Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: They're not perfect but they're getting better

ncsc.gov.uk

Post reply on HN
Print view View original

51–60 of 145 posts

Re: Passkeys: They're not perfect but they're getting better

#51

Post by secabeen »

AlexandrB wrote: post #47
gowld wrote: post #32

Earlier quoted context omitted.

lock-in to which vendor? Passkeys support transfer to any vendor you want.

Can you send some documentation on how ? For example, I tried googling for transferring a passkey out of popular systems and it doesn't seem possible[1][2] other than through JSON export[3] which is what some sites want to block as I understand. [1] https://old.reddit.com/r/Bitwarden/comments/1efs5d2/how_can_... [2] https://old.reddit.com/r/Bitwarden/comments/1di8nbz/import_p... [3] https://news.ycombinator.com/item?…

I don't think you're going to find it. The main vendors are hostile to this workflow. I get why, any flow that can exist to export passkeys can be used by hostile actors to walk a 75-year old millionaire grandma through handing over $$$. I think however that that's just a risk we have to make the bank and brokerages accept. It's not a problem with a technical solution.

Re: Passkeys: They're not perfect but they're getting better

#52

Post by magackame »

noirscape wrote: post #25

At its core, the main drawbacks that need to be solved for them to be a viable option are imo: * Improving OS flows. Every passkey implementer that's also an OS gets really excited about enrolling you into their proprietary clouds, and using alternate flows to respect the users wish to use their own manager is usually hidden in confusing UI forms that don't feel consistent if you don't already know what you're doing.…

God if it could just be a single key that you dump to paper or titanium plate and don't worry about backing up a zoo of keys/password with a cloud. Just take my one and only public key. If you care about per service privacy, you are welcome to use multiple. I don't think there is any compromise scenario where you would leak any single specific passkey and they are not bruteforcable. Why is it not as simple as that?

Re: Passkeys: They're not perfect but they're getting better

#53

Post by ngrilly »

josephcsible wrote: post #26
wbl wrote: post #23

Earlier quoted context omitted.

That's the whole point of this exercise. If export is possible it's not secure against local compromise in the way that's needed.

The point of passkeys is to protect against phishing and password reuse. You can't protect against local compromise, even if your passkeys are stored in something like a YubiKey, because once you log in to your bank with your hardware-backed passkey, the malware on your computer could use the session you started to transfer all of your money out of your account.

That’s why most banks ask you to approve transactions with an explicit reauthentication.

Re: Passkeys: They're not perfect but they're getting better

#54

Post by josephcsible »

ngrilly wrote: post #53
josephcsible wrote: post #26

Earlier quoted context omitted.

The point of passkeys is to protect against phishing and password reuse. You can't protect against local compromise, even if your passkeys are stored in something like a YubiKey, because once you log in to your bank with your hardware-backed passkey, the malware on your computer could use the session you started to transfer all of your money out of your account.

That’s why most banks ask you to approve transactions with an explicit reauthentication.

Then the malware will just wait until you want to do something legitimate that needs that, and then swap it out for its own thing.

Re: Passkeys: They're not perfect but they're getting better

#55

Post by skybrian »

abdullahkhalids wrote: post #15
etskinner wrote: post #7

Earlier quoted context omitted.

Let's assume your vault/login has these properties: - You have a strong unlock password that you don't use anywhere else - You have a second factor set up for unlocking the vault (TPM in the device you're using, Yubikey, TOTP, etc.) - The service you're logging into has good account recovery hygeine The benefit, assuming those things, is that the passkey is phishing-resistant and social-engineering-resistant. If a us…

My password manager (keepassxc) has a browser extension that only lets you autocomplete the password on a page if the url matches the one stored in the database. Sure I could manually copy the password from the database, but in practice, this is fairly good security. It also doesn't treat the user as an always-idiot, which is a good thing in my book.

That works for you, but the website doesn't know you use a password manager, so they'll often want you to use SMS as a second factor.

Passkeys require some kind of password manager. That's the main benefit. The adoption problems are because a lot of users don't really understand password managers.

Re: Passkeys: They're not perfect but they're getting better

#56

Post by zzo38computer »

IcyWindows wrote: post #40
sam_lowry_ wrote: post #28

How are passkeys different from API keys or just random chains of characters? And why can't we have the use of such keys enforced by an EU legislation so that all businesses allow users to login using such strings of random characters? The world would then be a better place.

Passkeys are a private key stored on your device with the public key registered with the server. Servers should allow multiple passkeys per user (so you can register multiple devices), but many don't.

X.509 already does that, and in a better way. It also makes it unnecessary to register multiple devices, if you allow certificate chains (the server would check the certificate chain; one of the was issued by the service and contains information about which account it is associated with; the other ones you can issue to yourself, optionally with more restricted permissions, and can be revoked or expire). That would also allow you to have passworded private keys, and/or to store one private key on a separate computer that is not connected to the internet to issue the other one to yourself in order to mitigate security issues (and you can revoke the certificate and make a new one if it is compromised or expires). X.509 also is not limited to only WWW, so it can be used with other protocols too.

Re: Passkeys: They're not perfect but they're getting better

#57

Post by ewoodrich »

abdullahkhalids wrote: post #15
etskinner wrote: post #7

Earlier quoted context omitted.

Let's assume your vault/login has these properties: - You have a strong unlock password that you don't use anywhere else - You have a second factor set up for unlocking the vault (TPM in the device you're using, Yubikey, TOTP, etc.) - The service you're logging into has good account recovery hygeine The benefit, assuming those things, is that the passkey is phishing-resistant and social-engineering-resistant. If a us…

My password manager (keepassxc) has a browser extension that only lets you autocomplete the password on a page if the url matches the one stored in the database. Sure I could manually copy the password from the database, but in practice, this is fairly good security. It also doesn't treat the user as an always-idiot, which is a good thing in my book.

I'm struggling to think of a reason why being "treated as an always-idiot" is an actual negative in this specific example.

I use Bitwarden and when the password autofill doesn't work as expected my first assumption from many previous experiences is that it's because a website changed something slightly in their auth flow or a particular page has a weird redirect/embedded login scheme different than the primary login, or similar "modern" web weirdness.

So if I get phished and let my guard down just that one time due to panic, sleep deprivation, or whatever else I'm glad that it gives me a second layer of defense against me reflexively clicking a couple times to copy/paste the password manually. A passkey dropdown with "No passkeys saved for this site" would be a massive red flag and stop me in my tracks before trying to do something else stupid.

Re: Passkeys: They're not perfect but they're getting better

#58

Post by MaxRegret »

sam_lowry_ wrote: post #28

How are passkeys different from API keys or just random chains of characters? And why can't we have the use of such keys enforced by an EU legislation so that all businesses allow users to login using such strings of random characters? The world would then be a better place.

Passkeys are a public/private keypair, where the service you're authenticating against has the public key and your browser has the private key. To authenticate, the browser demonstrates that it has the private key by signing and returning a challenge sent by the server.

So, unlike API keys, the actual passkey is never sent anywhere out of your device. Passkeys are more like SSH keys than API keys.

One difference between SSH and the WebAuthn protocol is that the challenge identifies which key it is expecting. So the user doesn't have to explicitly select which key to use.

Re: Passkeys: They're not perfect but they're getting better

#59

Post by torstenvl »

foobazgt wrote: post #44
torstenvl wrote: post #31

Earlier quoted context omitted.

Would be nice, but biometrics have also been systematically made less secure. Apple, for example, no longer sells a phone with Touch ID.

At first I read this as "Apple doesn't implement Touch ID, because they found it to be insecure", which really confused me. Was that the intent? On second reading, I'm thinking this might mean, "since Apple only implements Face ID, biometrics on Apple devices is less secure", which makes more sense (to me).

Yeah, the latter. All kinds of reports of siblings (including fraternal twins and non-twins) being able to unlock each others phones.

https://duckduckgo.com/?origin=funnel_home_google&t=h_&q=fac...

Fingerprints are much more non-deterministic and therefore more secure.

Re: Passkeys: They're not perfect but they're getting better

#60

Post by wbl »

secabeen wrote: post #51
AlexandrB wrote: post #47

Earlier quoted context omitted.

Can you send some documentation on how ? For example, I tried googling for transferring a passkey out of popular systems and it doesn't seem possible[1][2] other than through JSON export[3] which is what some sites want to block as I understand. [1] https://old.reddit.com/r/Bitwarden/comments/1efs5d2/how_can_... [2] https://old.reddit.com/r/Bitwarden/comments/1di8nbz/import_p... [3] https://news.ycombinator.com/item?…

I don't think you're going to find it. The main vendors are hostile to this workflow. I get why, any flow that can exist to export passkeys can be used by hostile actors to walk a 75-year old millionaire grandma through handing over $$$. I think however that that's just a risk we have to make the bank and brokerages accept. It's not a problem with a technical solution.

Why is it more important than protecting users? They've already added a way to share them securely.
Post reply on HN