Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys now support external providers

developer.apple.com

Post reply on HN
Print view View original

81–90 of 185 posts

Re: Passkeys now support external providers

#81

Post by closewith »

cj wrote: post #72
arianvanp wrote: post #63

Earlier quoted context omitted.

How? you make claims that seem to have no substance. What extra vector does Passkeys add for tracking? I don't see any. Passkeys are an origin-bound login mechanism. Worst case is that somebody places a first-party cookie to keep you logged in after you authenticated with a passkey. which they and will already do today without your consent or without logging in. (First-party session cookies don't even need a cookie w…

With 3rd party cookies going away, companies now need your email address to effectively track you. Tracking you via your email address is actually better than using cookies (for the advertiser) because it works cross-device and cross-browser. Any mechanism that makes it easier to login to sites will promote the usage of email addresses for tracking purposes. Think retargeting and conversion tracking (no longer needin…

> Tracking you via your email address is actually better than using cookies (for the advertiser) because it works cross-device and cross-browser.

At least in the EU, you'll need express consent to do this.

Re: Passkeys now support external providers

#82

Post by scott00 »

madeofpalk wrote: post #47
ljlolel wrote: post #19

Earlier quoted context omitted.

The last one is a problem for a lot of use cases. Lots of sites have different domains (also for example when HBO max renamed to max). Plaid also relies on entering bank passwords on neobank sites and is widely used.

> Plaid also relies on entering bank passwords on neobank sites and is widely used. This is an anti-pattern, and is not worth supporting in new tech that's supposed to be "secure first". We already have tech for delegating authorization.

Plaid isn't a solution to a technical problem. It's a way to deal with the fact that banks don't want their customers to bypass their websites/apps and the cross-selling ads within.

Re: Passkeys now support external providers

#83

Post by jabbany »

theshrike79 wrote: post #64
jabbany wrote: post #53

Earlier quoted context omitted.

Are you saying they don't use any physical keys? That would be surprising to me... I've found it really easy to teach non-technical people how to use U2F tokens. Just tell them it's like a door key but instead of plugging it in and turning, you plug it in and touch. That's all there is. It's been much more intuitive* to my older family members than SMS codes (that sometimes get lost), authenticator apps (that have a…

The difference is that I can know with significant certainty that shoving my house key in a random lock won't copy the form of my key and send it to a 3D printer where a thief will get it and use it to access my house. How can I know that won't happen when I use my USB dongle on a random coffee shop public computer?

This is exactly what U2F protects you from!

You can actually safely plug U2F tokens into random computers and rest assured that the keys inside cannot be cloned. This provides security guarantees above and beyond that of physical keys! In fact, an untrusted computer can't* even MITM the authentication process of U2F, unlike with SMS codes! (Of course, an untrusted computer could fake the UI to try and exfiltrate other info from you, but that's beyond the scope of authentication itself.)

The worst a malicious client can do to a U2F token is to fry it :-)

*: There's some asterisks here, but if you want to know the details check out the U2F spec or this https://www.yubico.com/blog/creating-unphishable-security-ke... for a more accessible explanation. Banking-grade U2F/similar tokens actually behave like hardware crypto wallets and will show the auth request metadata on an internal screen, in case the device you are plugging into is completely untrustworthy.

Re: Passkeys now support external providers

#84

Post by detourdog »

gjulianm wrote: post #21
ljlolel wrote: post #19

Earlier quoted context omitted.

The last one is a problem for a lot of use cases. Lots of sites have different domains (also for example when HBO max renamed to max). Plaid also relies on entering bank passwords on neobank sites and is widely used.

AFAIK, passkeys aren't really linked to a domain. It's old-school public-key verification, the server stores your public key and uses it to verify the signature of a challenge they send to your device on login. As long as the different domains/apps can share the public key you should be able to login. And for things like Plaid, I think banks are moving towards OAuth-style permissions, where you login to your bank and…

It is essentially kerberos only Apple has managed to grow a coherent ticketing system for all hardware, services, and users. Each Developer essentially has their own ticket signing system. Apple can revoke any ticket at any time and a developer can revoke their own tickets.

Re: Passkeys now support external providers

#85

Post by vouaobrasil »

dan-robertson wrote: post #76
vouaobrasil wrote: post #68

Earlier quoted context omitted.

If it is easier to do something, more websites will do it. Passkeys make it easier to make new logins, so more websites will do it. Just like seatbelts make people drive more dangerously. If more websites require logins, they can track you more easily, simple as that. It has nothing to do with the engineering aspects of passkeys, and everything to do with the fact that technology which makes logins easier will encour…

Doesn’t Apple Pay make it easier to not log in to websites (by getting rid of their desire to save payment details or addresses to get through later checkouts faster)? I just don’t really see some grand pro-login plan implied by Apple’s actions.

You are right. Of course, I am not talking about a conscious plan by board members or employees, but the general emergent trend inherent to this type of technology. I did not mean to imply conscious action as we know it.

Re: Passkeys now support external providers

#86

Post by mcherm »

arianvanp wrote: post #63
vouaobrasil wrote: post #52

So far, no one has commented on this large downside of passkeys: that it will promote the ease of sites to require login since it's much easier to generate a passkey than to remember a new password or even store it. Thus, passkeys lubricate the path towards an ever-increasing login-based society where it becomes much easier to track and monitor your online behaviour. Although it has the benefit of making our existing…

How? you make claims that seem to have no substance. What extra vector does Passkeys add for tracking? I don't see any. Passkeys are an origin-bound login mechanism. Worst case is that somebody places a first-party cookie to keep you logged in after you authenticated with a passkey. which they and will already do today without your consent or without logging in. (First-party session cookies don't even need a cookie w…

Passkeys do not help track people between sites, but if they are used in places that passwords never were, it might increase tracking within a site.

Hacker News, for instance, allows non-logged-in read-only usage. If Hacker News decided that Passkeys were so easy for the user that non-logged-in usage would be eliminated, then some degree of privacy would be lost.

Personally, I don't think it is that much of a risk. I DO worry about putting too much control in the hands of Apple and Google.

Re: Passkeys now support external providers

#87

Post by tourmalinetaco »

closewith wrote: post #81
cj wrote: post #72

Earlier quoted context omitted.

With 3rd party cookies going away, companies now need your email address to effectively track you. Tracking you via your email address is actually better than using cookies (for the advertiser) because it works cross-device and cross-browser. Any mechanism that makes it easier to login to sites will promote the usage of email addresses for tracking purposes. Think retargeting and conversion tracking (no longer needin…

> Tracking you via your email address is actually better than using cookies (for the advertiser) because it works cross-device and cross-browser. At least in the EU, you'll need express consent to do this.

“Need” is a very strong word. Any potential fines will just be rolled into the costs of doing business, and if it’s found to still be worth it they’ll keep abusing user privacy as there is a net benefit profit-wise.

Re: Passkeys now support external providers

#88

Post by ndjdhdidve »

dethos wrote: post #46

Good news. Lock-in was one of the biggest issues with passkeys. I think we will see a bunch of well known password managers adding passkey support soon. Is there any standard for this integration/interoperability? What about moving from one provider/app to another?

you fell for it.

the article says nothing to that end. still full locked in.

the UI will allow implementations... via app stores approved apps using their OS apis. for sure.

Re: Passkeys now support external providers

#89

Post by withinboredom »

dan-robertson wrote: post #74
cj wrote: post #72

Earlier quoted context omitted.

With 3rd party cookies going away, companies now need your email address to effectively track you. Tracking you via your email address is actually better than using cookies (for the advertiser) because it works cross-device and cross-browser. Any mechanism that makes it easier to login to sites will promote the usage of email addresses for tracking purposes. Think retargeting and conversion tracking (no longer needin…

But Apple offer this service where they make a fresh proxy email for you which is unique to the service. Why would they do that if they want to enable cross-service tracking via email address?

I use 1password + fastmail for exactly this. The integration is better than Apple IMHO.

Re: Passkeys now support external providers

#90

Post by withinboredom »

tourmalinetaco wrote: post #87
closewith wrote: post #81

Earlier quoted context omitted.

> Tracking you via your email address is actually better than using cookies (for the advertiser) because it works cross-device and cross-browser. At least in the EU, you'll need express consent to do this.

“Need” is a very strong word. Any potential fines will just be rolled into the costs of doing business, and if it’s found to still be worth it they’ll keep abusing user privacy as there is a net benefit profit-wise.

IIRC, the fines are some % of revenue. Basically enough to tap into margins.
Post reply on HN