Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

641–650 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#641

Post by ivlad »

unscaled wrote: post #407
packetlost wrote: post #380

Earlier quoted context omitted.

> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey). This is a misconception. A particular service can choose to enforce those class of passkeys, but most don't need that and shouldn't. Passkeys are primarily meant to replace passwords and be hard (but not necessarily impossible) to exfiltrate. The key difference…

Passkeys is basically a brand name for "discoverable credentials" (a Webauthn term). They do a little more than that technically, but in practice their purpose is what you said. Replace passwords. Or more accurately usernames and password pairs. This is in contrast from 2FA, but even before Apple started marketing Passkeys the FIDO standard supported the concept of Passwordless authentication, alongside 2FA. Passkeys…

I think in Apple stack they cannot be made hardware bound anymore. Platform claim is ignored on creation and the keypair is always in Keychain and syncable unless iCloud sync is disabled.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#642

Post by inigyou »

mwwaters wrote: post #624
phs318u wrote: post #542

Earlier quoted context omitted.

Replace the word passkey with password in your comment. What’s the benefit of passkeys again? If you’re not storing the actual private key in the Secure Enclave but only the “access to it” what’s changed from how Apple’s keychain already manages password syncing to iCloud? The only benefit (and it’s still a decent one) is that some random website breach can’t disclose your private key.

The far bigger benefit is phishing resistance (with hardware-contained keys themselves being phishing-proof on a non-compromised system). It moves to the account recovery flows, but that can be much more difficult to phish.

Why would a key need to be "hardware-contained" to be difficult to phish? My SSH private key is unphishable and it's right there in a file. It's unphishable because I know there's never ever a reason to send it to someone - in a scenario where that would be needed, I'd generate a new key just for that situation.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#643

Post by inigyou »

thewebguyd wrote: post #575
krferriter wrote: post #557

Earlier quoted context omitted.

A random website breach can't disclose your password either, assuming you use random high-entropy passwords and the website only stores a hash of it. I haven't really seen the benefit to passkeys over passwords. Pretty much everyone is using a password management service that securely syncs both passwords and passkeys across devices. In that context I don't see the difference.

> Pretty much everyone is using a password management service In the US, only about 34 to 36% of adults use a password manager. Of the ~64% that don't, an alarming 20% reuse the same password across almost every service, and a ton just rely on browser autofill. If you use a password manager, you are in the minority. Hell, even if you don't use a PW manager and you at least use a different password for different servi…

FWIW, browser autofill is a basic password manager.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#644

Post by ivlad »

akdev1l wrote: post #565
thewebguyd wrote: post #538

Earlier quoted context omitted.

The user can always be attacked via phishing so long as account recovery methods exist (and they need to exist for obvious reasons). Use passkeys, but so long as you can also log in via password, or SMS code, etc., it's phishable, you can get sim swapped. Your master password to your cloud PW manager's vault is also phishable (hence why passkeys were ideally device specific, non-exportable). Its phishing resistant no…

> hence why passkeys were ideally device specific, non-exportable Not true. The original concept was always for them to be cloud synced. This has nothing to do with their anti-phishing capabilities. The anti-phishing capabilities come from the fact that the password manager authenticates the application before handing out the passkey. It doesn’t matter if they are synced across devices or not. You are correct that ot…

> Not true. The original concept was always for them to be cloud synced.

It was not. The original U2F spec was created before that idea was around and it talked about hardware security keys as means to store the primary key pair.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#645

Post by inigyou »

ryandrake wrote: post #605
pseudalopex wrote: post #601

Earlier quoted context omitted.

KeepassXC gave users this choice. And was threatened to be blocked for it.[1] [1] https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

Yuck. Look closely at the wording: He is trying to counter a "user choice" feature by saying it doesn't have "protection". "File protection." "Protection of the key." Protection from who? From the user, that's who! This mentality that the user is an attacker, and the software must protect its data from the user. Isn't a passkey ultimately supposed to be my data?

This is simply the mentality. Everyone who's worth anything (as in money) has it. Everyone who makes anything you own has it. They do everything based on this mentality and will not give it up. Every new specification or policy has provisions to ensure the device is protected from its user. Whether it's age verification (non-California-style), passkeys, or CSAM scanning.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#646

Post by inigyou »

voxic11 wrote: post #456
kasabali wrote: post #371

Earlier quoted context omitted.

so you need to have discord installed in your phone. now multiply it with every web site you want to access.

That is how discord has chosen to implement it but nothing about the scheme actually requires an app besides a mobile browser and QR code scanner to be involved.

Meanwhile passwords work the same everywhere

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#647

Post by ivlad »

packetlost wrote: post #612
michaelt wrote: post #481

Earlier quoted context omitted.

> Passkeys are primarily meant to replace passwords Unfortunately, the designers of passkeys decided they should replace passwords and usernames and second factors. Also they decided they should be cloud-synchronised, so the something-you-have second factor doesn't impose the burdensome requirement for you to have something, which was apparently a big usability problem.

> Unfortunately, the designers of passkeys decided they should replace passwords and usernames and second factors. They obviate the need for a user identifier as the key is itself unique, but removing the 2nd factor is a choice of the service, not the designers of the Webauthn standard. > Also they decided they should be cloud-synchronised The earlier versions of the spec required that the keys be resident in hardwar…

> The important part is it's up to the service to decide on whether they want to require hardware resident keys (which cannot be synced via the cloud).

From what I know, Apple ignores `platform` and `ResidentKeyRequirement` claims and always creates cloud-synced key pairs.

Moreover, the strongest claim value allowed for the `ResidentKeyRequirement` is “discouraged”, which per spec is treated as SHOULD in RFC 2119 since. In other words, browsers are free to ignore it when “they know better”, which Apple always does.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#648

Post by __MatrixMan__ »

dfabulich wrote: post #518
__MatrixMan__ wrote: post #206

Earlier quoted context omitted.

> Instead, the password managers each have their own finicky app-to-app mechanism for transferring passkeys from one password manager to another. (I think all the password managers kinda like that lock in.) It's a nice simplifying step to talk about password managers here, but in the majority of the cases this won't be handled by a password manager, but rather by the device operating system, and the device manufactur…

All of the major operating systems and all of the major browsers are password managers. Apple, Google, Microsoft, and Mozilla are all password managers. They all have apps that let you access their password managers on other operating systems. You're right that all of the major password managers like their lock in. The Credential Exchange Protocol is just barely good enough that OS vendors can say they "support" it,…

The risk is not that the site would insist on attestation, it's that Apple would volunteer it. They could pass an ID through that channel, use it to strike up a separate conversation which makes them some money, informs Palantir about what protests you've been to, and the service in the middle gets a finder's fee.

If we want this to be usable by consumers we need to prevent this kind of thing, not thank Apple for their restraint.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#649

Post by m-p-3 »

thecombjelly wrote: post #217
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

What I find particularly annoying on Windows is that it tries to take over the Passkey workflow with Windows Hello. I wish I could just tell it to not handle Passkeys at all, and let me deal with it through my Password Manager (KeePassXC) and my hardware tokens (2 YubiKeys).

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#650

Post by doodlesdev »

ivlad wrote: post #637
Itoldmyselfso wrote: post #539

Earlier quoted context omitted.

I was referring to confusion experienced by people new to the passkeys creating passkeys for the first time ("Where am I saving this to?", "How do I store this in my password manager?").

You don’t. You don’t store anything at all. On registration, a keypair is generated, then the private key is encrypted with the long-term key burned into your security key fob or hardware. The encrypted blob is sent to the server and stored there. On authentication, after you enter your login, the server sends the encrypted blob and your security key tries to decrypt it with the long-term key it has. If it succeeds,…

> You don’t. You don’t store anything at all.

Yes, you do.

Whenever a website offers to create a passkey, it could end up in any of these:

- Samsung's Password Manager (if using a Samsung phone)

- Apple's Keychain (if using an iPhone)

- Google Password Manager

- Your operating system's keychain

- A bespoke password manager (e.g., Bitwarden or LastPass)

- Your hardware key

Most users do not have a security key fob. Instead, the proposal being mostly pushed is the idea that users can store keys on their own smartphones, making use of the modern TPM and chip security. Most of the discussion here revolves around that idea: "What if I lose my phone? What if I switch phones?" and that's why the problems seem so obvious to you.

I absolutely agree the best solution is to use hardware keys, but I'll admit it's cumbersome if I need them for hundreds of accounts (which I do have), having to register both for every website and praying that I never lose both at the same time in the case there's no viable recovery flow for some of the accounts. Also, most of these hardware keys are limited to 25 or 100 resident keys, which again makes them unable to substitute passwords. Observe the usage of the term resident keys: passkeys do rely on the private key being stored on the hardware key, as that allows discovery.

Post reply on HN