Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: They're not perfect but they're getting better

ncsc.gov.uk

Post reply on HN
Print view View original

61–70 of 145 posts

Re: Passkeys: They're not perfect but they're getting better

#61

Post by wbl »

josephcsible wrote: post #26
wbl wrote: post #23

Earlier quoted context omitted.

That's the whole point of this exercise. If export is possible it's not secure against local compromise in the way that's needed.

The point of passkeys is to protect against phishing and password reuse. You can't protect against local compromise, even if your passkeys are stored in something like a YubiKey, because once you log in to your bank with your hardware-backed passkey, the malware on your computer could use the session you started to transfer all of your money out of your account.

But it can't maintain that compromise. That's important.

Re: Passkeys: They're not perfect but they're getting better

#62

Post by spiffytech »

0cf8612b2e1e wrote: post #16
nabla9 wrote: post #5

Losing your device and not having any passwords is like losing your fingerprints. >Device loss scenarios >Users are largely unsure about the implications for their passkeys if they lose or break their device, as it seems their device holds the entire capability to authenticate. To trust passkeys as a replacement for the password, users need to be prepared and know what to do in the event of losing one – or all – of t…

Also requires the device allows backup of passkeys. The infamous post where keepass was threatened if they were to continue to allow users to backup their own keys.

I hadn't heard this story. Source: https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

Re: Passkeys: They're not perfect but they're getting better

#63

Post by eikenberry »

wbl wrote: post #60
secabeen wrote: post #51

Earlier quoted context omitted.

I don't think you're going to find it. The main vendors are hostile to this workflow. I get why, any flow that can exist to export passkeys can be used by hostile actors to walk a 75-year old millionaire grandma through handing over $$$. I think however that that's just a risk we have to make the bank and brokerages accept. It's not a problem with a technical solution.

Why is it more important than protecting users? They've already added a way to share them securely.

Wasn't the discussion you responded to about how they currently can't be shared and that the vendors don't want them to be shared as it breaks their desired lock-in?

Re: Passkeys: They're not perfect but they're getting better

#64

Post by abdullahkhalids »

ewoodrich wrote: post #57
abdullahkhalids wrote: post #15

Earlier quoted context omitted.

My password manager (keepassxc) has a browser extension that only lets you autocomplete the password on a page if the url matches the one stored in the database. Sure I could manually copy the password from the database, but in practice, this is fairly good security. It also doesn't treat the user as an always-idiot, which is a good thing in my book.

I'm struggling to think of a reason why being "treated as an always-idiot" is an actual negative in this specific example. I use Bitwarden and when the password autofill doesn't work as expected my first assumption from many previous experiences is that it's because a website changed something slightly in their auth flow or a particular page has a weird redirect/embedded login scheme different than the primary login,…

Passkeys do protect you from such mistakes in a way the current implementation of the browsers/password managers/web-specs don't.

But that is after 10s of millions of dollars or more have been poured into the development of passkeys, resulting in new standard specifications, diverse implementations of password managers, etc.

Now, imagine the counterfactual world where those same dollars were devoted to improving the password infrastructure. Could we have forced the average person to always password managers with long randomized passwords? Could we have build better webspecs around password entry workflows, and forced websites to fix the issues you face? I think the answer is yes.

Against this counterfactual world, passkeys are not in practice much better.

Re: Passkeys: They're not perfect but they're getting better

#65

Post by abdullahkhalids »

skybrian wrote: post #55
abdullahkhalids wrote: post #15

Earlier quoted context omitted.

My password manager (keepassxc) has a browser extension that only lets you autocomplete the password on a page if the url matches the one stored in the database. Sure I could manually copy the password from the database, but in practice, this is fairly good security. It also doesn't treat the user as an always-idiot, which is a good thing in my book.

That works for you, but the website doesn't know you use a password manager, so they'll often want you to use SMS as a second factor. Passkeys require some kind of password manager. That's the main benefit. The adoption problems are because a lot of users don't really understand password managers.

I bet that Google+Apple+Microsoft could have gotten 95% of the world on password managers by building excellent password managers into the OS, and demanding that one can only login into their websites with passwords that have at least 100 bits of entropy.

And it could have been done 10 years ago.

Re: Passkeys: They're not perfect but they're getting better

#66

Post by FreakLegion »

josephcsible wrote: post #19
varbhat wrote: post #4

I agree. I use Bitwarden on my Samsung Android phone and also on my Linux desktop. Bitwarden currently supports passkeys on almost all the apps on my android including firefox. The same passkeys which i used to login on my phone can be used on my Linux desktop where i use Firefox with Bitwarden extension. What's now possible was not even possible at the start of this year. I haven't switched everything to passkeys bu…

> I read about Passkey comittee being against open source passkey managers during start of this year (can't reference it, sorry) but with open source password/key managers already supporting passkeys, i don't think it turned out to be true. Here's an Okta employee threatening to use the attestation (anti)feature of passkeys to block open-source implementations, because they allow you to export your passkeys: https://…

Tim Cappalli is thoroughly misguided throughout that discussion, but he's not threatening anything. Okta lets users require attestation, but it will never, ever force attestation on anyone.

Re: Passkeys: They're not perfect but they're getting better

#67

Post by amenhotep »

gowld wrote: post #32
AlexandrB wrote: post #27

Earlier quoted context omitted.

Needed for whom? As others have said, without export it's a recipe for vendor lock-in.

lock-in to which vendor? Passkeys support transfer to any vendor you want.

I want to transfer them to a vendor that will let me export them in plain text.

Re: Passkeys: They're not perfect but they're getting better

#68

Post by josephcsible »

FreakLegion wrote: post #66
josephcsible wrote: post #19

Earlier quoted context omitted.

> I read about Passkey comittee being against open source passkey managers during start of this year (can't reference it, sorry) but with open source password/key managers already supporting passkeys, i don't think it turned out to be true. Here's an Okta employee threatening to use the attestation (anti)feature of passkeys to block open-source implementations, because they allow you to export your passkeys: https://…

Tim Cappalli is thoroughly misguided throughout that discussion, but he's not threatening anything. Okta lets users require attestation, but it will never, ever force attestation on anyone.

The specific part that I consider a threat is "which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations".

Re: Passkeys: They're not perfect but they're getting better

#69

Post by FreakLegion »

josephcsible wrote: post #68
FreakLegion wrote: post #66

Earlier quoted context omitted.

Tim Cappalli is thoroughly misguided throughout that discussion, but he's not threatening anything. Okta lets users require attestation, but it will never, ever force attestation on anyone.

The specific part that I consider a threat is "which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations".

Sorry, to clarify: Okta is not for our purposes a relying party and won't do anything to force attestation on relying parties. The second bit of what he wrote is ambiguous, but charitably, could simply mean "I used to argue against requiring attestation, but now I'm not sure". Which is fine, since he has absolutely no pull when it comes to how Okta's product works (and to be fair, I don't think he implied otherwise or even mentioned Okta).

Re: Passkeys: They're not perfect but they're getting better

#70

Post by marssaxman »

supportengineer wrote: post #41

Passkeys are great because they get sync'ed to all your devices, which makes it really easy to share access to those websites with other people ( who have access to devices on your account ). Like a spouse.

What mechanism makes that happen?
Post reply on HN