Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

501–510 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#501

Post by jmbwell »

JohnFen wrote: post #303
jmbwell wrote: post #79

Earlier quoted context omitted.

As an administrator, I hear you, but we have to adapt. Passwords are awful. On the whole, the effort and energy spent training people on passwords, battling phishing, dealing with password managers, cleaning up from breaches, and more… passwords can't die soon enough. FWIW, asymmetric PKI is technically mature and relatively easy to implement in most applications (without "vendor lock-in", I might add to comments upt…

I'm looking forward to such glory days. Right now, however, none of the solutions available are ones that I could live with if I had to use them for everything. For one or two very sensitive things, sure, but for everything? It's less of a pain to use long, random passwords.

This is just like using a long random password, except that it's cryptographically verifiable without ever leaving your device.

If passwords are like playing poker with your cards facing out, Passkeys are like playing with your cards facing in. Your secrets remain under your full control at all times. Nothing sensitive is sent over the wire.

Yes, for everything. Those who've implemented it so far have done a great job at making it /easier/ than handling passwords.

If you've ever used ssh with keys instead of passwords, it's the same thing, and it's so much easier while being more secure. A rare convergence.

Re: Passkeys: The beginning of the end of the password

#502

Post by SadWebDeveloper »

dcow wrote: post #179
SadWebDeveloper wrote: post #173

This looks and feels like passwords with extra steps... I mean now i need to "store, manage and secure" my per-user-certificate sorry "my passkey" myself and if its get compromised its my fault, how are passkeys more "secure" than enforcing a secure long password that the user can't change unless he met certain conditions and its conveniently stored inside the password manager i just built. What happens if i lost all…

The solution, for you, is a cloud synced passkey manager, possibly a custodial one. A password manager with strong passwords is weaker than a password manager with passkeys, because passkeys use asymmetric crypto and passwords+2fa involve exchanging a shared secret over an insecure channel at some point (yes I'm considering 1-sided TLS an "insecure" channel here). Trust the security experts when they say passkeys are…

So in the event that i lost everything, i mean catastrophic, like my house burned to the ground with all my belongings, i have no kin nor "trust alternate people" configured for my account, my password manager requires my "synced in google/apple drive/cloud" passkey or my last known device, i can't retrieve it in anyway, how can i recover my account?

Either have to prove that m me to my account provider, which essentially is huge security hole since what data it will be required to prove might be more easy to fake (kinda like how people do sim swapping) and stole my passkey or do the "crypto thing", that if you lost your decryption key all your money is gone forever and ever and start fresh.

I mean my point is... password are not going to be deprecated, we had so many attempts to murder them but their convenience outmatch any other solutions, feels like passkey aren't well designed imho if the backup requires a password, then passwords won't be deprecated... maybe passkeys aren't meant to replace password but long-sessions oauth tokens if you ask me why passkeys exists.

Re: Passkeys: The beginning of the end of the password

#503

Post by JohnFen »

snowwrestler wrote: post #416
JohnFen wrote: post #382

Earlier quoted context omitted.

> The generalized solution to this is allowing 3rd parties to be your passkey provider, so that you can choose how your passkeys are stored The password manager I use has no cloud component (which is why I chose it), and addresses this by allowing me to export my password collection to an encrypted backup file. Would this be a thing that the passkey folks would be OK with? That would ease a lot of my hesitation.

Yes you can just use a hardware FIDO token like a Yubikey as your passkey. And you can enroll more than one, so if you lose or wreck one, you’re not locked out.

I'm aware of that, yes, but that doesn't really address my question (or use case).

Re: Passkeys: The beginning of the end of the password

#504

Post by [deleted] »

dwaite wrote: post #454
JohnFen wrote: post #382

Earlier quoted context omitted.

> The generalized solution to this is allowing 3rd parties to be your passkey provider, so that you can choose how your passkeys are stored The password manager I use has no cloud component (which is why I chose it), and addresses this by allowing me to export my password collection to an encrypted backup file. Would this be a thing that the passkey folks would be OK with? That would ease a lot of my hesitation.

> Would this be a thing that the passkey folks would be OK with? That would ease a lot of my hesitation. I mean, I don't _like_ it (if I'm a passkey folk) as a widespread feature. I suspect users may be tricked into giving away the keys to the kingdom. However, these are generally just API, there are open source projects for security keys, and having an option to hold down a button on insertion to have it turned into…

[deleted]

Re: Passkeys: The beginning of the end of the password

#505

Post by richij »

alpos wrote: post #487

Just here to note that there are several huge problems with this approach from an actual security standpoint: First is that this changes from 2-factor authentication (something you have plus something you know) to single-factor (just something you have). Also be sure to notice in the article that they have changed their term there to 2-STEP authentication, not 2-FACTOR authentication, these are not the same thing, an…

On the contrary, it _is_ 2FA: One factor is something you have (the phone) and the other is something you are (your biometrics). You need both to log in.

The difference here is you're allowing your phone's enclave to store the magic secret, instead of your human memory.

—If you're authenticating with a PIN instead of biometrics, it's still 2FA.

Re: Passkeys: The beginning of the end of the password

#506

Post by JohnFen »

dwaite wrote: post #454
JohnFen wrote: post #382

Earlier quoted context omitted.

> The generalized solution to this is allowing 3rd parties to be your passkey provider, so that you can choose how your passkeys are stored The password manager I use has no cloud component (which is why I chose it), and addresses this by allowing me to export my password collection to an encrypted backup file. Would this be a thing that the passkey folks would be OK with? That would ease a lot of my hesitation.

> Would this be a thing that the passkey folks would be OK with? That would ease a lot of my hesitation. I mean, I don't _like_ it (if I'm a passkey folk) as a widespread feature. I suspect users may be tricked into giving away the keys to the kingdom. However, these are generally just API, there are open source projects for security keys, and having an option to hold down a button on insertion to have it turned into…

If I'm understanding you correctly, then I should be able to write my own manager to behave in a fashion that is in line with my wishes. Is that correct? That would be a nice escape hatch to have available if need be.

> Instead, some sites may ask for you to continue using additional factors

On the other hand, if that's the result of doing that, then there'd be no gain. I'll end up going through the whole gauntlet anyway.

Re: Passkeys: The beginning of the end of the password

#507

Post by [deleted] »

dwaite wrote: post #440
stanislavb wrote: post #418

Earlier quoted context omitted.

If people here can't understand what passkeys are, how are the "normies" gona get it? Or maybe the wide public is not supposed to get it how it works; they should "simply" use it.

The second. The term passkeys is meant to describe "like what I get with passwords, but easier/more secure'. It's lowercase "p" - it isn't a Google or Apple brand. Developers can use terms like "multi-device discoverable user-verifying FIDO/WebAuthn credentials" which have very precise technical meanings with demonstrated interoperability.

[deleted]

Re: Passkeys: The beginning of the end of the password

#508

Post by JohnFen »

prmoustache wrote: post #485
augusto-moura wrote: post #356

Earlier quoted context omitted.

I'm not sure if it is passkeys or other mechanism, but I can easily open my bank account on my Android phone just by using biometrics. Instead of typing a pin or password I just do the biometrics and voilá, it opens like magic. That really made me appreciate passwordless apps. On the other hand, I don't really know how would that work on desktops, should chrome use a Windows service for that? Would it use its own ser…

I guess the idea is they will ask you to grab your smartphone the same way they do it for 2FA. For the end user it will be just like using the 2nd factor of authentication without the primary one (login + password).

What do you do if you don't have a smartphone or are unwilling to use it for this?

Re: Passkeys: The beginning of the end of the password

#509

Post by jamesdepp »

CharlesW wrote: post #219
jamesdepp wrote: post #141

Until there is a viable way to sync passkeys between all devices, all platforms, and all browsers, I will be happily sticking to my passwords. The security benefits provided by passkeys are not enough to offset the ecosystem lock-in that passkeys cause.

What ecosystem lock-in are you talking about, exactly? I just created a passkey for Chrome on my macOS desktop and another on iOS. The Chrome passkey will sync to Chrome for Windows, my iOS passkey will sync to my other Apple devices, and I can create more as needed.

For every platform/ecosystem you are using (Chrome, Apple iCloud), you had to create a new passkey. For people using multiple different devices and platforms, this is a headache. I want to sign up once and be done with it.

Re: Passkeys: The beginning of the end of the password

#510

Post by Nathanba »

dahwolf wrote: post #408
shadowgovt wrote: post #321

Earlier quoted context omitted.

It's the second one, not the first one. The protocol is private key stored on your hardware; public on the service you're authing to. Google doesn't have a way to MITM that, but if you lose the machine storing the private key, best have another way to auth. (Note: some implementations, including Chrome on Android, do allow sync and sharing of the key, but IIUC even if Google bars you access to your account, the phone…

"best have another way to auth" right, so passwords it is then.

well, the argument is that for strong passwords you will need to use a password manager anyway. Which you will sync somehow, which will sync your passkeys too. So in the end you might as well replace all your passwords with passkeys except for the one password you use to access your passkeys in your password manager / the master access basically. The one way to make sure that you never lose access. I think this makes sense, I'm also very dependent on a password manager now.
Post reply on HN