Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

431–440 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#431

Post by dwaite »

__MatrixMan__ wrote: post #370
mk89 wrote: post #357

Earlier quoted context omitted.

You need to click on the link that is in the post: https://blog.google/technology/safety-security/one-step-clos... > Instead, your phone will store a FIDO credential called a passkey which is used to unlock your online account. The passkey makes signing in far more secure, as it’s based on public key cryptography and is only shown to your online account when you unlock your phone. It looks like a token stored on your…

Why not call it a private key then, we've been handling those since the 70's. They don't need to be rebranded, they need to be taught in high school with the same words we've always used to talk about them.

It isn't (just) a private key. It is part of a purpose-built authentication process that leverages private keys as a component.

You cannot use the private key within a passkey for general purpose data signing, for example.

Re: Passkeys: The beginning of the end of the password

#432

Post by dwaite »

internetter wrote: post #397
mastazi wrote: post #386

Earlier quoted context omitted.

So it's like a private key but you can't access or manage it, as it's owned by Google/Apple/Microsoft? How convenient!

My reaction as well. From Google's FAQ: > Passkeys created on Android are backed up and synced with Android devices that are signed in to the same Google Account, in the same way as passwords are backed up to the password manager. I don't like this. Time will tell if Google's implementation will be open source, and if third parties can hook into the OS level integration. I certainly don't like the lack of emphasis on…

> Time will tell if Google's implementation will be open source, and if third parties can hook into the OS level integration

It is all user terminology for Web Authentication features, so credentials stored on a current Yubikey are also "passkeys".

There are multiple open source security key hardware implementations that support the published specs.

There are multiple password managers that have started to implement "passkey manager" functionality - 1Password and Dashlane have made announcements here and have published code and Web Extensions for desktop.

Android 14 beta has a system API where software providers such as 1Password and Dashlane can work with this system, not just for Chrome but for installed applications.

I doubt Google's Password Manager will ever be open sourced, but it doesn't need to be for an interoperable ecosystem.

Re: Passkeys: The beginning of the end of the password

#433

Post by csomar »

snowwrestler wrote: post #417
csomar wrote: post #413

I understand crypto/web3 are hated because of all the scams and NFTs out there. However, I worked on a web3 login implementation and I think it’s the best login/account experience out there. Basically, your private key is your password. You can use your phone, a browser extension or a hardware wallet (kind of the equivalent of a YubiKey). It’s a pretty straightforward experience and it keeps the full ownership of the…

This is how passkeys work

I’m not familiar with passkeys. Can you back it up as a bunch of words? Does it require a third-party thing or the implementation is fully independent.

Re: Passkeys: The beginning of the end of the password

#434

Post by mattdesl »

snowwrestler wrote: post #417
csomar wrote: post #413

I understand crypto/web3 are hated because of all the scams and NFTs out there. However, I worked on a web3 login implementation and I think it’s the best login/account experience out there. Basically, your private key is your password. You can use your phone, a browser extension or a hardware wallet (kind of the equivalent of a YubiKey). It’s a pretty straightforward experience and it keeps the full ownership of the…

This is how passkeys work

It seems passkeys mostly operate in the cloud, like replication across all iCloud connected devices? This seems like a major point of vulnerability for the average user.

Private key infra in crypto/web3 tends to promote best practice as offline, paper wallet, airgapped devices, etc.

Re: Passkeys: The beginning of the end of the password

#435

Post by dwaite »

xg15 wrote: post #383
mk89 wrote: post #357

Earlier quoted context omitted.

You need to click on the link that is in the post: https://blog.google/technology/safety-security/one-step-clos... > Instead, your phone will store a FIDO credential called a passkey which is used to unlock your online account. The passkey makes signing in far more secure, as it’s based on public key cryptography and is only shown to your online account when you unlock your phone. It looks like a token stored on your…

I'm not completely sure, but my understanding is that it's basically the same principle as SSH keypairs, with the added twist that the user never gets direct access to the private keys. The keys are also per-device, so e.g. if you use your Google account from your phone, your laptop and your workplace PC, there would be three public keys associated with your account. Because the private key (in principle) doesn't eve…

> I'm not completely sure, but my understanding is that it's basically the same principle as SSH keypairs, with the added twist that the user never gets direct access to the private keys.

Pretty close - in fact you can use passkeys for SSH access, a la "ecdsa-sk", and in some cases "ed25519-sk".

> The keys are also per-device, so e.g. if you use your Google account from your phone, your laptop and your workplace PC, there would be three public keys associated with your account.

They are per authenticator. Some authenticators, like a Yubikey, hold their credentials in hardware. Some are backup capable - e.g. the "authenticator" is your iCloud account or Google account's password sync fabric (which are often secured more than the rest of those accounts).

This second class is what is known as backup-capable. Buy a new phone to replace your old one, and within the same ecosystem things just work because the platform authenticator can see all your old passkeys.

Across ecosystems, there is the ability to use your mobile phone as an authenticator for other devices. You can sign into an app on a Mac desktop using an android phone, for example.

Going forward, Android has beta code to support third party passkey providers. Hopefully other platforms support similar schemes, which would allow users to choose a cross-platform product rather than being platform-locked (or requiring them to buy hardware).

Re: Passkeys: The beginning of the end of the password

#436

Post by romwell »

esquivalience wrote: post #378
__MatrixMan__ wrote: post #370

Earlier quoted context omitted.

Why not call it a private key then, we've been handling those since the 70's. They don't need to be rebranded, they need to be taught in high school with the same words we've always used to talk about them.

Why not call passwords private words? We've been using words even longer. The answer is that they're being used to pass an authentication challenge. Pass + key is no different.

>Why not call passwords private words?

Because the word "password" has been in use for a long time, before computers, for the purpose of physically passing from one place to another.

The thing about password wasn't that it is a secret word, it's that it allows you to pass somewhere. Typically, passwords were a shared secret (i.e. not secret).

A digital key is typically different from a password in that it's not a word, i.e. not something people can remember a type. It's more like something you have than something you know.

In the context of cryptography it makes sense to distinguish keys from passwords, and public keys (used to "lock" data) from private keys (to "unlock" data). The word key is used for that concept because of the semantics of how keys are used.

A passkey is an abomination. A key, a-priori, is an object that opens locks; and we already have words for keys that allows you to pass somewhere: e.g. door keys.

A pass, in general, is something you present to pass somewhere, whether it's spoken or written; a key is not something you present to pass somewhere.

We have pass words, pass slips, hall/press/ski pass badges, etc.

We don't have pass keys, because you don't show a key to pass somewhere. You use it.

A password encoded as a QR code that you could show to a sensor would be a passkey.

Whatever Google has is probably something else.

Re: Passkeys: The beginning of the end of the password

#437

Post by MagicMoonlight »

segmondy wrote: post #41

I'm still salty about this. Called it passkey too. http://www.multipasskey.com/susdemo/ . Built this 5-6yrs ago and applied to YC. Crickets. Hope to see this take off, with my approach I made it where you don't even need to "register", you can go to a site and just have an account. I did the fingerprint, face scan, PIN approach for more security, but my favorite was NFC ring. Basically you have an NFC ring you wear o…

If your ring is your password then they'll just take your ring and your phone...

Re: Passkeys: The beginning of the end of the password

#438

Post by dwaite »

scott00 wrote: post #420
jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

The passkey itself is an encryption key. When you register a passkey to access a site, the component that holds the passkey generates a site-specific asymmetric encryption keypair. It then gives the site the (unencrypted) public key, and the private key encrypted with the passkey. To authenticate, the site sends the client the encrypted private key and a challenge. The client uses the passkey to decrypt the private k…

> The passkey itself is an encryption key.

Close - it is a signing key, e.g. used for integrity and authentication

> To authenticate, the site sends the client the encrypted private key and a challenge. The client uses the passkey to decrypt the private key, which it then uses to sign the challenge, then it sends the signature back to the site. The site verifies that the signature is valid and then lets you in.

This is how non-discoverable WebAuthn credentials (may) work, and is based on the U2F model. These hardware security key fobs did not have sufficient memory to store created credentials and associated metadata for potentially hundreds of sites. So instead, when you registered a credential it would generate a handle, and that handle would be returned to the site. To request authentication, you had to provide a handle which the authenticator understood. Such a model is really meant for second-factor authentication, e.g. after we partially authenticate the user with a knowledge factor, see if they have the physical factor.

A passkey in contrast is meant to indicate a discoverable credential. You don't need to provide those handles to authenticate. Instead, example.com shouts into the void (of browser javascript API) that it would love a previously registered credential. It hasn't authenticated the user at all, so it has no idea which credential that might be. An authentication response includes the handle and a signature, such that it can be correlated with the existing registration on a user account.

Passkeys add in user verification as a capability so that you can use them for the entire authentication process rather than as just one of the factors. This typically means a biometric challenge or knowledge based challenge, such as PIN/passcode entry.

Re: Passkeys: The beginning of the end of the password

#439

Post by dwaite »

jjav wrote: post #342
jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

> Until they develop a way to explain what passkeys really are, I question how quickly they will be adopted. The article is very frustrating, very long on fluff and no substance. If anyone has a link to a detailed technical description by an unbiased third-party (not google hawking their lock-in), I'd be very thankful if it can be posted.

You might like https://passkeys.dev if you want a more implementer-focused overview.

Re: Passkeys: The beginning of the end of the password

#440

Post by dwaite »

stanislavb wrote: post #418
jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

If people here can't understand what passkeys are, how are the "normies" gona get it? Or maybe the wide public is not supposed to get it how it works; they should "simply" use it.

The second. The term passkeys is meant to describe "like what I get with passwords, but easier/more secure'.

It's lowercase "p" - it isn't a Google or Apple brand.

Developers can use terms like "multi-device discoverable user-verifying FIDO/WebAuthn credentials" which have very precise technical meanings with demonstrated interoperability.

Post reply on HN