8 ms·

Passkeys.io – A Passkey Authentication Demo

119 points by night-rider 4y ago

fourmajor 4y ago
It asked for my email address, which I provided. Then it said there was no account for that email address, and asked if I would like to create an account. I said yes. Then it said I was logged in. Huh? I didn't have to verify anything.
- FlxMgdnz 4y ago
  For the sake of the demo, email validation has been disabled to make the account creation as simple as possible and to allow fake email addresses to be used.
- barkerja 4y ago
  If emails are being treated as usernames, in a real world usage, they should be verified. But beyond that, no verification is necessary.
Zamicol 4y ago
This demo would be far more useful if it displayed the public key that was used. As a developer, this appears more like a superficial sales pitch than a technically informing demo.
- FlxMgdnz 4y ago
  There are very few opportunities in the wild where you can use passkeys with a real account and not just a tech demo that pops up a WebAuthn modal. We've built passkeys.io to showcase what's possible with passkeys from the perspectives of the end user as well as the service provider. The demo that you can use on the page is very much work in progress, though, and we value any feedback.
- psanford 4y ago
  Try https://webauthn.me/debugger https://webauthn.me/debugger. It will show you all the gritty details.
jonas-w 4y ago
Why does it use Apple specific terms like "Touch ID" or "Face ID" or is this now the standard way to talk about fingerprint sensors and face recognition?
astrosi 4y ago
How would you go about handing a lost device with this? A passkey reset email which would have a link that you could use to register a new device?
egorfine 4y ago
Seems like Safari (both mobile and desktop) is actively hostile to Passkeys. Safari on a Mac requires me to enable iCloud Keychain in order to use Passkeys and has no way around that requirement. Mobile Safari presents me a QR code to be scanned by another iOS device o_O
- deleted 4y ago
  [deleted]
- speg 4y ago
  Yeesh. I thought the whole point was to make this easier? How am I supposed to take a photo of my phone screen?
  - illiac786 4y ago
    This is the huge downside of passkeys in my view. You must subscribe to some sync solution, and apple/Google/Msft have a tight grip on it it seems, forcing users to use their own secrets sync solution. Hope it will change though and I can sync my passkeys using 1password for example. I don't want and password manager and a separate passkey manager on top of that....
  - egorfine 4y ago
    You can't. I tried to screenshot the QR code and it disappeared immediately prior to screenshoting. It's a modal screen similar to Apple Pay one.
0dayz 4y ago
Am I wrong here, or isn't this just a glorified password manager on your phone?
tomstuart 4y ago
This was, for me, not an effective demo: when I tap “sign in with a passkey” it shows me a QR code to scan with another device. What? (I assume this is because I haven’t created an account yet, but if so, the demo needs to make that about ten times clearer.)
- FlxMgdnz 4y ago
  Thank you for the feedback. We get this question a lot, and it is obviously not ideal right now. Things will get much better with passkey autofill very soon, though. See also: https://github.com/teamhanko/hanko/discussions/342 https://github.com/teamhanko/hanko/discussions/342
deleted 4y ago
[deleted]
stavros 4y ago
This completely fails on Linux (doesn't even pop up the dialog for my FIDO2 key), even though WebAuthn on e.g. https://www.pastery.net https://www.pastery.net works fine (and works fine with Passkeys on my Android phone).
- groovybits 4y ago
  Just looking at the table at the bottom of the page, "where can passkeys be used", Ubuntu is the only Linux distro listed, and it does not support Passkeys.
  - stavros 4y ago
    Yes, but it supports WebAuthn, which works fine, so I'm confused as to why this site is Passkeys-specific and doesn't use WebAuthn, which, as far as I can tell, is a superset.
    - FlxMgdnz 4y ago
      Currently, only platform authenticators are supported to create passkeys with. Support for Security Keys is in development and will be available soon. Certain combinations of Linux distros and browsers will then support passkey creation as well.
- dwaite 4y ago
  Firefox is unfortunately a behind on support for this technology. I believe at least one password manager (Dashlane) has shipped a web extension that would polyfill the missing bits on Firefox. Unfortunately, passkeys.io as a demo falls back to a legacy "no passkey support" behavior for Firefox, without making it clear (as a demo site) that this is happening.
fbn79 4y ago
What if your device cannot connect to internet? OTP can work even if device is offline.
- endorphine 4y ago
  I guess you're specifically referring to TOTP or SMS-based OTP. Email OTP still requires an internet connection, for example.
- Karunamon 4y ago
  The passkey lives on the device you are logging into the service with, so it implies you have internet access there to be able to log into it in the first place.
- dwaite 4y ago
  If your device has limited network connectivity, it can create new passkeys or use a passkey it already has for interacting with a service. However, it won't be able to synchronize new credentials with any cloud service in multi-device scenarios. Or in other words, it works the same as a password manager today. There is a slight wrinkle that some platforms may eventually offer to use an internet service during registration for any required device attestations (e.g. no, this is really coming from mobile phone brand X). Your registration process can't require such things if you are dealing with non-internet-connected devices.
lwhsiao 4y ago
> passkeys are way more secure and are easier to use than both passwords and all current 2-factor authentication methods Perhaps I'm naive, but how are passkeys "way more secure" than "all current 2-factor authentication methods"? Don't many security keys (e.g. Yubikey) also require that you are in possession of the physical yubikey? I'm using that as a 2-factor authentication method. Why is a passkey more secure? Update: Ah, reading closer it seems that they mean to exclude this yubikey example from "all current 2-factor authentication methods"?
- princevegeta89 4y ago
  One question : will the signature generated on a brand new device still conform to the requirements, if I end up losing all my devices? What if I'm signing in on a random public device?
- FlxMgdnz 4y ago
  By the latest definition, Security Keys also store passkeys.
- homero 4y ago
  I think it protects against someone getting the 2fa code. Passkey talks to the website directly
- dwaite 4y ago
  Yubikey is included - as a passkey. They are more secure because they are different per-site and are public-key-based rather than secret-based, so they can't be captured and replayed later, a website compromise doesn't lead to further compromises, and they are phishing-resistant (e.g. paypa1.com can't request PayPal.com credentials). Passkeys are meant to refer to primary-factor authentication, as opposed to using something like a yubikey as a replacement for SMS OTP or TOTP. The ability to discover available first-factor options for a web domain was something new in FIDO 2 over the older U2F-based keys - I'd expect any security key sold in the last three years to have at least limited support for discoverable credentials. By default when someone talks about passkeys they mean multi-device, where you back them up (most likely to the cloud) and can sync/restore them to other devices. But modern Yubikeys (and current Windows Hello) support single-device passkeys. Or to put it a different way - passkeys are meant to be a concept for something equivalent but better than passwords, not a proper spec in themselves. Hence the lowercase 'p'.
taf2 4y ago
I love this in chrome at least I ran into all sorts of issues trying to get WebAuthn to work with touchid and my yubikey... anyone have plain JS example that works?
- Zamicol 4y ago
  I second this. I would love to see a raw demo that doesn't hide the internals.
  - dwaite 4y ago
    webauthn.io has recently been revamped to support more of the 'passkeys' behavior, such as conditional UI (the password manager/form-fill-like behavior added in certain browsers). webauthn.me has a developer tab that lets you really get your hands dirty.
    - taf2 4y ago
      thanks yeah i tried the webauthn.io but it seems to be in typescript and not very easy to reuse. i'll try webauthn.me
ents 4y ago
The demo is just using OTP sent to my email, which essentially makes my email a password manager, and now a much higher value target.
- freeone3000 4y ago
  There's a different user experience in Safari on Ventura -- it prompts for my TouchID.
- georgyo 4y ago
  Your email is already both the password and 2fa reset for the vast majority of services... including things like bank accounts. Email access is basically total access.
  - ents 4y ago
    That's a good point. It's annoying to have to check email for a code for each login though, compared to 1Password autofill w/password and TOTP.
- FlxMgdnz 4y ago
  Email OTP is just the fallback authentication method of the demo in case a user does not have access to the passkey(s) anymore. Depending on the real world scenario, fallback authentication may either be completely disabled as soon as passkeys are widely available, or protected by e.g. a Security Key or other 2FA methods.
charles_f 4y ago
Very nice, a good step towards the future. Just tried on multi-device scenario with android and my mac and that worked fine. I'm wondering though, how the biometric data gets associated with my email address.
- otachack 4y ago
  From what I remember, your biometric data shouldn't get associated at all. Your hardware uses your biometrics to unlock the onboard enclave / vault and then the process asking can obtain or create what it needs once unlocked. If you don't have biometrics enabled it would resort to your phone password/pin. Don't take my word for it though!
  - charles_f 4y ago
    I think you are correct, I took a shortcut there ; my question is more "I used email A to sign in, and used my android creds (incidentally my fingerprint) - which is using my Gmail account B. Now I want to use my apple creds C to signin on my Mac. What links are created between all these accounts? Does Google now know that their account B is linked to email A? Does Hankio? Or is that the service provider?
- dwaite 4y ago
  The use-case is to create a new key pair when you register an "authenticator" device, and then sign a challenge later to authenticate (prove it is the existing known authenticator). It is up to the site to decide if it wants to accept that authenticator, e.g. if it meets the necessary security requirements. For most sites, they'll accept anything based on user preference. The site only ever knows the 'kind' of authenticator though (possibly through a cryptographic attestation). The authentication process only releases/uses the public key, not any supplemental information. The site would never see any PIN or biometric information that was gathered locally to release the use of the key. The site (usually) can't even tell whether it was a PIN or biometric used - just that that 'kind' of authenticator has a particular behavior and particular security reputation/policy/certifications.
azinman2 4y ago
I guess I’m not understanding passkeys. On my iPhone it’s asking generating a QR code to scan with another device. Is this assuming another device already has credentials? What if this is my only device?
- ezfe 4y ago
  You can also save it to your phone, you only need to scan another QR code if you want to save it on another device
  - azinman2 4y ago
    I’m given a prompt to either use another device or an external key. Those are the only two choices. Or am I supposed to create via email first and that’s what I’m missing?
    - 58028641 4y ago
      You have to create first.
- LeoPanthera 4y ago
  In the specific case of Apple, your PassKey is stored in iCloud, and so can be retrieved from any Apple device you are signed into. Without this kind of cloud sync, you need at least two devices, or you will be locked out if you lose or break one.
- number6 4y ago
  Do you use fingerprints to unlock your device? The page asked me to identify via fingerprints
- dwaite 4y ago
  You register a device (authenticator), which generates and registers a new public key. You show up with that again in the future, which answers a challenge by using the private key. So it's just saying "I'm the same device as you've seen in the past". The system QR code behavior is for when your registered credential lives on another device. It sounds like you might have not registered anything yet, so you don't have any account or credentials with which to sign in.
drdaeman 4y ago
When signing up on a Windows machine with Firefox it doesn't let me use Yubikey but prompts for a Windows Hello PIN instead. Canceling the dialog doesn't go to the next available method (like it normally does) but just retries once again, after a second cancellation it just gives up. I'd say this makes this whole thing completely unusable, because under no circumstances would I ever want to use a machine-bound authenticator (unless that's the only option I physically have). I really cannot think of any reason, it won't give me any extra security and it will make things needlessly complicated in event of device loss. To make it worse, when I'm trying to sign in, it prompts me for my Yubikey PIN, and not Windows Hello PIN. Basically, multiple token support is badly messed up.
- ArchOversight 4y ago
  Using a physical key in Windows now requires you to enter the pin to unlock your Yubikey (or set a pin) before you can use it to register. This is an issue we've run into a lot at $work where users will forget their FIDO2 pin cause its only used during registration, and never after that, and when they reset the pin it destroys all their previous known 2FA (which is expected). This is a new requirement from Microsoft.
  - drdaeman 4y ago
    I'm aware about this requirement, and it makes sense. Obviously, I want the authenticator device protected, so I must know the device PIN or password to unlock it. It's exactly the same for Windows Hello built-in authenticator, they require a PIN (or face, or whatever other means you have configured) for the computer itself. Same for iPhones, you need a PIN or password to unlock it. It's merely a matter of frequency (phones and laptops are unlocked daily, Yubikeys - depends on the individual), and if use of hardware tokens is prohibited (or even discouraged) from the very beginning they'll never have a chance and the world would go the path of least resistance once again. I'm curious if resetting a PIN or password on Windows or macOS or iPhone OS would retain the Passkey identities. I suspect it would...
    - michaelt 4y ago
thewataccount 4y ago
I'm a bit confused with WebAuthn/Passkeys/Fido If I have a single hardware key/tpm/yubikey/iphone/etc - can you create multiple users on one site? And can they tell that you're the same user? Or are you now locked to just a single user for your phone/macbook/yubikey/whatnot? Also if multiple services colluded (or integrated with say GA) - can they (or at least GA) all tell that you're using the same hardware key across services? Unless I'm missing something this sounds like very bad news for user privacy
- jiveturkey 4y ago
  What you're asking is if the token can act as a so-called supercookie. For the first part yes, you can re-register the key multiple times for multiple accounts on the same site, and generally speaking these are not very correlatable on the basis of the token itself, as long as you have gotten a non-dodgy token (ie, one with a unique attestation cert). There may be other ways to strongly correlate the users however, and then the token may give the final (hard) proof the site was looking for. As a trivial example, linked in does a simple correlation on src IP. If you create 2 fake LI accounts and visit from the same IP, after a ramp up time LI will ask each of them if you want to connect to the other. But in this case, LI already had the info necessary to associate the 2 accounts. The token itself isn't the tip of the spear here, that makes this possible. Cross-site collusion is prevented by restrictions on the RP ID. So as long as the browser is functioning correctly sites cannot collude to use the token as a supercookie. > Unless I'm missing something Well the thing you're missing is that you're simply supposing these things. But these things are prevented by, and intentional in the design of U2F/WebAuthn. And if you don't trust the browser, or want to protect against sophisticated correlation attacks, "just" use a different token when you want to go dark. I'm not sure why you have this underlying assumption that a person can only possess one token. One caveat: I've no idea what you're referring to with "GA".
  - ornornor 4y ago
    > GA Probably means google analytics.
- sumitgt 4y ago
Brajeshwar 4y ago
Any idea how are Password Managers, such as 1Password/Bitwarden/Keepass, thinking of integrating or competing or co-living with Passkeys? I can live with something like 1Password but my wife and kids will be more suited and happier with Passkeys.
- Operyl 4y ago
  Bitwarden already support regular WebAuthn for 2FA[0] to log in. They have an active request for Passkey support[1]. It seems like they want to include these inside of their own service too, as the storage provider. [0] https://bitwarden.com/help/setup-two-step-login-fido/ https://bitwarden.com/help/setup-two-step-login-fido/ [1] https://community.bitwarden.com/t/unlock-bitwarden-with-2fa-e-g-yubikey-instead-of-not-in-addition-to-password/13224 https://community.bitwarden.com/t/unlock-bitwarden-with-2fa-...
  - stavros 4y ago
    They support WebAuthn to log in to Bitwarden, which is very different from supporting WebAuthn to authenticate to sites.
    - Operyl 4y ago
      That’s exactly what I said, “to log in”. They’ve also stated in many places over time their interest to be the holder of keys for these things too, including as a reply to the parent of my comment :).
      - stavros 4y ago
        I know, I'm clarifying that "support WebAuthn to log in" means "to Bitwarden". I'm really looking forward to them being a soft FIDO2 client.
- frizkie 4y ago
  If I understand what I've read correctly, 1Password nightlies already have support for webauthn, but it's certainly not something they advertise as ready for general usage. https://blog.1password.com/1password-is-joining-the-fido-alliance/ https://blog.1password.com/1password-is-joining-the-fido-all...
thealistra 4y ago
Jus a note for the creator. Not all email adresses support the +n thing. Just gmail based
- frenkel 4y ago
  Fastmail supports it too and you can configure postfix and opensmtpd to support it as well.
- leetbulb 4y ago
  More than Gmail supports this.
  - sreevisakh 4y ago
    I can confirm it works on MailInaBox. So it should probably work on any installation that uses Postfix and/or Dovecot.
- endorphine 4y ago
  I don't get why this is downvoted. Even if the second sentence is I correct, the first one is correct. I mistakenly assumed the "+" thing is built into the email standard.
- jonahhorowitz 4y ago
  iCloud Mail supports it too
- jbverschoor 4y ago
  Most providers support it afaik. Additionally, gmail normalize all periods (.) to the mail address without periods. So your.name@gmail.com yo.u.r.n.a..m.e@gmail.com both get delivered to yourname@gmail.com
odo1242 4y ago
I would really like this tech if they supported third party services to store passkeys in.
- lsowen 4y ago
  Wouldn't that completely eliminate the security benefits of passkey?
  - FlxMgdnz 4y ago
    It really depends on your security requirements and where you're coming from or what you're comparing it to. There would be still many advantages over, say, passwords stored in a pw manager, such as no shared secrets across all sites/apps, phishing protection, and far fewer opportunities for user errors.
  - stavros 4y ago
    No, because it already uses a third party service, it just doesn't let you pick the one you want to use. I want to have the option to use a FIDO2 key, for example.
- dwaite 4y ago
  1Password and Dashlane have announced support via web extensions. I also really hope we have future platform-level support, so that third party "passkey managers" will work outside of the browser (such as on mobile, within all native apps).
captaincrowbar 4y ago
Tried entering my email. Fail 1 - doesn't allow autofill. Then tried signing in. "Enter the passcode that was sent to <email>." Fail 2 - no passcode was ever sent. (Yes, I tried the resend button multiple times, because I'm not a moron. Yes, I checked my spam folder, because I'm not a moron. I know the HN crowd would have taken great pleasure in explaining the obvious to me if I hadn't mentioned it.) Even if that had worked, how is copying a code from unencrypted email supposed to be either easier or more secure than a password? Fail 3.
- jasonlotito 4y ago
  So, not saying what happened to you didn't happen, but as a counter point: 1. It allowed me to auto fill. Both the email and the pass code. 2. The pass code was sent and I received it without issue. So, not sure what happened to you, but your failures don't seem an issue with Passkeys, but rather just software in general.
- FlxMgdnz 4y ago
  The demo in it's current state is built with a web component using shadow dom. Unfortunately, most browsers do not support autofill in shadow dom yet. A newer version using light dom will be available soon. Email codes are just the fallback auth method in case no passkeys are supported on the device or the user has lost access to the passkeys. In real world scenarios, this may be secure enough, or fallback authentication could be disabled completely, or secured with Security Keys or other 2FA methods, depending on the use case.
- dwaite 4y ago
  The email and passcode is part of the site registration flow for this particular site (e.g. registration requires a verified email address). Other demo sites like webauthn.io do not attempt to add a 'real' registration flow. My guess is that a demo app was pummeled a bit and fell behind on the email verification queue. That aside, only the part where you register a new credential (e.g. the browser/OS modal dialog) in that registration process is using passkeys.
masterof0 4y ago
Does anyone knows if 'passweys' will be implemented in open source password managers like BitWarden or KeyPassX, etc. ? Or do we need to rely on Apple/Microsoft/Google for this to work?
- dwaite 4y ago
  1Password and Dashlane have web extensions which replace any integrated browser support with their own UX and functionality. I do not know the current release state of those extensions. I personally hope there is more of an 'officially supported' integration in the future with the various browsers and platforms. "Passkey managers" need to be able to integrate with native applications just as well as they do with web apps inside browsers. The fall-back of 'I'll just copy and paste the password over' won't work if the credential isn't text.
- psanford 4y ago
  The specification is fully open and most of the components have already been implemented in various open source libraries. The nice thing about passkeys is that they are just a FIDO2 implementation with a few extensions. That means any site that supports passkeys will also support other FIDO2 implementations, including the existing open source FIDO2 projects.
jbverschoor 4y ago
A few things I don't understand: 1) How can I share the fingerprint keys between chrome and safari? 2) How do I share keys between different types of devices? (mac, ios, android, windows) 3) What happens if my devices are gone? 4) What happens if I want to change my login (email to a new email for example)? 5) Is account recovery handled simply by a reset-email? 6) It seems a validation step of the email is missing?
- barkerja 4y ago
  1. I don't believe you can, but I could be wrong. 2. Apple does this using Keychain (iCloud), but that's limited to Safari in iOS/iPadOS/macOS. 3. I assume would be treated as any other MFA option; if you lose your auth code generator with no backups, you're SOL. With Apple, you can setup what they call a contact recovery, which lets a trusted contact be a point of recovery for your account. 4. I don't believe this is an issue specific to Passkeys. 5. Account recovery isn't really necessary, unless you hit up against point 3, in which case it's about recovering your ability to use the passkey and not so much the account. 6. If emails are being treated as usernames, they absolutely should be validated.
  - cameronh90 4y ago
    > Account recovery isn't really necessary, Unless you want to switch from Safari to Chrome, I guess?
    - barkerja 4y ago
      I would assume so, but I'm not 100% sure. I personally haven't yet messed with Passkeys much aside from use on a couple of sites that have implemented them. My working assumption is if you wanted to use a new browser, you'd have to attempt to log into the service with the new browser. When the Passkey flow prompts you with a QR code to scan, you'd have to use your iPhone/iPad to scan that QR code to allow entry. What happens after that, I have no clue.
    - psanford 4y ago
      Part of the design is that every site will support multiple passkeys tied to an individual account. So it will be normal to use one browser to bootstrap registering another browser with a new passkey into your account. This video[1] by the FIDO alliance shows what that process will look like with a bunch of different OS and browser combos. [1]: https://www.youtube.com/watch?v=SWocv4BhCNg https://www.youtube.com/watch?v=SWocv4BhCNg
homero 4y ago
I wish chrome showed me what keys are issued. There's no way to see a list
- dwaite 4y ago
  The platform is often managing things, sometimes with Chrome and the platform splitting responsibilities when the Chrome team adds support for additional options. So the ability to see or manage passkeys will unfortunately vary by platform, and Chrome's support there will thus also vary. We can only hope this gets more consistent over time. For passkeys in Google Password Manager, I expect they will (at least eventually) show up right alongside passwords. This is also how it works in the Apple ecosystem.
  - homero 4y ago
    Chrome on Android should show easily but it doesn't
bryfb 4y ago
Is passkeys just a webauthn implementation? https://webauthn.io https://webauthn.io is a similar demo I think.
- psanford 4y ago
  Passkeys are an implementation of FIDO2 so yes, any sites that have implemented webauthn will support passkeys. It might be useful to think of passkeys as a usability extension to webauthn. You no longer need to buy dedicated security devices but can use your existing laptop and phone to login securely to your accounts. I expect my parents will start using passkeys on sites in the next 24 months. I would not have tried to get my parents to use Yubikeys.
sreevisakh 4y ago
I don't think I understand passkeys. The best I could make out is that it uses an asymmetric key pair for authentication. How is this different from self-signed TLS client certificates (like the ones used in Gemini protocol) or CertFP used in IRCv3?
- psanford 4y ago
  The difference is that: 1) this is accessible and usable by anyone running a modern operating system+browser. mTLS client certs need to be provisioned which is one of the major reasons why it is only used in enterprise settings. And 2) passkeys and WebAuthn are privacy preserving features. You can't track users across different websites with FIDO2 devices (mTLS does not preserve your privacy at all). This was one of the core principals that went into the design of FIDO(2) from the beginning.
  - sreevisakh 4y ago
    Client certs as implemented on Gemini and IRC are self-signed. They are enrolled on the service after they're created. They don't need enterprise level capabilities. In fact, even the creation of these certificates are automated on many clients (eg: Lagrange Gemini browser, soju IRC bouncer). You don't even think of them as certificates. They're considered as identities. And regarding the privacy. You can deploy as many certificates/identities as you want on multiple accounts and sites. It's not possible to track them across sites or even across accounts, since there is no CA involved.
    - WorldMaker 4y ago
      Passkeys are indeed similar to that approach. There's no CA infrastructure, so they can be considered "self-signed certificates" (though they do not present as certificates, and currently cannot be used for TLS to my understanding, though I don't think there are technical reasons you couldn't wrap them in x509 metadata and use them as such it's just not a core use case), generated per-service, and enrolled as they are created. Passkeys add a couple enterprise features back in than just "raw self-signed certificates" in the form of optional "attestations" designed in a somewhat privacy-preserving way to prove the type of device that owns the key and in deeper enterprise modes the serial number of the device.
smcleod 4y ago
Just tried this on iOS 16.1 and when I go to sign in with the passkey it loads a pop up menu with a QR code that I need to scan - but it's on my phone so what am I supposed to scan it with?
- bouke 4y ago
  Read the “learn more” to learn more. (I had the same question.) First create an account and then setup the passkey.
  - smcleod 4y ago
    Ohhhhhh I see, thank you. Logged a bug on GitHub that hopefully makes it clear that the experience is confusing.
replaceusb 4y ago
I am confused as to why there is a hard requirement tied to apple,google,ms accounts. I get that its so they can sync to other devices but what if I do not want them syncing?
- FlxMgdnz 4y ago
  At some point, the platforms may open their APIs and allow for 3rd party providers to hook in and do the syncing. It can be expected that most current password managers will do that asap.

119 points by night-rider 4y ago

It asked for my email address, which I provided. Then it said there was no account for that email address, and asked if I would like to create an account. I said yes. Then it said I was logged in. Huh? I didn't have to verify anything.

FlxMgdnz 4y ago
For the sake of the demo, email validation has been disabled to make the account creation as simple as possible and to allow fake email addresses to be used.
barkerja 4y ago
If emails are being treated as usernames, in a real world usage, they should be verified. But beyond that, no verification is necessary.

Zamicol 4y ago

This demo would be far more useful if it displayed the public key that was used. As a developer, this appears more like a superficial sales pitch than a technically informing demo.

FlxMgdnz 4y ago
There are very few opportunities in the wild where you can use passkeys with a real account and not just a tech demo that pops up a WebAuthn modal. We've built passkeys.io to showcase what's possible with passkeys from the perspectives of the end user as well as the service provider. The demo that you can use on the page is very much work in progress, though, and we value any feedback.
psanford 4y ago
Try https://webauthn.me/debugger https://webauthn.me/debugger. It will show you all the gritty details.

jonas-w 4y ago

Why does it use Apple specific terms like "Touch ID" or "Face ID" or is this now the standard way to talk about fingerprint sensors and face recognition?

astrosi 4y ago

How would you go about handing a lost device with this? A passkey reset email which would have a link that you could use to register a new device?

egorfine 4y ago

Seems like Safari (both mobile and desktop) is actively hostile to Passkeys. Safari on a Mac requires me to enable iCloud Keychain in order to use Passkeys and has no way around that requirement. Mobile Safari presents me a QR code to be scanned by another iOS device o_O

deleted 4y ago
[deleted]
speg 4y ago
Yeesh. I thought the whole point was to make this easier? How am I supposed to take a photo of my phone screen?
- illiac786 4y ago
  This is the huge downside of passkeys in my view. You must subscribe to some sync solution, and apple/Google/Msft have a tight grip on it it seems, forcing users to use their own secrets sync solution. Hope it will change though and I can sync my passkeys using 1password for example. I don't want and password manager and a separate passkey manager on top of that....
- egorfine 4y ago
  You can't. I tried to screenshot the QR code and it disappeared immediately prior to screenshoting. It's a modal screen similar to Apple Pay one.

0dayz 4y ago

Am I wrong here, or isn't this just a glorified password manager on your phone?

tomstuart 4y ago

This was, for me, not an effective demo: when I tap “sign in with a passkey” it shows me a QR code to scan with another device. What? (I assume this is because I haven’t created an account yet, but if so, the demo needs to make that about ten times clearer.)

FlxMgdnz 4y ago
Thank you for the feedback. We get this question a lot, and it is obviously not ideal right now. Things will get much better with passkey autofill very soon, though. See also: https://github.com/teamhanko/hanko/discussions/342 https://github.com/teamhanko/hanko/discussions/342

deleted 4y ago

[deleted]

stavros 4y ago

This completely fails on Linux (doesn't even pop up the dialog for my FIDO2 key), even though WebAuthn on e.g. https://www.pastery.net https://www.pastery.net works fine (and works fine with Passkeys on my Android phone).

groovybits 4y ago
Just looking at the table at the bottom of the page, "where can passkeys be used", Ubuntu is the only Linux distro listed, and it does not support Passkeys.
- stavros 4y ago
  Yes, but it supports WebAuthn, which works fine, so I'm confused as to why this site is Passkeys-specific and doesn't use WebAuthn, which, as far as I can tell, is a superset.
  - FlxMgdnz 4y ago
    Currently, only platform authenticators are supported to create passkeys with. Support for Security Keys is in development and will be available soon. Certain combinations of Linux distros and browsers will then support passkey creation as well.
dwaite 4y ago
Firefox is unfortunately a behind on support for this technology. I believe at least one password manager (Dashlane) has shipped a web extension that would polyfill the missing bits on Firefox. Unfortunately, passkeys.io as a demo falls back to a legacy "no passkey support" behavior for Firefox, without making it clear (as a demo site) that this is happening.

fbn79 4y ago

What if your device cannot connect to internet? OTP can work even if device is offline.

endorphine 4y ago
I guess you're specifically referring to TOTP or SMS-based OTP. Email OTP still requires an internet connection, for example.
Karunamon 4y ago
The passkey lives on the device you are logging into the service with, so it implies you have internet access there to be able to log into it in the first place.
dwaite 4y ago
If your device has limited network connectivity, it can create new passkeys or use a passkey it already has for interacting with a service. However, it won't be able to synchronize new credentials with any cloud service in multi-device scenarios. Or in other words, it works the same as a password manager today. There is a slight wrinkle that some platforms may eventually offer to use an internet service during registration for any required device attestations (e.g. no, this is really coming from mobile phone brand X). Your registration process can't require such things if you are dealing with non-internet-connected devices.

lwhsiao 4y ago

> passkeys are way more secure and are easier to use than both passwords and all current 2-factor authentication methods Perhaps I'm naive, but how are passkeys "way more secure" than "all current 2-factor authentication methods"? Don't many security keys (e.g. Yubikey) also require that you are in possession of the physical yubikey? I'm using that as a 2-factor authentication method. Why is a passkey more secure? Update: Ah, reading closer it seems that they mean to exclude this yubikey example from "all current 2-factor authentication methods"?

princevegeta89 4y ago
One question : will the signature generated on a brand new device still conform to the requirements, if I end up losing all my devices? What if I'm signing in on a random public device?
FlxMgdnz 4y ago
By the latest definition, Security Keys also store passkeys.
homero 4y ago
I think it protects against someone getting the 2fa code. Passkey talks to the website directly
dwaite 4y ago
Yubikey is included - as a passkey. They are more secure because they are different per-site and are public-key-based rather than secret-based, so they can't be captured and replayed later, a website compromise doesn't lead to further compromises, and they are phishing-resistant (e.g. paypa1.com can't request PayPal.com credentials). Passkeys are meant to refer to primary-factor authentication, as opposed to using something like a yubikey as a replacement for SMS OTP or TOTP. The ability to discover available first-factor options for a web domain was something new in FIDO 2 over the older U2F-based keys - I'd expect any security key sold in the last three years to have at least limited support for discoverable credentials. By default when someone talks about passkeys they mean multi-device, where you back them up (most likely to the cloud) and can sync/restore them to other devices. But modern Yubikeys (and current Windows Hello) support single-device passkeys. Or to put it a different way - passkeys are meant to be a concept for something equivalent but better than passwords, not a proper spec in themselves. Hence the lowercase 'p'.

taf2 4y ago

I love this in chrome at least I ran into all sorts of issues trying to get WebAuthn to work with touchid and my yubikey... anyone have plain JS example that works?

Zamicol 4y ago
I second this. I would love to see a raw demo that doesn't hide the internals.
- dwaite 4y ago
  webauthn.io has recently been revamped to support more of the 'passkeys' behavior, such as conditional UI (the password manager/form-fill-like behavior added in certain browsers). webauthn.me has a developer tab that lets you really get your hands dirty.
  - taf2 4y ago
    thanks yeah i tried the webauthn.io but it seems to be in typescript and not very easy to reuse. i'll try webauthn.me

ents 4y ago

The demo is just using OTP sent to my email, which essentially makes my email a password manager, and now a much higher value target.

freeone3000 4y ago
There's a different user experience in Safari on Ventura -- it prompts for my TouchID.
georgyo 4y ago
Your email is already both the password and 2fa reset for the vast majority of services... including things like bank accounts. Email access is basically total access.
- ents 4y ago
  That's a good point. It's annoying to have to check email for a code for each login though, compared to 1Password autofill w/password and TOTP.
FlxMgdnz 4y ago
Email OTP is just the fallback authentication method of the demo in case a user does not have access to the passkey(s) anymore. Depending on the real world scenario, fallback authentication may either be completely disabled as soon as passkeys are widely available, or protected by e.g. a Security Key or other 2FA methods.

charles_f 4y ago

Very nice, a good step towards the future. Just tried on multi-device scenario with android and my mac and that worked fine. I'm wondering though, how the biometric data gets associated with my email address.

otachack 4y ago
From what I remember, your biometric data shouldn't get associated at all. Your hardware uses your biometrics to unlock the onboard enclave / vault and then the process asking can obtain or create what it needs once unlocked. If you don't have biometrics enabled it would resort to your phone password/pin. Don't take my word for it though!
- charles_f 4y ago
  I think you are correct, I took a shortcut there ; my question is more "I used email A to sign in, and used my android creds (incidentally my fingerprint) - which is using my Gmail account B. Now I want to use my apple creds C to signin on my Mac. What links are created between all these accounts? Does Google now know that their account B is linked to email A? Does Hankio? Or is that the service provider?
dwaite 4y ago
The use-case is to create a new key pair when you register an "authenticator" device, and then sign a challenge later to authenticate (prove it is the existing known authenticator). It is up to the site to decide if it wants to accept that authenticator, e.g. if it meets the necessary security requirements. For most sites, they'll accept anything based on user preference. The site only ever knows the 'kind' of authenticator though (possibly through a cryptographic attestation). The authentication process only releases/uses the public key, not any supplemental information. The site would never see any PIN or biometric information that was gathered locally to release the use of the key. The site (usually) can't even tell whether it was a PIN or biometric used - just that that 'kind' of authenticator has a particular behavior and particular security reputation/policy/certifications.

azinman2 4y ago

I guess I’m not understanding passkeys. On my iPhone it’s asking generating a QR code to scan with another device. Is this assuming another device already has credentials? What if this is my only device?

ezfe 4y ago
You can also save it to your phone, you only need to scan another QR code if you want to save it on another device
- azinman2 4y ago
  I’m given a prompt to either use another device or an external key. Those are the only two choices. Or am I supposed to create via email first and that’s what I’m missing?
  - 58028641 4y ago
    You have to create first.
LeoPanthera 4y ago
In the specific case of Apple, your PassKey is stored in iCloud, and so can be retrieved from any Apple device you are signed into. Without this kind of cloud sync, you need at least two devices, or you will be locked out if you lose or break one.
number6 4y ago
Do you use fingerprints to unlock your device? The page asked me to identify via fingerprints
dwaite 4y ago
You register a device (authenticator), which generates and registers a new public key. You show up with that again in the future, which answers a challenge by using the private key. So it's just saying "I'm the same device as you've seen in the past". The system QR code behavior is for when your registered credential lives on another device. It sounds like you might have not registered anything yet, so you don't have any account or credentials with which to sign in.

drdaeman 4y ago

When signing up on a Windows machine with Firefox it doesn't let me use Yubikey but prompts for a Windows Hello PIN instead. Canceling the dialog doesn't go to the next available method (like it normally does) but just retries once again, after a second cancellation it just gives up. I'd say this makes this whole thing completely unusable, because under no circumstances would I ever want to use a machine-bound authenticator (unless that's the only option I physically have). I really cannot think of any reason, it won't give me any extra security and it will make things needlessly complicated in event of device loss. To make it worse, when I'm trying to sign in, it prompts me for my Yubikey PIN, and not Windows Hello PIN. Basically, multiple token support is badly messed up.

ArchOversight 4y ago
Using a physical key in Windows now requires you to enter the pin to unlock your Yubikey (or set a pin) before you can use it to register. This is an issue we've run into a lot at $work where users will forget their FIDO2 pin cause its only used during registration, and never after that, and when they reset the pin it destroys all their previous known 2FA (which is expected). This is a new requirement from Microsoft.
- drdaeman 4y ago
  I'm aware about this requirement, and it makes sense. Obviously, I want the authenticator device protected, so I must know the device PIN or password to unlock it. It's exactly the same for Windows Hello built-in authenticator, they require a PIN (or face, or whatever other means you have configured) for the computer itself. Same for iPhones, you need a PIN or password to unlock it. It's merely a matter of frequency (phones and laptops are unlocked daily, Yubikeys - depends on the individual), and if use of hardware tokens is prohibited (or even discouraged) from the very beginning they'll never have a chance and the world would go the path of least resistance once again. I'm curious if resetting a PIN or password on Windows or macOS or iPhone OS would retain the Passkey identities. I suspect it would...
  - michaelt 4y ago

thewataccount 4y ago

I'm a bit confused with WebAuthn/Passkeys/Fido If I have a single hardware key/tpm/yubikey/iphone/etc - can you create multiple users on one site? And can they tell that you're the same user? Or are you now locked to just a single user for your phone/macbook/yubikey/whatnot? Also if multiple services colluded (or integrated with say GA) - can they (or at least GA) all tell that you're using the same hardware key across services? Unless I'm missing something this sounds like very bad news for user privacy

jiveturkey 4y ago
What you're asking is if the token can act as a so-called supercookie. For the first part yes, you can re-register the key multiple times for multiple accounts on the same site, and generally speaking these are not very correlatable on the basis of the token itself, as long as you have gotten a non-dodgy token (ie, one with a unique attestation cert). There may be other ways to strongly correlate the users however, and then the token may give the final (hard) proof the site was looking for. As a trivial example, linked in does a simple correlation on src IP. If you create 2 fake LI accounts and visit from the same IP, after a ramp up time LI will ask each of them if you want to connect to the other. But in this case, LI already had the info necessary to associate the 2 accounts. The token itself isn't the tip of the spear here, that makes this possible. Cross-site collusion is prevented by restrictions on the RP ID. So as long as the browser is functioning correctly sites cannot collude to use the token as a supercookie. > Unless I'm missing something Well the thing you're missing is that you're simply supposing these things. But these things are prevented by, and intentional in the design of U2F/WebAuthn. And if you don't trust the browser, or want to protect against sophisticated correlation attacks, "just" use a different token when you want to go dark. I'm not sure why you have this underlying assumption that a person can only possess one token. One caveat: I've no idea what you're referring to with "GA".
- ornornor 4y ago
  > GA Probably means google analytics.
sumitgt 4y ago

Brajeshwar 4y ago

Any idea how are Password Managers, such as 1Password/Bitwarden/Keepass, thinking of integrating or competing or co-living with Passkeys? I can live with something like 1Password but my wife and kids will be more suited and happier with Passkeys.

Operyl 4y ago
Bitwarden already support regular WebAuthn for 2FA[0] to log in. They have an active request for Passkey support[1]. It seems like they want to include these inside of their own service too, as the storage provider. [0] https://bitwarden.com/help/setup-two-step-login-fido/ https://bitwarden.com/help/setup-two-step-login-fido/ [1] https://community.bitwarden.com/t/unlock-bitwarden-with-2fa-e-g-yubikey-instead-of-not-in-addition-to-password/13224 https://community.bitwarden.com/t/unlock-bitwarden-with-2fa-...
- stavros 4y ago
  They support WebAuthn to log in to Bitwarden, which is very different from supporting WebAuthn to authenticate to sites.
  - Operyl 4y ago
    That’s exactly what I said, “to log in”. They’ve also stated in many places over time their interest to be the holder of keys for these things too, including as a reply to the parent of my comment :).
    - stavros 4y ago
      I know, I'm clarifying that "support WebAuthn to log in" means "to Bitwarden". I'm really looking forward to them being a soft FIDO2 client.
frizkie 4y ago
If I understand what I've read correctly, 1Password nightlies already have support for webauthn, but it's certainly not something they advertise as ready for general usage. https://blog.1password.com/1password-is-joining-the-fido-alliance/ https://blog.1password.com/1password-is-joining-the-fido-all...

thealistra 4y ago

Jus a note for the creator. Not all email adresses support the +n thing. Just gmail based

frenkel 4y ago
Fastmail supports it too and you can configure postfix and opensmtpd to support it as well.
leetbulb 4y ago
More than Gmail supports this.
- sreevisakh 4y ago
  I can confirm it works on MailInaBox. So it should probably work on any installation that uses Postfix and/or Dovecot.
endorphine 4y ago
I don't get why this is downvoted. Even if the second sentence is I correct, the first one is correct. I mistakenly assumed the "+" thing is built into the email standard.
jonahhorowitz 4y ago
iCloud Mail supports it too
jbverschoor 4y ago
Most providers support it afaik. Additionally, gmail normalize all periods (.) to the mail address without periods. So your.name@gmail.com yo.u.r.n.a..m.e@gmail.com both get delivered to yourname@gmail.com

odo1242 4y ago

I would really like this tech if they supported third party services to store passkeys in.

lsowen 4y ago
Wouldn't that completely eliminate the security benefits of passkey?
- FlxMgdnz 4y ago
  It really depends on your security requirements and where you're coming from or what you're comparing it to. There would be still many advantages over, say, passwords stored in a pw manager, such as no shared secrets across all sites/apps, phishing protection, and far fewer opportunities for user errors.
- stavros 4y ago
  No, because it already uses a third party service, it just doesn't let you pick the one you want to use. I want to have the option to use a FIDO2 key, for example.
dwaite 4y ago
1Password and Dashlane have announced support via web extensions. I also really hope we have future platform-level support, so that third party "passkey managers" will work outside of the browser (such as on mobile, within all native apps).

captaincrowbar 4y ago

Tried entering my email. Fail 1 - doesn't allow autofill. Then tried signing in. "Enter the passcode that was sent to <email>." Fail 2 - no passcode was ever sent. (Yes, I tried the resend button multiple times, because I'm not a moron. Yes, I checked my spam folder, because I'm not a moron. I know the HN crowd would have taken great pleasure in explaining the obvious to me if I hadn't mentioned it.) Even if that had worked, how is copying a code from unencrypted email supposed to be either easier or more secure than a password? Fail 3.

jasonlotito 4y ago
So, not saying what happened to you didn't happen, but as a counter point: 1. It allowed me to auto fill. Both the email and the pass code. 2. The pass code was sent and I received it without issue. So, not sure what happened to you, but your failures don't seem an issue with Passkeys, but rather just software in general.
FlxMgdnz 4y ago
The demo in it's current state is built with a web component using shadow dom. Unfortunately, most browsers do not support autofill in shadow dom yet. A newer version using light dom will be available soon. Email codes are just the fallback auth method in case no passkeys are supported on the device or the user has lost access to the passkeys. In real world scenarios, this may be secure enough, or fallback authentication could be disabled completely, or secured with Security Keys or other 2FA methods, depending on the use case.
dwaite 4y ago
The email and passcode is part of the site registration flow for this particular site (e.g. registration requires a verified email address). Other demo sites like webauthn.io do not attempt to add a 'real' registration flow. My guess is that a demo app was pummeled a bit and fell behind on the email verification queue. That aside, only the part where you register a new credential (e.g. the browser/OS modal dialog) in that registration process is using passkeys.

masterof0 4y ago

Does anyone knows if 'passweys' will be implemented in open source password managers like BitWarden or KeyPassX, etc. ? Or do we need to rely on Apple/Microsoft/Google for this to work?

dwaite 4y ago
1Password and Dashlane have web extensions which replace any integrated browser support with their own UX and functionality. I do not know the current release state of those extensions. I personally hope there is more of an 'officially supported' integration in the future with the various browsers and platforms. "Passkey managers" need to be able to integrate with native applications just as well as they do with web apps inside browsers. The fall-back of 'I'll just copy and paste the password over' won't work if the credential isn't text.
psanford 4y ago
The specification is fully open and most of the components have already been implemented in various open source libraries. The nice thing about passkeys is that they are just a FIDO2 implementation with a few extensions. That means any site that supports passkeys will also support other FIDO2 implementations, including the existing open source FIDO2 projects.

jbverschoor 4y ago

A few things I don't understand: 1) How can I share the fingerprint keys between chrome and safari? 2) How do I share keys between different types of devices? (mac, ios, android, windows) 3) What happens if my devices are gone? 4) What happens if I want to change my login (email to a new email for example)? 5) Is account recovery handled simply by a reset-email? 6) It seems a validation step of the email is missing?

barkerja 4y ago
1. I don't believe you can, but I could be wrong. 2. Apple does this using Keychain (iCloud), but that's limited to Safari in iOS/iPadOS/macOS. 3. I assume would be treated as any other MFA option; if you lose your auth code generator with no backups, you're SOL. With Apple, you can setup what they call a contact recovery, which lets a trusted contact be a point of recovery for your account. 4. I don't believe this is an issue specific to Passkeys. 5. Account recovery isn't really necessary, unless you hit up against point 3, in which case it's about recovering your ability to use the passkey and not so much the account. 6. If emails are being treated as usernames, they absolutely should be validated.
- cameronh90 4y ago
  > Account recovery isn't really necessary, Unless you want to switch from Safari to Chrome, I guess?
  - barkerja 4y ago
    I would assume so, but I'm not 100% sure. I personally haven't yet messed with Passkeys much aside from use on a couple of sites that have implemented them. My working assumption is if you wanted to use a new browser, you'd have to attempt to log into the service with the new browser. When the Passkey flow prompts you with a QR code to scan, you'd have to use your iPhone/iPad to scan that QR code to allow entry. What happens after that, I have no clue.
  - psanford 4y ago
    Part of the design is that every site will support multiple passkeys tied to an individual account. So it will be normal to use one browser to bootstrap registering another browser with a new passkey into your account. This video[1] by the FIDO alliance shows what that process will look like with a bunch of different OS and browser combos. [1]: https://www.youtube.com/watch?v=SWocv4BhCNg https://www.youtube.com/watch?v=SWocv4BhCNg

homero 4y ago

I wish chrome showed me what keys are issued. There's no way to see a list

dwaite 4y ago
The platform is often managing things, sometimes with Chrome and the platform splitting responsibilities when the Chrome team adds support for additional options. So the ability to see or manage passkeys will unfortunately vary by platform, and Chrome's support there will thus also vary. We can only hope this gets more consistent over time. For passkeys in Google Password Manager, I expect they will (at least eventually) show up right alongside passwords. This is also how it works in the Apple ecosystem.
- homero 4y ago
  Chrome on Android should show easily but it doesn't

bryfb 4y ago

Is passkeys just a webauthn implementation? https://webauthn.io https://webauthn.io is a similar demo I think.

psanford 4y ago
Passkeys are an implementation of FIDO2 so yes, any sites that have implemented webauthn will support passkeys. It might be useful to think of passkeys as a usability extension to webauthn. You no longer need to buy dedicated security devices but can use your existing laptop and phone to login securely to your accounts. I expect my parents will start using passkeys on sites in the next 24 months. I would not have tried to get my parents to use Yubikeys.

sreevisakh 4y ago

I don't think I understand passkeys. The best I could make out is that it uses an asymmetric key pair for authentication. How is this different from self-signed TLS client certificates (like the ones used in Gemini protocol) or CertFP used in IRCv3?

psanford 4y ago
The difference is that: 1) this is accessible and usable by anyone running a modern operating system+browser. mTLS client certs need to be provisioned which is one of the major reasons why it is only used in enterprise settings. And 2) passkeys and WebAuthn are privacy preserving features. You can't track users across different websites with FIDO2 devices (mTLS does not preserve your privacy at all). This was one of the core principals that went into the design of FIDO(2) from the beginning.
- sreevisakh 4y ago
  Client certs as implemented on Gemini and IRC are self-signed. They are enrolled on the service after they're created. They don't need enterprise level capabilities. In fact, even the creation of these certificates are automated on many clients (eg: Lagrange Gemini browser, soju IRC bouncer). You don't even think of them as certificates. They're considered as identities. And regarding the privacy. You can deploy as many certificates/identities as you want on multiple accounts and sites. It's not possible to track them across sites or even across accounts, since there is no CA involved.
  - WorldMaker 4y ago
    Passkeys are indeed similar to that approach. There's no CA infrastructure, so they can be considered "self-signed certificates" (though they do not present as certificates, and currently cannot be used for TLS to my understanding, though I don't think there are technical reasons you couldn't wrap them in x509 metadata and use them as such it's just not a core use case), generated per-service, and enrolled as they are created. Passkeys add a couple enterprise features back in than just "raw self-signed certificates" in the form of optional "attestations" designed in a somewhat privacy-preserving way to prove the type of device that owns the key and in deeper enterprise modes the serial number of the device.

smcleod 4y ago

Just tried this on iOS 16.1 and when I go to sign in with the passkey it loads a pop up menu with a QR code that I need to scan - but it's on my phone so what am I supposed to scan it with?

bouke 4y ago
Read the “learn more” to learn more. (I had the same question.) First create an account and then setup the passkey.
- smcleod 4y ago
  Ohhhhhh I see, thank you. Logged a bug on GitHub that hopefully makes it clear that the experience is confusing.

replaceusb 4y ago

I am confused as to why there is a hard requirement tied to apple,google,ms accounts. I get that its so they can sync to other devices but what if I do not want them syncing?

FlxMgdnz 4y ago
At some point, the platforms may open their APIs and allow for 3rd party providers to hook in and do the syncing. It can be expected that most current password managers will do that asap.