Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PassSeeds – hijacking Passkeys to unlock new cryptographic use cases

backalleycoder.com

Post reply on HN
Print view View original

1–10 of 45 posts

Re: PassSeeds – hijacking Passkeys to unlock new cryptographic use cases

#2

Post by csuwldcat »

Passkeys can be hijacked to serve as cryptographic seed material that is securely synced across all of a user’s devices, enabling the generation of a wide range of cryptographic keys. This allows Passkeys to power use cases far beyond what they have traditionally been constrained to. I’ve been calling this mechanism PassSeeds.

I’ll leave the details to the blog post, but here’s a short list of what PassSeeds enable:

- Need a user-custodied BLS12-381 key to engage in more advanced ZKP Verifiable Credential / proofing flows? Say less, you're covered.

- Want to create a petty cash Web wallet for Bitcoin transactions that relies on a secp256k1 key? Ask and ye shall receive.

- How about keys for decentralized social media identifiers and post signing that are of a type other than P-256? No problem, I got you!

Re: PassSeeds – hijacking Passkeys to unlock new cryptographic use cases

#3

Post by phillipseamore »

csuwldcat wrote: post #2

Passkeys can be hijacked to serve as cryptographic seed material that is securely synced across all of a user’s devices, enabling the generation of a wide range of cryptographic keys. This allows Passkeys to power use cases far beyond what they have traditionally been constrained to. I’ve been calling this mechanism PassSeeds. I’ll leave the details to the blog post, but here’s a short list of what PassSeeds enable:…

Why use the word "hijacked" and not repurposing, extending or adapting? I'd even prefer leveraging.

Re: PassSeeds – hijacking Passkeys to unlock new cryptographic use cases

#4

Post by witte »

phillipseamore wrote: post #3
csuwldcat wrote: post #2

Passkeys can be hijacked to serve as cryptographic seed material that is securely synced across all of a user’s devices, enabling the generation of a wide range of cryptographic keys. This allows Passkeys to power use cases far beyond what they have traditionally been constrained to. I’ve been calling this mechanism PassSeeds. I’ll leave the details to the blog post, but here’s a short list of what PassSeeds enable:…

Why use the word "hijacked" and not repurposing, extending or adapting? I'd even prefer leveraging.

[dead]

Re: PassSeeds – hijacking Passkeys to unlock new cryptographic use cases

#6

Post by csuwldcat »

phillipseamore wrote: post #3
csuwldcat wrote: post #2

Passkeys can be hijacked to serve as cryptographic seed material that is securely synced across all of a user’s devices, enabling the generation of a wide range of cryptographic keys. This allows Passkeys to power use cases far beyond what they have traditionally been constrained to. I’ve been calling this mechanism PassSeeds. I’ll leave the details to the blog post, but here’s a short list of what PassSeeds enable:…

Why use the word "hijacked" and not repurposing, extending or adapting? I'd even prefer leveraging.

Just sounded cooler , and I was on the team that worked on Passkeys at Microsoft, so I wanted to poke them a bit (in a friendly way).

Re: PassSeeds – hijacking Passkeys to unlock new cryptographic use cases

#8

Post by csuwldcat »

josephcsible wrote: post #7

How is this any better than just storing the value in a password manager, or in YubiKey's "Static Password" mode? Also, the "ECDSA Public Key Recovery" picture makes me suspect this is AI slop.

How it's better: automatically synced across all a user's devices, not subject to manual interactions with input fields (you can't programmatically request/regen passwords the same way you can with this).

I did use AI for the ECDSA public key recovery diagram, because I wasn't about to spend hours hand rolling that in Lunacy. It's correct in broad strokes, and anyone who wants to understand it more deeply can just look at the code, imo.

Re: PassSeeds – hijacking Passkeys to unlock new cryptographic use cases

#9

Post by notorious_pgb »

Interesting, but the PRF / LargeBlob extensions already enable just such functionality (and more) without relying on the secrecy of a public key.

Why not just use those?

Edit: that's what I get for not reading far enough -- the article addresses this, though I would quibble with the confident assertion that the extensions are not available in major browsers, given I worked for a startup literal years ago which built major functionality on top of these extensions, which were available in (at least) all relevant mobile browsers.

Re: PassSeeds – hijacking Passkeys to unlock new cryptographic use cases

#10

Post by [deleted] »

notorious_pgb wrote: post #9

Interesting, but the PRF / LargeBlob extensions already enable just such functionality (and more) without relying on the secrecy of a public key. Why not just use those? Edit: that's what I get for not reading far enough -- the article addresses this, though I would quibble with the confident assertion that the extensions are not available in major browsers, given I worked for a startup literal years ago which built…

[deleted]
Post reply on HN