Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale doesn't want your password

tailscale.com

Post reply on HN
Print view View original

91–100 of 316 posts

Re: Tailscale doesn't want your password

#91

Post by rebeccaskinner »

decryption wrote: post #74
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

You need to add multiple passkeys so if one breaks, you can still access the service. Ditto for Yubikeys (which can be added as a passkey), you need more than one so if you lose it you can still access.

I see a lot of claims that passkeys are more secure than passwords with 2fa, but my understanding is that they are strictly less secure. As it stands right now, if someone wanted to compromise a service that I use 2fa with, they'd need to both obtain my physical device, and also get my password. Either one of those things may be relatively easy, but it's harder to do both- especially without my knowledge.

With passkeys, if someone steals my physical device, then they have full access. That seems strictly worse to me. It's just beyond me how there's a plausible claim that moving to a single factor is better than two factor authentication, except that it gives Google and Apple more control over the internet by allowing them to lock people even more heavily into proprietary OS ecosystems.

Re: Tailscale doesn't want your password

#92

Post by scottgg »

SamvitJ wrote: post #89

"Passkeys allow you to go passwordless — rather than a password that can still be phished — you get strong credential that syncs securely across your devices, using your chosen password/passkey manager." This sentence doesn't quite make grammatical sense to me. Is there a typo or two here, or am I missing something?

you get _a_ strong credential, or you get _strong credentials_ , probably

There's a lot going on in there!

Re: Tailscale doesn't want your password

#93

Post by shortcake27 »

ec109685 wrote: post #71
shortcake27 wrote: post #60

Earlier quoted context omitted.

What the heck? SMS as a second factor was considered bad practice ten years ago. Allowing it to be used as the only factor to access your entire Apple ID is absolute negligence as SIM-swapping is still and forever will be trivial. I'm genuinely shocked. Engineers at Apple must have been screaming into their pillows at night as they watched some incompetent BA ignore all advice and force this through.

My guess is that they aren’t making things less secure. There are flows that let you reset your password but don’t let you login today, so letting you login via those flows would be a step up in usability. If you don’t have your phone as your second factor or can’t use phone today to reset password, then I don’t expect you’ll be able to login via that mechanism.

Ah yeah that’s true, it’s no less secure than recovery via phone number.

Not entirely sure how to prevent recovery using a phone number. I wonder if this means setting up a recovery key instead? Been considering doing this anyway.

https://support.apple.com/en-us/HT208072

Re: Tailscale doesn't want your password

#94

Post by [deleted] »

SamvitJ wrote: post #89

"Passkeys allow you to go passwordless — rather than a password that can still be phished — you get strong credential that syncs securely across your devices, using your chosen password/passkey manager." This sentence doesn't quite make grammatical sense to me. Is there a typo or two here, or am I missing something?

[deleted]

Re: Tailscale doesn't want your password

#95

Post by [deleted] »

SamvitJ wrote: post #89

"Passkeys allow you to go passwordless — rather than a password that can still be phished — you get strong credential that syncs securely across your devices, using your chosen password/passkey manager." This sentence doesn't quite make grammatical sense to me. Is there a typo or two here, or am I missing something?

[deleted]

Re: Tailscale doesn't want your password

#96

Post by zoomTo125 »

dfabulich wrote: post #88
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

It's way simpler than you think. You reset your passkey the same way you'd reset your password. So, how do you reset your password when you forget it? Well, it depends. Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there. Som…

Thank you. I think this answers my question.

Re: Tailscale doesn't want your password

#97

Post by drdaeman »

decryption wrote: post #74
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

You need to add multiple passkeys so if one breaks, you can still access the service. Ditto for Yubikeys (which can be added as a passkey), you need more than one so if you lose it you can still access.

Which is going to be a major pain in the ass.

Every time you sign up for something you have to perform a complex rite: 1) sign up or add a portable authenticator (Yubikey or software token in something cross-platform like 1Password); and 2) run around the house, grabbing up all the different devices you have that aren't transparently synchronizing (so, something from Apple, something from Microsoft, something from Google, and don't forget that backup Yubikey you have in a safe too) and enrolling them on the same website.

I'm baffled how this obvious issue is not just unsolved at the start, but is not even addressed by any user-facing marketing materials. Every single demo stops at enrolling one single device, period. The word is that vendors will do you good magically letting you access that passkey from everywhere - and they missed that huge fucking asterisk after "everywhere". Because they won't - Google, Apple, Microsoft, 1Password, and probably everyone else have no incentive to do so, they want to stay in their respective ecosystems and no chance in hell they're doing any cross-platform interop with anything that not theirs.

Apple, Google and Microsoft would love this model. People suddenly swayed to stay within their ecosystem to log in to websites. "Oh shit can't login from here, gotta start Microsoft Edge to access this website" sounds exactly like what those corporations fancy.

Yubico and 1Password don't have a beef with it - someone wants a portable authenticator, they're gonna pay for it - it's not like there are many options anyway.

And only me - as an end user - is not exactly happy. Even though I do want to get rid of passwords and replace them with keypairs.

---

Add: This said, if you're at some conference attending a talk about Passkeys... Please consider raising this point and explicitly not letting it slide with the usual waiver of "nothing to worry about, $VendorName will sync the Passkeys across your devices". Raising awareness is important.

Re: Tailscale doesn't want your password

#98

Post by n42 »

zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

if you're someone who uses a password manager already, and is generating unique random passwords for every website, the only appreciable difference between a passkey and what you do today is:

- the passkey is never transmitted anywhere when logging in, eliminating the largest attack vectors for stealing passwords

- you can no longer manually type the passkey in on random devices that don't have your password manager on it

it's basically a really really long password you don't know with some added security guarantees.

if you are not already doing this, then it requires adaptation to a world where you do not know your passwords and they are stored in a vault. this does mean ironing out account recovery for the account the vault is associated with. passkeys don't change that, though.

Re: Tailscale doesn't want your password

#99

Post by als0 »

rebeccaskinner wrote: post #91
decryption wrote: post #74

Earlier quoted context omitted.

You need to add multiple passkeys so if one breaks, you can still access the service. Ditto for Yubikeys (which can be added as a passkey), you need more than one so if you lose it you can still access.

I see a lot of claims that passkeys are more secure than passwords with 2fa, but my understanding is that they are strictly less secure. As it stands right now, if someone wanted to compromise a service that I use 2fa with, they'd need to both obtain my physical device, and also get my password. Either one of those things may be relatively easy, but it's harder to do both- especially without my knowledge. With passke…

Physical devices, like Yubikeys and iPhones, have rate limited PINs. It’s not enough just to steal a device.

Re: Tailscale doesn't want your password

#100

Post by n42 »

decryption wrote: post #74
zoomTo125 wrote: post #66

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…

You need to add multiple passkeys so if one breaks, you can still access the service. Ditto for Yubikeys (which can be added as a passkey), you need more than one so if you lose it you can still access.

no, this is false. this is different than 2FA. you can reset your passkey just like you can a password.
Post reply on HN