12 ms·

Passkeys sound like another way for companies like Google and Apple to lock you into their walled garden. Having each walled garden randomly generating a key fo

Passkeys sound like another way for companies like Google and Apple to lock you into their walled garden. Having each walled garden randomly generating a key for every single domain instead of using the actual domain name as part of the key is a great way to lock regular people into their respective ecosystems.

redandblack 4y ago
yeah. will be switching to this for all google apps, with firefox for general use
api 4y ago
The entire third party auth push has turned into what may be one of the largest incumbent power grabs I have ever seen. Stuff like Google Amp or even App Store walled gardens pale in comparison. What drives me nuts is how little discussion of this I've seen. People don't even seem aware of the implications of it. It's being pushed hard as a boon to security, which it is in some cases, but at a cost that nobody is even considering or talking about. The implications are pretty profound: large companies having the power to lock you out of everything on a whim (even your own systems and unaffiliated third party services), levy taxes on the use of everything (e.g. Google starts charging you or sites to log in with Google), surveil literally everything (including logging into everything you have as you and sucking down data), and if a big identity provider gets seriously hacked it'll be an epic security apocalypse. Imagine someone stealing the master keys for a provider and pushing ransomware to millions of companies at once. ... and don't forget the obvious: "Oops I got locked out of Google and now I'm locked out of 50 SaaS services, my company's bank, my VPN, and my remote servers." It just totally blows me away that these systems have no privacy protection at all, no portability provision for me to select or change my provider built into the protocol, no built-in support for third factor auth that I can control (e.g. FIDO2), no built in provision for recovery codes, and so on. These kinds of things didn't even seem like they were considered in the design of things like OpenID/OIDC. It's just a big "oh hey lets give god level access with no recourse to third parties and implement it so there's total lock-in... what could go wrong?" Edit: yes some well-implemented systems offer their own built-in support for some of those things (recovery codes, changing your auth provider, reverting to password, etc.) but in my experience it's a minority and there is obviously nothing in the standard to encourage it or provide any guidance on how to do those things securely.
- r00fus 4y ago
  Compare this with status quo for users like my parents. They constantly forget their passwords and quail at screwing up the 2nd factor all the time. If they could just use their fingerprint/faceID to login (after initial registration on the device) they would be super happy. Rest of us should be happy there will be less exploits where people give up the keys to their kingdom by clicking on a random email.
  - jve 4y ago
    Exactly what Google thinks: https://youtu.be/N7N4EC20-cM?t=15m36s https://youtu.be/N7N4EC20-cM?t=15m36s If you scroll back, they mention you have to protect everyone to be effective, i.e. high value target friends and family.
- dickhardt 4y ago
  I founded Hellō to address your concerns. Check out the Show HN post I wrote this morning. https://news.ycombinator.com/item?id=33177705#33182379 https://news.ycombinator.com/item?id=33177705#33182379
- stavros 4y ago
  Man, every one of these comments has completely misunderstood the point. WebAuthn is an open standard. The provider is only there to sync your key. If you want, you can keep it yourself. Why is everyone yelling about the sky falling down when this is the best thing to happen to authentication since ever?
  - api 4y ago
    If it syncs your keys, it has full access. All I'm saying is that authentication is literally the keys to the castle, and inviting third party control of authentication has some scary implications in terms of privacy, monopoly control, and security. We should at least be discussing this, but I don't really see that much discussion. People are just blindly adopting this stuff because it's convenient and not even thinking about what's under the hood or whether there is a way to back out or change provider.
webmobdev 4y ago
This is also going to be a body blow for our privacy - if BigTech have access to your keys, so will the government and both can abuse it. The idea is to force you to "save password on device" (whether you want to or not) so that when a government authority gets your device they can also easily access all your internet accounts. US courts have already affirmed that it is legal for the police to force you to unlock your device if it is biometric protected (fingerprint or face scan etc.). Moreover, by forcing you to use your personal device for identity verification, BigTech is ensuring that identifying you and datamining your personal data becomes more easy for them. Don't be surprised if this is also extended in the future as a "super cookie" service to allow easy tracking.
- yupper32 4y ago
  Why would this be different than any other password manager in that aspect?
  - webmobdev 4y ago
    Online service don't force me to use to use password managers.
- goalieca 4y ago
  There will be services from 1password, yubikey, etc. This is actually great news!
  - oezi 4y ago
    I don't think this is possible. The browser doesn't allow other backends for key storage.
    - deleted 4y ago
      [deleted]
    - goalieca 4y ago
      https://www.yubico.com/blog/a-yubico-faq-about-passkeys/ https://www.yubico.com/blog/a-yubico-faq-about-passkeys/
mooreds 4y ago
My understanding of passkeys is that they are using WebAuthn under the hood (hence the nod to the w3c/FIDO at the end, and the fact that the passkey in the screenshot was associated with tribank.us). They are solving a very real problem. WebAuthn uses private keys, but those private keys are tied to the device where they were created. This is a blessing and a curse. It's a blessing because it eliminates a whole trove of phishing attacks. After all, if no one can get the private key, they can't steal or share it. Well, of course they could steal the actual device, but that's orders of magnitude harder than stealing online credentials (points to https://haveibeenpwned.com/ https://haveibeenpwned.com/ ). That's a good thing. It's a curse because the same person logging in from their ipad, android phone, and desktop PC needs to set up WebAuthn three times. For each domain/website (broadly speaking). If they only set it up once and lose the device, well, they are either locked out or need to have another means of account recovery (username/password, calling a customer service rep). This curse is what passkeys managed by Apple/Google are attempting to solve. I believe the WebAuthn 3 draft is going to try to address some of this: https://www.w3.org/TR/webauthn-3/ https://www.w3.org/TR/webauthn-3/ but that's based on what a co-worker said. A quick scan didn't turn up anything. If you want to know more about WebAuthn, I wrote a lot more here (my company is going to release an implementation Real Soon Now): https://fusionauth.io/learn/expert-advice/authentication/webauthn-explained https://fusionauth.io/learn/expert-advice/authentication/web...
- wnevets 4y ago
  > They are solving a very real problem. WebAuthn uses private keys, but those private keys are tied to the device where they were created. To clarify I am not talking about the issue of syncing the device's private key. I am talking about the artificial problem these walled gardens are creating by having every single domain getting its own randomly generated private key. The only practical way to keep all of these randomly generated keys synced across multiple devices is to use the "cloud". If instead the per site key was generated using a private key and the domain name, users would only need to transport that one private key to another device and would get syncing for free without the requirement of the "cloud".
  - josteink 4y ago
deleted 4y ago
[deleted]
skybrian 4y ago
Seems like you wouldn't want to share passkeys for the same reasons you don't normally want to share passwords? Instead, each website that accepts passkeys should allow you to register multiple devices and probably print out backup codes as well (for the especially important accounts). If there's no reason to migrate anything then lock-in is irrelevant. Just add more login methods so that when you lose some, you have others.
- jjnoakes 4y ago
  I have over 500 online accounts. Imagine if all of them used a login method where I had to have backup devices registered, instead of just me backing up the credentials (like I do today with a password manager). With backup devices, whenever I upgrade or replace a device, I need to go to each of the 500+ online accounts and register the new device. This is much more work than a quick login to each site via my password manager (which can happen on-demand, only as I need to use the services).
  - dickhardt 4y ago
    I founded Hellō to solve this problem. A neutral service where you get to choose how to login, and how you can recover your Hellō Wallet. Done. See Show HN post I wrote this morning https://news.ycombinator.com/item?id=33178285 https://news.ycombinator.com/item?id=33178285
    - dickhardt 4y ago
      doh -- https://news.ycombinator.com/item?id=33177705 https://news.ycombinator.com/item?id=33177705
    - jml7c5 4y ago
      I think you've pasted the wrong link.
      - rohanharikr 4y ago
        https://news.ycombinator.com/item?id=33177705 https://news.ycombinator.com/item?id=33177705

redandblack 4y ago

yeah. will be switching to this for all google apps, with firefox for general use

api 4y ago

The entire third party auth push has turned into what may be one of the largest incumbent power grabs I have ever seen. Stuff like Google Amp or even App Store walled gardens pale in comparison. What drives me nuts is how little discussion of this I've seen. People don't even seem aware of the implications of it. It's being pushed hard as a boon to security, which it is in some cases, but at a cost that nobody is even considering or talking about. The implications are pretty profound: large companies having the power to lock you out of everything on a whim (even your own systems and unaffiliated third party services), levy taxes on the use of everything (e.g. Google starts charging you or sites to log in with Google), surveil literally everything (including logging into everything you have as you and sucking down data), and if a big identity provider gets seriously hacked it'll be an epic security apocalypse. Imagine someone stealing the master keys for a provider and pushing ransomware to millions of companies at once. ... and don't forget the obvious: "Oops I got locked out of Google and now I'm locked out of 50 SaaS services, my company's bank, my VPN, and my remote servers." It just totally blows me away that these systems have no privacy protection at all, no portability provision for me to select or change my provider built into the protocol, no built-in support for third factor auth that I can control (e.g. FIDO2), no built in provision for recovery codes, and so on. These kinds of things didn't even seem like they were considered in the design of things like OpenID/OIDC. It's just a big "oh hey lets give god level access with no recourse to third parties and implement it so there's total lock-in... what could go wrong?" Edit: yes some well-implemented systems offer their own built-in support for some of those things (recovery codes, changing your auth provider, reverting to password, etc.) but in my experience it's a minority and there is obviously nothing in the standard to encourage it or provide any guidance on how to do those things securely.

r00fus 4y ago
Compare this with status quo for users like my parents. They constantly forget their passwords and quail at screwing up the 2nd factor all the time. If they could just use their fingerprint/faceID to login (after initial registration on the device) they would be super happy. Rest of us should be happy there will be less exploits where people give up the keys to their kingdom by clicking on a random email.
- jve 4y ago
  Exactly what Google thinks: https://youtu.be/N7N4EC20-cM?t=15m36s https://youtu.be/N7N4EC20-cM?t=15m36s If you scroll back, they mention you have to protect everyone to be effective, i.e. high value target friends and family.
dickhardt 4y ago
I founded Hellō to address your concerns. Check out the Show HN post I wrote this morning. https://news.ycombinator.com/item?id=33177705#33182379 https://news.ycombinator.com/item?id=33177705#33182379
stavros 4y ago
Man, every one of these comments has completely misunderstood the point. WebAuthn is an open standard. The provider is only there to sync your key. If you want, you can keep it yourself. Why is everyone yelling about the sky falling down when this is the best thing to happen to authentication since ever?
- api 4y ago
  If it syncs your keys, it has full access. All I'm saying is that authentication is literally the keys to the castle, and inviting third party control of authentication has some scary implications in terms of privacy, monopoly control, and security. We should at least be discussing this, but I don't really see that much discussion. People are just blindly adopting this stuff because it's convenient and not even thinking about what's under the hood or whether there is a way to back out or change provider.

webmobdev 4y ago

This is also going to be a body blow for our privacy - if BigTech have access to your keys, so will the government and both can abuse it. The idea is to force you to "save password on device" (whether you want to or not) so that when a government authority gets your device they can also easily access all your internet accounts. US courts have already affirmed that it is legal for the police to force you to unlock your device if it is biometric protected (fingerprint or face scan etc.). Moreover, by forcing you to use your personal device for identity verification, BigTech is ensuring that identifying you and datamining your personal data becomes more easy for them. Don't be surprised if this is also extended in the future as a "super cookie" service to allow easy tracking.

yupper32 4y ago
Why would this be different than any other password manager in that aspect?
- webmobdev 4y ago
  Online service don't force me to use to use password managers.
goalieca 4y ago
There will be services from 1password, yubikey, etc. This is actually great news!
- oezi 4y ago
  I don't think this is possible. The browser doesn't allow other backends for key storage.
  - deleted 4y ago
    [deleted]
  - goalieca 4y ago
    https://www.yubico.com/blog/a-yubico-faq-about-passkeys/ https://www.yubico.com/blog/a-yubico-faq-about-passkeys/

mooreds 4y ago

My understanding of passkeys is that they are using WebAuthn under the hood (hence the nod to the w3c/FIDO at the end, and the fact that the passkey in the screenshot was associated with tribank.us). They are solving a very real problem. WebAuthn uses private keys, but those private keys are tied to the device where they were created. This is a blessing and a curse. It's a blessing because it eliminates a whole trove of phishing attacks. After all, if no one can get the private key, they can't steal or share it. Well, of course they could steal the actual device, but that's orders of magnitude harder than stealing online credentials (points to https://haveibeenpwned.com/ https://haveibeenpwned.com/ ). That's a good thing. It's a curse because the same person logging in from their ipad, android phone, and desktop PC needs to set up WebAuthn three times. For each domain/website (broadly speaking). If they only set it up once and lose the device, well, they are either locked out or need to have another means of account recovery (username/password, calling a customer service rep). This curse is what passkeys managed by Apple/Google are attempting to solve. I believe the WebAuthn 3 draft is going to try to address some of this: https://www.w3.org/TR/webauthn-3/ https://www.w3.org/TR/webauthn-3/ but that's based on what a co-worker said. A quick scan didn't turn up anything. If you want to know more about WebAuthn, I wrote a lot more here (my company is going to release an implementation Real Soon Now): https://fusionauth.io/learn/expert-advice/authentication/webauthn-explained https://fusionauth.io/learn/expert-advice/authentication/web...

wnevets 4y ago
> They are solving a very real problem. WebAuthn uses private keys, but those private keys are tied to the device where they were created. To clarify I am not talking about the issue of syncing the device's private key. I am talking about the artificial problem these walled gardens are creating by having every single domain getting its own randomly generated private key. The only practical way to keep all of these randomly generated keys synced across multiple devices is to use the "cloud". If instead the per site key was generated using a private key and the domain name, users would only need to transport that one private key to another device and would get syncing for free without the requirement of the "cloud".
- josteink 4y ago

deleted 4y ago

[deleted]

skybrian 4y ago

Seems like you wouldn't want to share passkeys for the same reasons you don't normally want to share passwords? Instead, each website that accepts passkeys should allow you to register multiple devices and probably print out backup codes as well (for the especially important accounts). If there's no reason to migrate anything then lock-in is irrelevant. Just add more login methods so that when you lose some, you have others.

jjnoakes 4y ago
I have over 500 online accounts. Imagine if all of them used a login method where I had to have backup devices registered, instead of just me backing up the credentials (like I do today with a password manager). With backup devices, whenever I upgrade or replace a device, I need to go to each of the 500+ online accounts and register the new device. This is much more work than a quick login to each site via my password manager (which can happen on-demand, only as I need to use the services).
- dickhardt 4y ago
  I founded Hellō to solve this problem. A neutral service where you get to choose how to login, and how you can recover your Hellō Wallet. Done. See Show HN post I wrote this morning https://news.ycombinator.com/item?id=33178285 https://news.ycombinator.com/item?id=33178285
  - dickhardt 4y ago
    doh -- https://news.ycombinator.com/item?id=33177705 https://news.ycombinator.com/item?id=33177705
  - jml7c5 4y ago
    I think you've pasted the wrong link.
    - rohanharikr 4y ago
      https://news.ycombinator.com/item?id=33177705 https://news.ycombinator.com/item?id=33177705