Passkey can detect auth cloning via signCount, but big tech do not support it
1–10 of 13 posts
Re: Passkey can detect auth cloning via signCount, but big tech do not support it
#2Probably a naive question, but: if the passkey is synchronised between multiple devices, doesn't it just trivially render the signCount useless?
Say I have a passkey shared between my laptop and my smartphone. When I log in with the smartphone, the signCount is incremented and the new value is synchronised with the laptop, as suggested in the article.
Now say my passkey is compromised, and an attacker logs in from somewhere else. Won't the signCount just be incremented and synchronised with the smartphone and the laptop? How does signCount prevent that?
Re: Passkey can detect auth cloning via signCount, but big tech do not support it
#3Probably a naive question, but: if the passkey is synchronised between multiple devices, doesn't it just trivially render the signCount useless? Say I have a passkey shared between my laptop and my smartphone. When I log in with the smartphone, the signCount is incremented and the new value is synchronised with the laptop, as suggested in the article. Now say my passkey is compromised, and an attacker logs in from so…
You made a good point, esp. if your passkey vault is comprosed, e.g. Apple iCloud's credentials are leaked. signCount, incremented or not, would not help here in informing you of your hacked iCloud account – that would be dependent on iCloud's service itself for detecting and informing you of your compromised account.
I would still like to see big tech passkey providers implement signCount for the following 2 reasons:
1. It helps to push relying parties to implement signCount verification. Right now most relying parties do not implement it as many providers are returning `0` for `signCount`.
2. This would be an odd one, it helps against detecting leaked private keys of passkeys, if a malicious attacker, internal or external, manages to obtain the private key.
Re: Passkey can detect auth cloning via signCount, but big tech do not support it
#4Probably a naive question, but: if the passkey is synchronised between multiple devices, doesn't it just trivially render the signCount useless? Say I have a passkey shared between my laptop and my smartphone. When I log in with the smartphone, the signCount is incremented and the new value is synchronised with the laptop, as suggested in the article. Now say my passkey is compromised, and an attacker logs in from so…
I haven't paid much attention to the passkey journey.
Why would you sync a passkey, rather than create a separate one for each device? Seems risky if it's compromised?
Re: Passkey can detect auth cloning via signCount, but big tech do not support it
#5Probably a naive question, but: if the passkey is synchronised between multiple devices, doesn't it just trivially render the signCount useless? Say I have a passkey shared between my laptop and my smartphone. When I log in with the smartphone, the signCount is incremented and the new value is synchronised with the laptop, as suggested in the article. Now say my passkey is compromised, and an attacker logs in from so…
You made a good point, esp. if your passkey vault is comprosed, e.g. Apple iCloud's credentials are leaked. signCount, incremented or not, would not help here in informing you of your hacked iCloud account – that would be dependent on iCloud's service itself for detecting and informing you of your compromised account. I would still like to see big tech passkey providers implement signCount for the following 2 reasons…
I'm a bit confused: how does signCount ever bring security in a shared-passkey scenario?
The only way I can see it be useful is if you have exactly one instance of the passkey (e.g. a security key), because if `signCount` got incremented without the security key being aware of it, then you have a problem.
Re: Passkey can detect auth cloning via signCount, but big tech do not support it
#6Probably a naive question, but: if the passkey is synchronised between multiple devices, doesn't it just trivially render the signCount useless? Say I have a passkey shared between my laptop and my smartphone. When I log in with the smartphone, the signCount is incremented and the new value is synchronised with the laptop, as suggested in the article. Now say my passkey is compromised, and an attacker logs in from so…
I haven't paid much attention to the passkey journey. Why would you sync a passkey, rather than create a separate one for each device? Seems risky if it's compromised?
I don't; I use Yubikeys so each passkey is unique.
But I was assuming that the TooBigTech implementation was somehow sharing the passkeys?
Re: Passkey can detect auth cloning via signCount, but big tech do not support it
#7Probably a naive question, but: if the passkey is synchronised between multiple devices, doesn't it just trivially render the signCount useless? Say I have a passkey shared between my laptop and my smartphone. When I log in with the smartphone, the signCount is incremented and the new value is synchronised with the laptop, as suggested in the article. Now say my passkey is compromised, and an attacker logs in from so…
I haven't paid much attention to the passkey journey. Why would you sync a passkey, rather than create a separate one for each device? Seems risky if it's compromised?
convenience. They judge that people using synced passkeys is better than people finding passkeys annoying and not using passkeys at all.
Re: Passkey can detect auth cloning via signCount, but big tech do not support it
#8Earlier quoted context omitted.
You made a good point, esp. if your passkey vault is comprosed, e.g. Apple iCloud's credentials are leaked. signCount, incremented or not, would not help here in informing you of your hacked iCloud account – that would be dependent on iCloud's service itself for detecting and informing you of your compromised account. I would still like to see big tech passkey providers implement signCount for the following 2 reasons…
I'm a bit confused: how does signCount ever bring security in a shared-passkey scenario? The only way I can see it be useful is if you have exactly one instance of the passkey (e.g. a security key), because if `signCount` got incremented without the security key being aware of it, then you have a problem.
Same reason how signCount is useful in a non-shared passkey. Yubikeys are not supposed to be cloneable afaik, but this helps to detect if somehow it got done.
Also, why not.
Re: Passkey can detect auth cloning via signCount, but big tech do not support it
#9Earlier quoted context omitted.
I'm a bit confused: how does signCount ever bring security in a shared-passkey scenario? The only way I can see it be useful is if you have exactly one instance of the passkey (e.g. a security key), because if `signCount` got incremented without the security key being aware of it, then you have a problem.
Same reason how signCount is useful in a non-shared passkey. Yubikeys are not supposed to be cloneable afaik, but this helps to detect if somehow it got done. Also, why not.
> Same reason how signCount is useful in a non-shared passkey.
Again: unless I am missing something, signCount is useless with a shared passkey. If your laptop expects signCount to be "2" and sees "5", it will just believe that your smartphone was used in the meantime. The counter doesn't say "it was used illegally", does it?
> Also, why not.
"Because it's useless" sounds like a good reason to me. Unless you explain why it is not useless, that is.
Re: Passkey can detect auth cloning via signCount, but big tech do not support it
#10Earlier quoted context omitted.
Same reason how signCount is useful in a non-shared passkey. Yubikeys are not supposed to be cloneable afaik, but this helps to detect if somehow it got done. Also, why not.
> Same reason how signCount is useful in a non-shared passkey. Again: unless I am missing something, signCount is useless with a shared passkey. If your laptop expects signCount to be "2" and sees "5", it will just believe that your smartphone was used in the meantime. The counter doesn't say "it was used illegally", does it? > Also, why not. "Because it's useless" sounds like a good reason to me. Unless you explain…
signCount would need to be synchronised as well as the passkey by whatever method you elect to use. If your synchronisation method has been persistently compromised you're hosed, but if the passkey is cloned as a one off, the server would continue to increment signCount everytime either copy is used, while the passkey in your possession would only increment when used by you ie. half as often.
You'd run into trouble if the sync service can't tally multiple device uses in quick succession, which is the likely reason for the article - if I use my synced passkey on three separate devices in a few minutes, all three copies would have the same signCount, but it would be lower than the server's signCount. Either you'd have to prompt the user everytime this happens or record and sync a lot more information about every passkey use and let the sync service count them.