Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: A shattered dream

fy.blackhats.net.au

Post reply on HN
Print view View original

431–440 of 789 posts

Re: Passkeys: A shattered dream

#431

Post by skybrian »

knallfrosch wrote: post #213
vanburen wrote: post #82

Usernameless always seemed like an optimization too far to me. I think it's totally reasonable, and probably a good thing for users having to use their username at login. Especially as it reminds them what username they are using for that service. I could totally see a situation where a user uses a Usernameless passkey for years to access a service and for some reason loses access to the Usernameless passkey, and the…

There's no account recovery process for passkeys. I thought they are your identity?

No, that's like having only one key to your house.

If you have two passkeys from different providers, they serve as backups for each other. And there are other alternatives, like a printout of recovery codes.

Re: Passkeys: A shattered dream

#432

Post by ar-jan »

CogitoCogito wrote: post #392
dfabulich wrote: post #366

Earlier quoted context omitted.

People keep trying to answer this question, so I'll try, too, but I'm going to do a better job than anyone else. ;-) Passkeys are randomly generated passwords that are required to be managed by a password manager. All the major password managers support them, including Apple, Google, Microsoft, Mozilla, and 1Password. By requiring the passkey to be managed by a password manager, you get some anti-phishing protection.…

Do you know if there an open source self-hosted implementation available?

https://github.com/protonpass

Also see https://proton.me/blog/big-tech-passkey

Re: Passkeys: A shattered dream

#433

Post by abdullahkhalids »

c0wb0yc0d3r wrote: post #298
throwaway48476 wrote: post #294

Earlier quoted context omitted.

The unstated value of a USB key is the functional similarity to metal keys for ordinary people.

This is exactly how I describe them to many as well. I just wish there was a USB key with the durability of a metal key.

If there was a NFC only version of these (and laptops came equipped with NFC), then we could make a block-of-metal key. No ports/holes and no buttons. Would be water proof and crush resistant. Assuming that you can send NFC signals through metal.

Re: Passkeys: A shattered dream

#434

Post by skybrian »

bradley13 wrote: post #128
macrael wrote: post #75

Passkeys can't actually replace passwords, right? I will always need a username and password with a website, then can generate a passkey as a separate auth mechanism, which if I lose, I will recover by setting up again using my username and password? I don't get how we can get to a place where passkeys are all, how do you get a passkey on a new device when you only have passkey auth on some other device enabled?

That's not the idea, no. The idea is that - instead of a password - you have a cryptographic key. Like an SSH key. This key is managed for you, so you never have to see it or type it. You ought to be able to either have just a few keys, or else a different key for every service you use. Unfortunately, the big players are trying to force this (really excellent!) idea into platform dependency. They want to store the ke…

Both iOS and Android sync to other devices in the same ecosystem, so there is at least a limited form of device portability.

If you have both, register two passkeys with each account and that's even better, since they back up each other if the vendor somehow deletes your account.

Re: Passkeys: A shattered dream

#435

Post by novok »

jerf wrote: post #268
pseudo0 wrote: post #261

Earlier quoted context omitted.

Agreed, they unfortunately seem to have gone the vendor lock-in route. The big players don't have export utilities for passkeys, despite it being technically feasible and pretty straightforward to implement. That's a pretty major gap in the spec, there should be a standard export/import format, and vendors should be required to implement it in order to be compliant. It's probably possible to extract passkeys from a r…

This has always been my objection to them, as a user, as they have been presented. As an employee, I don't care. Businesses have sufficient relationships and mechanisms to self-serve any issues that come up, like lost keys. But as a user, I do not. It is a drop-dead requirement for me for any authentication material that I have some way of backing it up and modifying it in case of compromise. Besides, give the Silico…

I'm not quite sure if even the corporate case works properly with iOS & Android devices as the article states, otherwise you could become a 'corporation of one' and side step all of this stuff. Even the corporations look like they have to use apple or google's crap for employee devices and accounts?

Re: Passkeys: A shattered dream

#436

Post by throw7 »

Just wanting to get rid of "passwords" means getting rid of "something i know" as an authentication factor. That should not be the goal. The issue is that the other authentication factors have real drawbacks. It's tradeoffs all around.

'something i have' means carrying something around and also the possibility of it being forgotten/stolen/broken/taken by authorities (legally even!) and the repercussions of that. i'm fine with this, only if i am allowed to access/export/copy/store the keys myself. I can do that with totp auth and i do. people say this "breaks" security. but the point is: i control what i own; i control me (not you).

'something i am' has the worst drawback. you can't change it! the other issue is you are not the unique snowflake you think you are. Also, side note of a personal experience: India has mass fingerprinted everyone, yet in trying to do some bank transactions in India the fingerprint read/auth kept failing for an acquaintance.

Re: Passkeys: A shattered dream

#437

Post by vel0city »

Macha wrote: post #414
vel0city wrote: post #405

Earlier quoted context omitted.

> every time I sign up to a site I need to grab all 5+ devices I might ever use and add them to every site, or I can't e.g. log into my D&D game while travelling because I forgot to generate a key on the work laptop? You don't need to log in to every app on every device the instant you register a new account. Just make a passkey on a couple of devices that you're likely to have around and you'll probably have what yo…

This really doesn't contradict the problem of needing to sort out M sites x N devices, where M can be very large. Whether you do it eventually or do it straight away. Unless you can predict which devices you will have and which sites you will need access to at any given point, then it degrades to needing everything authenticated just in case.

I'm pretty much never too far from either my phone and my security key, seeing as how at least my phone is my car key and my wallet the majority of the time and a security key lives in my backpack.

Sure, M devices can be quite large, but the odds of me being at only one device and not any of my portable devices is extremely small. As long as I have at least one other device I've previously logged in to somewhat handy, I can still easily get in. Maybe that initial login is marginally more complicated, but IMO the ease of future authentications more than makes up for the small bit of initial friction the first time.

And in the rare instance where I'm suddenly on the moon and realize I left practically every other computing device and physical authenticator on another planet, I guess I just won't have access to a DnD tool. Oh well.

Re: Passkeys: A shattered dream

#438

Post by 0xbadcafebee »

There is no auth panacea. There's too many different use cases, too many players involved. You cannot create one "thing" that solves all the problems for all the people. It was hubris.

Instead, if "the industry" wants to solve "the problem", they need to write down all the use cases. Then we can argue about how to do that, and the result will probably be a couple different things that solve a couple different groups of use cases.

But what will always suck is letting "the industry" dictate to us "tech peons" how that should happen. They always come up with bloated standards that are a pain in the balls. So rather than let "the industry" solve the problem, I think we need a loose confederation of open source contributors and corporate goons to meet on some forum somewhere and hash it out. Let the solutions (plural) come organically without a single player controlling the conversation.

Re: Passkeys: A shattered dream

#439

Post by skybrian »

sedatk wrote: post #401
skybrian wrote: post #395

I don't trust passkeys, and yet so far, I'm not bothered by them. This is because I use them as an additional way to log in. The other day I noticed that for some reason GitHub couldn't seem to find my Android passkey. Weird. So I logged in using my Yubikey and recreated it. But this would be a lot worse if it were your only way of logging in. Always have multiple authentication methods for important accounts.

You can have multiple passkeys (using different devices or passkey providers) for a single site too. You don't need to fall back to another login mechanism.

Yep, that too. It's especially convenient if you have both iOS and Android since you can easily log in using either.

Re: Passkeys: A shattered dream

#440

Post by pixelHD »

CogitoCogito wrote: post #392
dfabulich wrote: post #366

Earlier quoted context omitted.

People keep trying to answer this question, so I'll try, too, but I'm going to do a better job than anyone else. ;-) Passkeys are randomly generated passwords that are required to be managed by a password manager. All the major password managers support them, including Apple, Google, Microsoft, Mozilla, and 1Password. By requiring the passkey to be managed by a password manager, you get some anti-phishing protection.…

Do you know if there an open source self-hosted implementation available?

I use selfhosted vaultwarden [0] instance (its a rust implementation of the bitwarden server), and the bitwarden apps (i point the apps to use my server instead of bitwarden).

Vaultwarden + bitwarden client apps (for desktop/browsers) have passkey support, and i've been using them for a month or two without any issues.

That being said, bitwarden client apps for android and ios are going through a rewrite (from xamarin to native iirc), and are yet to support passkeys. However, the bitwarden folk said passkeys are the next feature coming to these apps.

[0]: https://github.com/dani-garcia/vaultwarden

Post reply on HN