Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Things I learnt about passkeys when building passkeybot

enzom.dev

Post reply on HN
Print view View original

71–80 of 152 posts

Re: Things I learnt about passkeys when building passkeybot

#71

Post by godelski »

jeroenhd wrote: post #55
awesome_dude wrote: post #50

Earlier quoted context omitted.

I read this thinking "The BEST security is the WORST usability, and vice versa" The easier it is to do things, like use another channel, the harder it is to keep secure. The easier it is to keep secure, the harder it is to use.

I don't think this is a security vs usability thing. A lot of UIs are intentionally confusing. Apple wants you to use iCloud passkeys, Microsoft wants you to use Microsoft Account passkeys, Google wants you to use Google passkeys. Even if you have a dedicated USB device plugged in, browsers keep defaulting to the cloud accounts. Bitwarden's approach is to simply hijack the passkey request before the browser can respo…

I remember once I was working for a big tech and we had windows computers. I tried to use Hello so I could login with my fingerprint. It broke outlook for some reason. So I switched to a Yubi key since they were offering.

Every login was the same: fails -> try again or try different method -> list of methods (including "security key") -> ok -> tap security key -> ok

It would not let me set the key as the default and there were two unnecessary clicks. The box literally only had a single button (besides the standard x on the window)! It was absolutely infuriating.

I'm with you. I don't believe these companies are actually trying to create the best solutions. And you can absolutely see that when you try to move from one ecosystem to another.

Look at my problem again and now consider had I been using my iCloud key and wanted to login from my Linux machine. It literally wouldn't be possible!

Re: Things I learnt about passkeys when building passkeybot

#72

Post by bobbylarrybobby »

IgorPartola wrote: post #61

One thing I ran into recently when I played around with passkeys is the problem of orphaned keys. Basically if I log into a website using the passkey and then go to my account settings and remove that passkey then log out I have a problem. Now I can’t sign in but when I go to recover my account iOS/macOS will refuse to create a new passkey because one already exists for this website. So I have to go to my passwords l…

Why would a website leave you with an account but no way to log in aside from the account recovery procedure?

Re: Things I learnt about passkeys when building passkeybot

#73

Post by jogu »

jeroenhd wrote: post #55
awesome_dude wrote: post #50

Earlier quoted context omitted.

I read this thinking "The BEST security is the WORST usability, and vice versa" The easier it is to do things, like use another channel, the harder it is to keep secure. The easier it is to keep secure, the harder it is to use.

I don't think this is a security vs usability thing. A lot of UIs are intentionally confusing. Apple wants you to use iCloud passkeys, Microsoft wants you to use Microsoft Account passkeys, Google wants you to use Google passkeys. Even if you have a dedicated USB device plugged in, browsers keep defaulting to the cloud accounts. Bitwarden's approach is to simply hijack the passkey request before the browser can respo…

Yeah, the passkey provider management is absolutely horrendous and is the biggest blocker to passkey adoption in my eyes. I have 3 different sources (iCloud keychain, Yubikey, and Enpass) and in the best case it's some extra clicks like you mention, in the worst case it just simply won't let me select the correct provider.

I've resigned to registering a passkey into all of my providers and just letting the most platform native option win for now.

Re: Things I learnt about passkeys when building passkeybot

#74

Post by raw_anon_1111 »

jeroenhd wrote: post #55
awesome_dude wrote: post #50

Earlier quoted context omitted.

I read this thinking "The BEST security is the WORST usability, and vice versa" The easier it is to do things, like use another channel, the harder it is to keep secure. The easier it is to keep secure, the harder it is to use.

I don't think this is a security vs usability thing. A lot of UIs are intentionally confusing. Apple wants you to use iCloud passkeys, Microsoft wants you to use Microsoft Account passkeys, Google wants you to use Google passkeys. Even if you have a dedicated USB device plugged in, browsers keep defaulting to the cloud accounts. Bitwarden's approach is to simply hijack the passkey request before the browser can respo…

Apple does have an API to allow third parties to be used to store passwords and passkeys and they show up during the standard flow from a browser.

Re: Things I learnt about passkeys when building passkeybot

#75

Post by raw_anon_1111 »

quantummagic wrote: post #70
jeroenhd wrote: post #53

Earlier quoted context omitted.

There are plenty of websites and services already where you need to prove your identity to use them. The digital credentials API is an attempt to standardise that which is already legally required in the US, the UK, Australia, and the EU, except without having to upload a picture of your ID to a shady third party website.

I've never had to upload my government ID to any site; and none of my family have either. It's beyond naive to think that enshrining such a protocol won't lead to more widespread adoption, and even legislation requiring it. It's infrastructure that is quietly being built first, and enthusiastic authoritarian governments will eagerly embrace it.

As an American citizen, I had to upload my passport to get an ETA before flying into the UK this year.

https://www.gov.uk/eta

I also uploaded my passport to Delta to make traveling to both Costa Rica and London faster this year.

https://www.delta.com/us/en/travel-planning-center/know-befo...

Re: Things I learnt about passkeys when building passkeybot

#77

Post by raw_anon_1111 »

Magnusmaster wrote: post #58
coldpie wrote: post #57

Earlier quoted context omitted.

> If you're finding workarounds to violate the security design, you're not gaining any advantage by using passkeys. The trouble is, if websites are allowed/encouraged to ban clients, then the advantages you're talking about come with the downside of hard-tying yourself to one of 3 US-based Big Tech companies, because those will be the only ones who will ship clients declared "secure." That's not a trade-off I'm willi…

You already need to submit to iOS or stock Android for a myriad of banking or government apps that use remote attestation to verify that you are running "untampered" software. Remote attestation is evil.

I keep seeing this where? What banks don’t allow you to go to their website and use them from your phone? Which government apps don’t also have websites?

Re: Things I learnt about passkeys when building passkeybot

#78

Post by raw_anon_1111 »

lelandbatey wrote: post #41
yawaramin wrote: post #35

Earlier quoted context omitted.

Apple doesn't do attestation, so effectively this feature is dead in the water.

Per the article, Apple does do attestation. By default attestation is off unless you have enterprise management turned on. But the existence of attestation means Apple could at any time in the future make attestation on by default and suddenly our devices control our secrets more than we do.

Isn’t that just like people said in 2008 now that therd is a Mac App Store “any day now” that will be the only way to get apps on the Mac?

Re: Things I learnt about passkeys when building passkeybot

#79

Post by morshu9001 »

awesome_dude wrote: post #50
godelski wrote: post #36

A few weeks ago I had a bug with bitwarden where every passkey wanted to load from the macbook instead of bitwarden. I ended up being locked out of a few accounts that didn't have OTPs as a fallback. Mostly inconsequential stuff like Twitter. I love passkeys, but they're still kinda hard to use. There's several sites that wont let you enroll multiple ones and it's easy for systems to step on each other like the afore…

I read this thinking "The BEST security is the WORST usability, and vice versa" The easier it is to do things, like use another channel, the harder it is to keep secure. The easier it is to keep secure, the harder it is to use.

Some of the things that came out before passkeys were harder and not more secure, like OTP. Especially the way that earlier versions of Google Authenticator implemented it. We're finally close to a permanent "remember me" button that most people wanted, but it needs a bit more polishing.

Re: Things I learnt about passkeys when building passkeybot

#80

Post by stavros »

AlotOfReading wrote: post #29
stavros wrote: post #24

Earlier quoted context omitted.

Whereas we never see a horror story involving passwords.

There are two problems with passwords. Reuse, and site breaches. The solution to the former is the same as passkeys: credential managers. Passkeys genuinely solve the second, in exchange for a vastly less comprehensible system (see all the uncertainty people have even here on HN) that doesn't support many of the ways people want to use authentication tokens.

That's not what phishing is. Phishing is convincing someone to give you a credential with a page that looks like the one they're supposed to give the credential on. Passkeys cannot be phished.
Post reply on HN