4 ms·

I agree - I think password managers will (soon enough) implement passkeys. As you say though, the current implementations deliver lock-in "by-design" (but with

by g_p 4y ago

I agree - I think password managers will (soon enough) implement passkeys. As you say though, the current implementations deliver lock-in "by-design" (but with legitimate reason - you don't want to have an API that shares the AES-256 root key that decrypts passkey keyblobs!) This could all be mitigated with a little bit of tooling (allowing an existing passkey to enrol a new passkey from another device), which would also help users of hardware tokens to potentially create a way to auto-enrol an off-site key. I do believe WebAuthn is a good-faith attempt to get away from the pervasive problem of "use the same useless password everywhere", but it makes a range of compromises which (intentionally or otherwise) create a level of cryptographic vendor lock-in that I don't think many people have recognised yet.

howinteresting 4y ago
I've flagged these concerns to several people involved in Webauthn, privately and publicly, and passkey portability is pretty clearly low-priority (i.e. never going to happen) for them.
- g_p 4y ago
  This is a shame to see - it's understandable that there are some technical challenges in it, but it does seem possible (via a mutual auth handshake) to introduce portability. Kudos to you for arguing the case though! Before "cloud keychain" (i.e. software-backed, like Apple's implementation), your only "safe" option was to have 2x hardware tokens, and try to keep one off-site, but still accessible enough you could enrol it on all the sites you use. I fear with "cloud keychain" Webauthn, we are heading for a world where getting locked out of (or banned from) your "FAMNG" account will lock you out of everything else, to an extent we've not really seen before - no access to your synced keychain secret will prevent you from logging in to everything. Physical tokens remaining interoperable should give technical users an insurance policy against this, but without some kind of portability (i.e. pairing hardware webauthn keys), I fear it won't be practical enough to keep users safe, and independent of the keychain providers.
  - deleted 4y ago
    [deleted]
- jacooper 4y ago
  Great, then I will probably never use it, and anyone who has an iPhone and another windows device. Or any other mismatched devices ecosystem, the locked in ecosystem dream of apple is only applicable to extremely tiny amounts of people.
  - g_p 4y ago
    The technology is safe enough to use, as long as you stick to hardware tokens - I have accumulated a few of them over the years (quite affordable), and you can get USB-A, USB-C and NFC versions. You shouldn't get locked in with a USB hardware token - you can enrol it in Chrome on one computer, and then authenticate via Firefox in another computer. The issue is really the software-based "passkey" implementation. As long as you're not solely reliant on one company for login (i.e. you enrol multiple keys, one of which is portable and interoperable, AKA a hardware token) you can safely add software-based ones for convenience without getting locked in - you can always use the hardware token to get back in and enrol a new device.
  - howinteresting 4y ago
    The problem is that a lot of people are going to unintentionally lock themselves in due to Apple's and Google's marketing. It's going to be a miserable few years.

by g_p 4y ago

howinteresting 4y ago

I've flagged these concerns to several people involved in Webauthn, privately and publicly, and passkey portability is pretty clearly low-priority (i.e. never going to happen) for them.

g_p 4y ago
This is a shame to see - it's understandable that there are some technical challenges in it, but it does seem possible (via a mutual auth handshake) to introduce portability. Kudos to you for arguing the case though! Before "cloud keychain" (i.e. software-backed, like Apple's implementation), your only "safe" option was to have 2x hardware tokens, and try to keep one off-site, but still accessible enough you could enrol it on all the sites you use. I fear with "cloud keychain" Webauthn, we are heading for a world where getting locked out of (or banned from) your "FAMNG" account will lock you out of everything else, to an extent we've not really seen before - no access to your synced keychain secret will prevent you from logging in to everything. Physical tokens remaining interoperable should give technical users an insurance policy against this, but without some kind of portability (i.e. pairing hardware webauthn keys), I fear it won't be practical enough to keep users safe, and independent of the keychain providers.
- deleted 4y ago
  [deleted]
jacooper 4y ago
Great, then I will probably never use it, and anyone who has an iPhone and another windows device. Or any other mismatched devices ecosystem, the locked in ecosystem dream of apple is only applicable to extremely tiny amounts of people.
- g_p 4y ago
  The technology is safe enough to use, as long as you stick to hardware tokens - I have accumulated a few of them over the years (quite affordable), and you can get USB-A, USB-C and NFC versions. You shouldn't get locked in with a USB hardware token - you can enrol it in Chrome on one computer, and then authenticate via Firefox in another computer. The issue is really the software-based "passkey" implementation. As long as you're not solely reliant on one company for login (i.e. you enrol multiple keys, one of which is portable and interoperable, AKA a hardware token) you can safely add software-based ones for convenience without getting locked in - you can always use the hardware token to get back in and enrol a new device.
- howinteresting 4y ago
  The problem is that a lot of people are going to unintentionally lock themselves in due to Apple's and Google's marketing. It's going to be a miserable few years.