5 ms·

I don't get what it's all about this passwordless. I make my browser (Firefox) generate strong password and store them in its password manager, this is synchron

I don't get what it's all about this passwordless. I make my browser (Firefox) generate strong password and store them in its password manager, this is synchronized with end to end encryption to all my devices, I have only to remember a master password. It's kind of the same but it works with every website. It is not complicated, doesn't require certificates that you may loose, and that sort of things.

judge2020 4y ago
In general "passkey breach" events aren't possible.
ghughes 4y ago
The point is to make it harder to export your credentials to another platform. An iOS refugee with a keychain full of passkeys will have to do a password reset for every account, instead of a relatively simple export/import into a third-party password manager.
sideshownz 4y ago
Try explaining a password manager to your nana, and having her use it. Then explain to her how she can install it on her phone and have it synchronised across all her devices. Password managers are awesome, but way too technical to become mainstream. You shouldn't have to install 3rd party software for something so fundamental. The password system really needs an overhaul and hopefully this will go along way towards fixing it.
- makeitdouble 4y ago
  > Try explaining a password manager to your nana It's an interesting issue, and wildly varies depending on who manages her devices. For instance if she has an iPhone with a windows computer, a third party manager brings uniformity to how she deals with login on any device she happens to use. Same if she happens to use a Chromebook. Or even if she uses an older Apple device, I'm assuming passkeys won't come to previous OSes, and upgrading a 2018 MBP just to get passkeys would come with a lot of trade-offs. Perhaps I'm seeing it as, it's already a complex mess already, and Apple didn't come with a silver buller to solve all that complexity in one swoop. PS: password managers are fairly straightforward to explain: it's a digital equivalent of the password notebook they keep in the side drawer
- BuckRogers 4y ago
  Sometimes I wonder how bright nana or papa really is as a result. If you won't dig into even an iPhone's settings to learn what's available, what it can do, good luck to you. That curiosity and willingness to play around, accompanied with Google searches when they don't know what something does, is critical in making it in the world today. Or if you remain a rube, and they will, you'll get scammed someday because you're not on the top of your game mentally. Just lazying it up. I've come to two solutions. Either Bitwarden or KeePass with only a mobile client to begin with. If they are managing that, then I graduate them to clients on multiple systems and the integration advantages that brings. I'm a KeePass Windows and Strongbox Pro user on iOS myself. Prefer to keep that database where I want it. Bitwarden is probably the ticket for most people though. If you start them on mobile only, it helps a lot.
  - urthor 4y ago
    What a ridiculous thing to say. Nana and Papa are not locksmiths. Nana and Papa still deserve to have a front door to their house that can't be lockpicked. Normal people, who have other interests in life than configuring technology, should have secure devices and data from criminals. And they shouldn't have to configure 5 different obscure password managers to do so. Society shouldn't allow criminals to take advantage of Nana and Papa. This is one of the most embarrassing comments I've read on Hackernews.
    - BuckRogers 4y ago
      Expecting people to give the minimum of a damn is embarrassing to point out? It's true either way. Sometimes a certain level of complexity can't be abstracted over. This is no longer a fun toy in life. You may have your bank account credentials stolen if you don't wake up and pay attention to what you're looking at. To avoid being lockpicked you only need two-factor. It's that simple. You need some form of password manager, even if it's paper and pencil, until a megacorp handles it all for you. That'll require a universal standard to be adopted, which won't be here soon. The rest of your assertions are assuming a premise that I never stated. Feigning offense on the internet has really gone over the top. Of course people should have secure devices.
- whyenot 4y ago
  Apple already has a password manager as part of iOS/MacOS. Your passwords sync seamlessly on other Apple devices via iCloud. There is nothing to install. My octogenarian mother uses it daily on her iPad and iMac.
- i67vw3 4y ago
  Password managers are already pretty easy to use from a nana's perspective. The main problem is that nana does not know that password managers exit itself. Most of them just input password as 'nana1234' and store it in their browser password manager (usually chrome password manager) and use chrome's autofill. Eg., I was telling a middle aged person (50 years) about password managers and were unable to grasp the idea of it. 'Why would you store passwords in cloud based password manager from a company I have never heard of, just type a password and write it down on your diary (OS notes app) or just store it in chrome. I trust google (chrome) to keep my passwords safe rather than with some sketchy company I have never heard of (the sketchy company if one of the most reputable cloud based password management company).
  - larrybud 4y ago
    > I was telling a middle aged person (50 years) about password managers and were unable to grasp the idea of it. This is more than a little ageist, don’t you think? > Why would you store passwords in cloud based password manager from a company I have never heard of? This is actually a very valid question; hope you didn’t just dismiss it due to “the oldie doesn’t understand.”
    - i67vw3 4y ago
      >This is more than a little ageist, don’t you think? It was not meant in that way, same thing could be said about 20 year old, who have no idea (or unable to grasp) about password manager but more importantly about Authenticator Apps (Micorosft Authenticator, Authy, Aegis). >This is actually a very valid question; hope you didn’t just dismiss it due to “the oldie doesn’t understand.” You are reading my comment from a wrong angle.
javajosh 4y ago
Apps.
- theonething 4y ago
  1Password supports mobile apps. Probably other password managers do too.
  - javajosh 4y ago
    Sure, but how does that relate to the GP's comment about Firefox? Did Mozilla release a FirefoxOS for Apple devices that I didn't hear about?!
    - leodriesch 4y ago
      Firefox also acts as a password manager on iOS and supports the standard system-wide auto-fill APIs [0]. [0]: https://support.mozilla.org/en-US/kb/end-of-support-firefox-lockwise https://support.mozilla.org/en-US/kb/end-of-support-firefox-...
tuxone 4y ago
I don’t get that too, you can already build such a system yourself quite trivially with gpg+rsync
- padjo 4y ago
  Impossible to tell if this is serious or sarcasm, well done if it’s the latter.
  - stevewatson301 4y ago
tinus_hn 4y ago
It’s not the same because you have to actually tell the websites your password, while with this, like with certificates, you only have to prove that you have access to the private key. So, if the server is hacked they don’t get a dump of encrypted passwords and if the hack persists they can’t sniff your password. Because the server never gets your password.
- ghughes 4y ago
  But this is irrelevant if you use a password manager.
  - potatoz2 4y ago
    Not entirely. If I MITM your connection to a website that uses a password, I have access until the breach is detected. If I MITM a public/private key log in, I only have access to the session (which can be made arbitrarily short if logging in is painless/automatic).
    - ghughes 4y ago
      But you can't, because TLS.
  - tinus_hn 4y ago
    No, because if the server gets hacked and the attacker can intercept your password, your password manager is managing a password that is, unbeknownst to it, known to an attacker. Who can now use that password to just login to the service.
donarb 4y ago
It eliminates phishing since there is no password to share and the authorization is locked to a specific domain.
- makeitdouble 4y ago
  Flip side of the coin: this system now manages what domain you can log to, and when it gets it wrong you're probably toast or go through a backup option (is there any if yhey maximize for security ?) I used Apple keychain for a while, and it wasn't good at recognizing which site needed which password, not even including account switching when you want to use a different one. If it hasn't significantly improved, it will be a pretty frustrating experience for user heavily relying on it (and not just using the same 5 sites the same way everyday)
xtat 4y ago
How does apple get your data that way?

judge2020 4y ago

In general "passkey breach" events aren't possible.

ghughes 4y ago

The point is to make it harder to export your credentials to another platform. An iOS refugee with a keychain full of passkeys will have to do a password reset for every account, instead of a relatively simple export/import into a third-party password manager.

sideshownz 4y ago

Try explaining a password manager to your nana, and having her use it. Then explain to her how she can install it on her phone and have it synchronised across all her devices. Password managers are awesome, but way too technical to become mainstream. You shouldn't have to install 3rd party software for something so fundamental. The password system really needs an overhaul and hopefully this will go along way towards fixing it.

makeitdouble 4y ago
> Try explaining a password manager to your nana It's an interesting issue, and wildly varies depending on who manages her devices. For instance if she has an iPhone with a windows computer, a third party manager brings uniformity to how she deals with login on any device she happens to use. Same if she happens to use a Chromebook. Or even if she uses an older Apple device, I'm assuming passkeys won't come to previous OSes, and upgrading a 2018 MBP just to get passkeys would come with a lot of trade-offs. Perhaps I'm seeing it as, it's already a complex mess already, and Apple didn't come with a silver buller to solve all that complexity in one swoop. PS: password managers are fairly straightforward to explain: it's a digital equivalent of the password notebook they keep in the side drawer
BuckRogers 4y ago
Sometimes I wonder how bright nana or papa really is as a result. If you won't dig into even an iPhone's settings to learn what's available, what it can do, good luck to you. That curiosity and willingness to play around, accompanied with Google searches when they don't know what something does, is critical in making it in the world today. Or if you remain a rube, and they will, you'll get scammed someday because you're not on the top of your game mentally. Just lazying it up. I've come to two solutions. Either Bitwarden or KeePass with only a mobile client to begin with. If they are managing that, then I graduate them to clients on multiple systems and the integration advantages that brings. I'm a KeePass Windows and Strongbox Pro user on iOS myself. Prefer to keep that database where I want it. Bitwarden is probably the ticket for most people though. If you start them on mobile only, it helps a lot.
- urthor 4y ago
  What a ridiculous thing to say. Nana and Papa are not locksmiths. Nana and Papa still deserve to have a front door to their house that can't be lockpicked. Normal people, who have other interests in life than configuring technology, should have secure devices and data from criminals. And they shouldn't have to configure 5 different obscure password managers to do so. Society shouldn't allow criminals to take advantage of Nana and Papa. This is one of the most embarrassing comments I've read on Hackernews.
  - BuckRogers 4y ago
    Expecting people to give the minimum of a damn is embarrassing to point out? It's true either way. Sometimes a certain level of complexity can't be abstracted over. This is no longer a fun toy in life. You may have your bank account credentials stolen if you don't wake up and pay attention to what you're looking at. To avoid being lockpicked you only need two-factor. It's that simple. You need some form of password manager, even if it's paper and pencil, until a megacorp handles it all for you. That'll require a universal standard to be adopted, which won't be here soon. The rest of your assertions are assuming a premise that I never stated. Feigning offense on the internet has really gone over the top. Of course people should have secure devices.
whyenot 4y ago
Apple already has a password manager as part of iOS/MacOS. Your passwords sync seamlessly on other Apple devices via iCloud. There is nothing to install. My octogenarian mother uses it daily on her iPad and iMac.
i67vw3 4y ago
Password managers are already pretty easy to use from a nana's perspective. The main problem is that nana does not know that password managers exit itself. Most of them just input password as 'nana1234' and store it in their browser password manager (usually chrome password manager) and use chrome's autofill. Eg., I was telling a middle aged person (50 years) about password managers and were unable to grasp the idea of it. 'Why would you store passwords in cloud based password manager from a company I have never heard of, just type a password and write it down on your diary (OS notes app) or just store it in chrome. I trust google (chrome) to keep my passwords safe rather than with some sketchy company I have never heard of (the sketchy company if one of the most reputable cloud based password management company).
- larrybud 4y ago
  > I was telling a middle aged person (50 years) about password managers and were unable to grasp the idea of it. This is more than a little ageist, don’t you think? > Why would you store passwords in cloud based password manager from a company I have never heard of? This is actually a very valid question; hope you didn’t just dismiss it due to “the oldie doesn’t understand.”
  - i67vw3 4y ago
    >This is more than a little ageist, don’t you think? It was not meant in that way, same thing could be said about 20 year old, who have no idea (or unable to grasp) about password manager but more importantly about Authenticator Apps (Micorosft Authenticator, Authy, Aegis). >This is actually a very valid question; hope you didn’t just dismiss it due to “the oldie doesn’t understand.” You are reading my comment from a wrong angle.

javajosh 4y ago

Apps.

theonething 4y ago
1Password supports mobile apps. Probably other password managers do too.
- javajosh 4y ago
  Sure, but how does that relate to the GP's comment about Firefox? Did Mozilla release a FirefoxOS for Apple devices that I didn't hear about?!
  - leodriesch 4y ago
    Firefox also acts as a password manager on iOS and supports the standard system-wide auto-fill APIs [0]. [0]: https://support.mozilla.org/en-US/kb/end-of-support-firefox-lockwise https://support.mozilla.org/en-US/kb/end-of-support-firefox-...

tuxone 4y ago

I don’t get that too, you can already build such a system yourself quite trivially with gpg+rsync

padjo 4y ago
Impossible to tell if this is serious or sarcasm, well done if it’s the latter.
- stevewatson301 4y ago

tinus_hn 4y ago

It’s not the same because you have to actually tell the websites your password, while with this, like with certificates, you only have to prove that you have access to the private key. So, if the server is hacked they don’t get a dump of encrypted passwords and if the hack persists they can’t sniff your password. Because the server never gets your password.

ghughes 4y ago
But this is irrelevant if you use a password manager.
- potatoz2 4y ago
  Not entirely. If I MITM your connection to a website that uses a password, I have access until the breach is detected. If I MITM a public/private key log in, I only have access to the session (which can be made arbitrarily short if logging in is painless/automatic).
  - ghughes 4y ago
    But you can't, because TLS.
- tinus_hn 4y ago
  No, because if the server gets hacked and the attacker can intercept your password, your password manager is managing a password that is, unbeknownst to it, known to an attacker. Who can now use that password to just login to the service.

donarb 4y ago

It eliminates phishing since there is no password to share and the authorization is locked to a specific domain.

makeitdouble 4y ago
Flip side of the coin: this system now manages what domain you can log to, and when it gets it wrong you're probably toast or go through a backup option (is there any if yhey maximize for security ?) I used Apple keychain for a while, and it wasn't good at recognizing which site needed which password, not even including account switching when you want to use a different one. If it hasn't significantly improved, it will be a pretty frustrating experience for user heavily relying on it (and not just using the same 5 sites the same way everyday)

xtat 4y ago

How does apple get your data that way?