeable future, unless we find other ways to authenticate people reliably.

Re: Toward a Passwordless Future

#46

Post by lolinder »

acdha wrote: post #15
demarq wrote: post #12

Earlier quoted context omitted.

We can’t trust users to not re use a password, why do we expect they will go through the effort of storing / understanding recovery codes?

It’s easier to print things and you have clear instructions telling you why it’s important. The key here is thinking about relative risk: many people get compromised by reusing passwords or being phished every day compared to the number of people who simultaneously lose all of their devices and recovery codes.

It's not easier to print things. Only about 60% of the population has a printer and that number is going down, not up.

Re: Toward a Passwordless Future

#49

Post by aianus »

ajsnigrutin wrote: post #5
tptacek wrote: post #3

Earlier quoted context omitted.

The same thing that happens if you enroll in 2FA and lose your 2FA cred: you go into a complicated account recovery process. For this reason, at the huge providers, when you enable 2FA (or Passkeys) you usually have to set up a recovery buddy account or something like it.

But if that "buddy account" is 'passworded' by the same passkey device? Getting a new sim card with the same number is easy, you just go to your mobile provider with your ID card, and you're done in five minutes. I mean still... the article mentions a "single point of failure" as a bad thing with other methods, but forgets about it here.

Getting a SIM card is too easy, many millions have been lost to sim-jacking.

Re: Toward a Passwordless Future

#50

Post by brickfaced »

freeone3000 wrote: post #34
brickfaced wrote: post #26

So it's effectively SSH keys, but for regular app/site logins with a nicer UI.

Closer to having your existed devices work similar to a yubikey: it’s a signed challenge-response, per-site, instead of a single shared key.

That and the hypothetical ability to use different private keys per device, which could be canceled in case of loss or theft, seems legitimately useful. Not interested unless and until there's a standalone, standardized, open-source, cold-backup'ed way to use passkeys though.
Post reply on HN