12 ms·

Introducing passkeys in Chrome

120 points by aborsy 4y ago

fud101 4y ago
does this work with yubikeys?
- deleted 4y ago
  [deleted]
- ac50hz 4y ago
  Yes, https://passkey.org/ https://passkey.org/
tedd4u 4y ago
Good to see this. Apple's WWDC video on Passkeys [1] has a good explanation of how passkeys work, including the nifty feature where you can use your phone to log in on a laptop without the laptop getting your credentials. [1] https://developer.apple.com/videos/play/wwdc2022/10092/ https://developer.apple.com/videos/play/wwdc2022/10092/
- kccqzy 4y ago
  And what's more nifty is that the phone can be Android or iOS, the laptop can be Windows or macOS and it will all work.
  - knaik94 4y ago
    How is that different from password+2 factor? Logging-in is already platform independent.
    - yencabulator 4y ago
      Webauthn is immune to phishing. The message sent to the server cryptographically depends on the target domain. With Webauthn, you can't be fooled into typing your password+2factor into gmai1.com.
    - stetrain 4y ago
      Password+2 factor sends your password across the wire to the website, and trusts that website and the path between to handle it securely and not store or log it anywhere. Passkey never sends your private key to the website you are signing in to.
      - knaik94 4y ago
        That's the purpose of the 2 factor. The "private key" used to generate the 5/6 digit pin stays on my device and isn't transmitted.
        stetrain 4y ago
        Well what if we got rid of the password and just used the private key part?
        knaik94 4y ago
        That's how SSH commits work on github. It's an option, but for complete multi-factor security passwords take care of the "something you know" factor. The factors "something you know" like a password, "something you are" like biometrics, along with "something you have" like a hardware authenticator that implements TOTP/HOTP.
        stetrain 4y ago
        But modern password best practices require long, unique passwords for each website. Most users either don’t follow this, or use a password manager. If you use a password manager, the “something you know” has become just another “something you have” like an SSH or 2 factor key. Basically for good security practices, passwords are converging on becoming SSH keys except less secure since you trust the website (or any device that isn’t yours that you type them into) to not leak them. At that point, what value is the password providing when you are always pairing it with an actual private key challenge?
        4y ago
- knaik94 4y ago
  I don't see why I should be worried about storing and using credentials on my own devices. What would be the point, what threat does it protect against, and in what way is it more useful than using OAuth 2.0 "sign in with" feature?
  - taftster 4y ago
    Logging into devices you don't own, for example.
    - knaik94 4y ago
      I log in to devices I don't own using a password+2factor. I have a long but memorable password that I just type in. I don't have some obtuse password where I require a password manager to log-in, I refuse to use the suggested password that chrome generates. What is the point of a password I don't remember? I am going to link this helpful xkcd comic https://xkcd.com/936/ https://xkcd.com/936/ that was published August 10, 2011 that is still relevant.
      - stetrain 4y ago
        If you type your password into a device you don’t own, what value is left in the password? Shouldn’t you basically consider it compromised at that point? If you rely on remembering your passwords, do you also keep them unique for every website?
        brookst 4y ago
        It’s easy to have memorable and unique passwords for every website. You just create a personal hash algorithm to derive a password from the site name. For instance: number of letters in site name + second letter of site name in caps + last letter of site name + number of repeat letters in site name + (! if even number of letters, * if odd) + capitalized first letter google.com = 6Oe1!G bestbuy.com = 7Ey0*B Longer rules than that, but once you remember than you can derive the password for any site. If an adversary gets a few of your passwords and the sites they’re for, it would be easy to crack the rules. But that’s not an attack vector that typical hackers are exploring.
- FeistySkink 4y ago
  What's wrong with any of the existing methods of logging into my laptop?
  - deleted 4y ago
    [deleted]
zagrebian 4y ago
I hope Firefox gets this soon.
josephg 4y ago
Any updates on passkey support in Firefox? Firefox seems to (still) only support hardware keys. (FF 107 / MacOS) https://webauthn.io/ https://webauthn.io/
evolve2k 4y ago
I’m very glad to see passkeys coming especially for the contribution they make to improving user experience. Concerned for the “Big tech” vendor lock-in this will likely facilitate. Anyone played with this in Chrome yet? How hard will it be to migrate away from Chrome with this in place?
- tryptophan 4y ago
  I also think passkeys are great and the future...but the issue of who controls the keys is really important to resolve. If chrome holds them and never lets you export...then those accounts are not yours. They are Google's. No thanks.
- knaik94 4y ago
  I think I got a prompt for this yesterday on a Google account, I was logging into an incognito window while connected to a VPN. I am staying away from enabling because it's not clear how to manage the private and public keys myself.
abdullahkhalids 4y ago
What is interoperability like and does Chrome employ open standards? If I generate a key in Chromium, can I use it in some other browser that supports passkeys?
- cokeandpepsi 4y ago
  It's mostly WebAuthn isn'it it?
- josephg 4y ago
  You can noodle around with it on https://webauthn.io/ https://webauthn.io/ . Keys will sync within ecosystems - so, if you login with safari on iOS, the same credentials show up on desktop Safari on a mac. That doesn't seem to work between Chrome and Safari, but you can scan a QR code to sign in on chrome using a passkey on your phone. Right now I'm not sure if this stuff good enough to use instead of passwords. I'd want Firefox support, and preferably built in support in 1Password too. But it might be good enough to use alongside passwords. We need to collectively figure out how to do that. (Do you get a password and a passkey? Or just a passkey & reset via email? How should the user flows work? Any good examples?)
RjQoLCOSwiIKfpm 4y ago
"A passkey doesn't leave your mobile device when signing in like this. Only a securely generated code is exchanged with the site so, unlike a password, there's nothing that could be leaked." How to circumvent this in order to store the "passkey" in a regular password manager on the same desktop machine, not an external mobile device, so you can do proper backups of it and need no secondary device? NOTICE: I am aware of the security implications. I don't care about them. I don't want any locked-down hardware to prevent me from accessing my own keys. I want control of my own keys.
- aiiane 4y ago
  You don't have to use a mobile device; you can just generate a passkey on a desktop machine.
  - punk_ihaq 4y ago
    Unless you're using Linux. https://developers.google.com/identity/passkeys/supported-environments#linux https://developers.google.com/identity/passkeys/supported-en...
    - psanford 4y ago
      You can use an opensource fido key implementation on linux though.
- ganbatekudasai 4y ago
  It sounds like you just want to continue randomly generated passwords, instead of passkeys? They seem to already solve exactly your problem?
  - RjQoLCOSwiIKfpm 4y ago
    Yes. But Google wants people to make a "transition", so I assume they will not allow passwords at some point in the future.
NikolaNovak 4y ago
I don't understood this. I keep not understanding this. What's my basic authentication method to a site or system I can write down, backup, export or memorize? What happens if I go naked to a friend and want to use their devices to access my systems? What happens if I lose one or more of my existing devices? What happens if I get locked out of one or more of my devices? Basically am I the only one who doesn't think phone is my life and I don't want my life to be over if I lose my phone? I feel like I'm in a twilight zone of phone dependencies. Already so many systems refuse to let me in if I don't have my phone with me due to sms 2fa I didn't ask for, even though I have dozen other devices and valid credentials. Now we just want to stop pretending and just lock me in to phone forever? My phone goes with me everywhere I go and is super likely to get lose broken or stolen. I don't want it to be a dependency to my online access.
- p-e-w 4y ago
  > What's my basic authentication method to a site or system I can write down, backup, export or memorize? There isn't one. This is by design. Logging into your bank or email provider will in the future require mobile device shenanigans that are either proprietary or so complex and opaque that you have no chance of "controlling" anything, or even really understanding what's actually going on. The main lobby driving this forward consists of Google, Apple, and Microsoft. This should tell you all you need to know.
  - stetrain 4y ago
    Which part of passkeys / Webauthn / FIDO requires a mobile device?
    - p-e-w 4y ago
      In principle, none. In practice, many websites will check the user agent and flat out refuse service unless it's one of a pre-approved list of implementations, regardless of whether it would work or not. This has been happening for a long, long time already, for many browser features, and such "standards" pushed forward by the major mobile vendors will only make the problem worse.
vouaobrasil 4y ago
The problem with passkeys is that you need your phone to use them. The more it is adopted, the more likely technology will only work with them in the future. Thus, we will be more tied to our mobile devices. No thanks.
- deleted 4y ago
  [deleted]
- stetrain 4y ago
  Why does it need a phone? It's like SSH keys, you just need access to your keys from where you are logging in. They give the example of using your phone because that's a convenient portable key vault you may have with you. But if you want to keep your keys just on a desktop or in some other password manager that integrates with the browser I don't see any barrier to that. 1Password for example has already announced passkey support.
  - vouaobrasil 4y ago
    Hmm, I didn't know that. Thanks! When I watched Apple's video on passkeys, it seemed to imply a phone was needed.
- encryptluks2 4y ago
  I don't believe you do. You just need an app that supports passkeys, but I could be wrong. The notice says that it integrates with other password managers.
knaik94 4y ago
I realized I got prompted to start an enroll for this yesterday after reading this webpage. I reacted exactly like this first bullet point: "Some users may be surprised if a biometric authentication suddenly appears on a website or an app and think this is sending sensitive information to the server. With passkeys, the user's biometric information is never revealed to the website or the app. Biometric material never leaves the user's personal device." Having a notification asking me to enable Bluetooth immediately concerned me even though it was clearly the genuine prompt you get get when Google asks you to sign-in by accepting a prompt on a phone. I don't see myself using this authentication over pass+2factor even though it should be safer because of 2 main reasons. I avoid turning or keeping Bluetooth on and I don't see a clear way to manually control and export the passkey private key. I understand that it's synced via the OS and Google's password manager, but I don't trust it unless I can back it up and restore it to a device myself. Is there an open, Google independent implementation like Aegis is for 2 factor? If I can't control and manage my private keys, it's not my private keys. The more I read about this, the less this feels like an improvement to pass+2 factor. Phishing attempts are easier because Banks don't allow non-sms tied 2 factor authentication. Thinking of this like SSH key based authentication for website made the value of this clear for me. But I don't want my passkey dependent on my Google login. https://developers.google.com/identity/passkeys https://developers.google.com/identity/passkeys
- stetrain 4y ago
  Nothing about passkeys needs to be tied to Google. You can use other password managers, and it seems like the major players are all supporting the same standard. For example you can use 1Password: https://www.future.1password.com/passkeys/ https://www.future.1password.com/passkeys/ If they can do it, other password managers both cloud and local should be able to do this as well.
  - knaik94 4y ago
    I look forward to that, but as it stands currently, only Google and Apple's password managers are supported. All of the support documents mention its tied to the OS and linux support isn't planned. The table on this page shows there are no plans of "Local user verification" or "Passkey sync" when using Linux. Additionally it also states that to access the passkey, you need to log in to the given Google account. "Passkeys generated in Chrome on Android are stored in the Google Password Manager. These passkeys are available on all other Android devices as long as Google Password Manager is available and the same user's Google account is signed in." https://developers.google.com/identity/passkeys/supported-environments#:~:text=support%20passkey%20autofill.-,Linux,by%20scanning%20a%20QR%20code https://developers.google.com/identity/passkeys/supported-en....
deleted 4y ago
[deleted]
nmeagent 4y ago
> With the latest version of Chrome, we're enabling passkeys on Windows 11, macOS, and Android. Notable absence of GNU/Linux. If I used chromium, I'd feel like even more of a second-class citizen.
TheBrokenRail 4y ago
This all seems really cool, but right now I'm just dreading when some site inevitably start forcing you to use it out of some misplaced desire to protect the user from themselves. It's my account, it should be my choice whether to make the security/convenience tradeoff. Sometimes I just want to use a plain password, stick it in my web browser, and forget about it.
baybal2 4y ago
kosherhurricane 4y ago
I have a novice question: If I create a new passkey using Chrome on a Mac, is that passkey stored in chrome (via google account) or on MacOS iCloud Keychain? Would I get to pick one or the other?
codedokode 4y ago
Password authentication is an example of bad UI design (they are hard to remember and easy to forget), but passkeys are not great either. They have at least three weak points: First, they are stored in a phone internal storage. This is not secure because phones have complicated software with large attack surface, and if an attacker finds a vulnerability, then they can gain access to all private keys on that device. If the phone is lost or stolen, then the keys can be recovered by reading phone's internal storage. Even if the keys are protected by a PIN, the PINs are usually short and can be easily bruteforced. If they are protected by a fingerprint or biometric lock then I assume that they are not encrypted at all. Second, to synchronize keys between devices, private keys are uploaded to Google's cloud [1]. The post metions that they are end-to-end encrypted, by doesn't specify any details. However, it says that the keys can be decrypted on a new device if the user provides a PIN or unlock pattern: > To recover the end-to-end encryption key, the user must provide the lock screen PIN, password, or pattern of another existing device that had access to those keys. This means that keys stored in Google cloud are either not encrypted or use weak encryption keys that can be easily bruteforced by Google. Third, synchronizing keys relies on Google's infrastructure. If you ever get banned from Google, you will lose the ability to synchronize keys, and maybe access to them as well. So instead of promoting secure, easy to use, vendor-independent, cheap hardware keys, Google suggests that everyone stores their private keys either in a Google cloud or on devices where Google has root access. I don't think that it's a great idea. [1] https://security.googleblog.com/2022/10/SecurityofPasskeysintheGooglePasswordManager.html https://security.googleblog.com/2022/10/SecurityofPasskeysin... Also, I don't like FIDO standard because it requires attestation of hardware keys and doesn't allow to use DIY keys for example.
- yencabulator 4y ago
  > PINs are usually short and can be easily bruteforced The tamperproof hardware compartment storing that data is supposed to rate limit the guesses (and maybe lock up after too many tries). Ask FBI how easy it has been guessing iPhone PINs.
greatgib 4y ago
Annoying points with passkey is that one way or another, your creds (ie the passkey) has to stay on your device/app or you are fucked. Good thing with password is that you can have it not stored on any device and just used when you need. Gives you plausible deniability. Also, now your chrome passkey/password manager has all your creds. Protected only with a single thing (password/biometry). Imagine your are at the Chinese or US border, and tsa is overreaching: with just your finger they can access to all your accounts: Facebook, twitter, Google, Dropbox, ... You can't temporary delete from a device and readd without redoing the whole setup with the website. To create a passkey on Chrome for Android, you need the Google Play services beta. Otherwise the call to navigator.credentials.create() below will fail. You see it the moment where apps and websites will not work without the Google play ecosystem just before they added a new lock in? Also, I can see in advance that most website will only accept a single passkey public key per account. So you can't have one on each of your devices or even easily randomly connect from different web browser to the same site.
- yencabulator 4y ago
  > Annoying points with passkey is that one way or another, your creds (ie the passkey) has to stay on your device/app or you are fucked. Good thing with password is that you can have it not stored on any device and just used when you need. The key is just a bunch of random data used as a cryptographic private key. You could make an authenticator that argon2id's a passphrase to generate the private key, to go back to the world of passwords. Meanwhile, the average person using passkeys will become immune to phishing.
- stetrain 4y ago
  Or use a third party password manager where you can export the keys to some other storage if you wish, or apply other security measures to access those keys?
- greatgib 4y ago
  Last but not least, now, even in private browsing the public key used could easily tell which device you are using.
chrismarlow9 4y ago
Look on the bright side: implementing, supporting, and fixing this over the next decade means job security for everyone here.
Shank 4y ago
I see a lot of negativity and skepticism in the comments, and I think it's worth saying quite strongly: if you're reading comments on Hacker News, you're a power user, and you already probably have a good password management system. Either you're superhuman and memorize thousands of different passwords per site, or you have a generator or other system for generating unique passwords and storing them. You may also have security keys, TOTP generation, and an innate ability not to be phished. The reality is the vast majority of the globe does not have any of these traits. People create bad passwords that are reused all the time. People willingly disable 2FA for convenience, or get phished. In attacks over the summer, we've seen people take bribes to just give over passwords and 2FA codes. Passkeys are predicated on a 2FA-by-default philosophy that solves a lot of real-world problems the vast majority of people have. This is a huge win for normal people who use an Android phone or an iPhone in the default configuration and just need to login to places. It may feel like it's too heavy of an instrument for you because your solution is more convenient and well-understood, but most people struggle with this on a day-to-day basis. In my book, passkeys are still not perfect, but they definitely are better than passwords for 99% of the world.
- josephcsible 4y ago
  We already have regular WebAuthn to fix that problem properly. Passkeys feel like a way to abuse WebAuthn to lock people into your ecosystem forever, on pain of losing all their online accounts.
- knaik94 4y ago
  If people are going to be using default settings, why not just push a lot harder to force non sms based 2FA? Salted password+2FA should practically match any security benefit being attributed to passkeys. My University forced the entire student and staff population to enroll in Duo 2FA a few years ago and staff/faculty can get a hardware key if they request one. 2FA is required at every single point a University login exists. Everyone just got used to it. I even have to use 2FA when logging in to the VPN using Cisco Anyconnect, there's a third field that says "Duo Action" and it used to say "Second Password" and the options are using a backup code or the word "push" to get a mobile notification. The fact that passkeys are supposed to replace password and TOTP feels like a security risk. I understand that the phone uses a security enclave or TPM along with a pin/pattern/biometrics to attest a valid 2FA unlock, having it be tied to a mobile phone feels incorrect. I understand that's how it's set up for the vast amount of people already, but shifting from potentially separate devices for TOTP and Pass to a single device for everything seems weaker. I understand that power users are not the target, but the issue of vendor/device lock based on attestation and not allowing DIY keys. Moving from a piece of information I know like a password, or even an SSH key/cert I print out, to a "password" of a private key even I am not allowed to read feels less secure. It's not a matter of convenience, it's a question of giving up control of key generation and syncing to a third party. From a standpoint of opsec, not having control of your private keys is a much bigger weakness relative to a compromised password. Changing passwords is trivial, but changing a device secured private key is impossible. Passkeys don't fix the bribes or 5$ wrench loophole [1]. Unless you force users to only use biometrics and pin/patterns are disabled, passkeys will have the same issues that passwords do. In a world where getting people to understand 2FA is hard, it feels short sighted to depend on Bluetooth protocol dependent authentication. Trying to get people to shift from the convenience of a password to the inconvenience of needing to mess with Bluetooth is going to be its own headache. When the topic of needing a superhuman memory to remember passwords comes up, I think of https://xkcd.com/936/ https://xkcd.com/936/ . The conspiracy theorist in me can imagine companies like Netflix forcing passkey reauth every 15 days in order to combat things like password sharing. I respectfully disagree and believe passkeys will serve mostly as an inconvenience for the world. I am struggling to see the use cases where passkeys are meaningfully better than passwords and 2FA unless the use passwords is completely discontinued. And phones would become an even bigger single point of failure. A broken phone would be the same as losing all of your 2FA keys, there would be no password to help demonstrate account ownership to support. [1] https://xkcd.com/538/ https://xkcd.com/538/
josephcsible 4y ago
A lot of people here aren't differentiating between WebAuthn, a good thing that basically solves phishing, and these new implementations of it, bad things that lock you into one vendor's ecosystem forever because you can't log into your accounts from other operating systems anymore.
- psanford 4y ago
  You are not locked in. You can create a passkey in ios, on an android phone and on your desktop for the same website. This is going to accelerate the adoption of WebAuthn across sites on the internet. I consider that to be very good. You can benefit from the better security that your accounts will get from WebAuthn without ever using a synchronizing passkey.
nigamanth 4y ago
I don't understand this, to be honest the more complicated it gets for the user, the more the user gets locked out by themselves. We need a simple username + password thing with an option for 2-factor authentication. Not a madness of lock screens, passkeys, and all this nonsense. Google shouldn't add this in Google Chrome.
aborsy 4y ago
The private keys are encrypted when synced from one device to another. The key for this encryption seems to be a short PIN or biometrics. Is that true? If yes, the platform provider can easily decrypt the encrypted keys on their servers. If not, what’s the other secret known only by the user that encrypts the passkeys in transit? I hope the option of a password is provided. Further, a closed source unverified password manager such as the iCloud Keychain doesn’t sound a great idea. I could use passkeys in Android (and if there is no external hardware key support), but not on Apple’s platform.
- stetrain 4y ago
  Apple supports third party password managers at the system level on iOS and as browser extensions in Safari.
- codedokode 4y ago
  > Is that true? It seems so. The article [1] mentions that you can copy the keys to a new device and you need only a backup stored in a Google cloud and PIN/unlock pattern which are easy to bruteforce: > In some cases, for example, when the older device was lost or damaged, users may need to recover the end-to-end encryption keys from a secure online backup. > To recover the end-to-end encryption key, the user must provide the lock screen PIN, password, or pattern of another existing device that had access to those keys. So it means that Google and their friends from government organizations will be able to decrypt cloud backups easily. [1] https://security.googleblog.com/2022/10/SecurityofPasskeysintheGooglePasswordManager.html https://security.googleblog.com/2022/10/SecurityofPasskeysin...
nunez 4y ago
for those concerned about vendor lock-in, 1password and others are working on ways to support passkey auth. it's an open standard.
- ohCh6zos 4y ago
  So far all of these solutions involve the cloud in some way, including 1password. Why would I store my passwords in the cloud?
pronlover723 4y ago
this entire comment section is so full of BS! People ranting about stuff they don't understand and coming up with random conspiracy theories that have no basis in reality PassKeys are NOT proprietary. They're a standard. You can implement it yourself if you want or use several other implementations not run by FAMG. Here's a video on how it works https://www.youtube.com/watch?v=SWocv4BhCNg https://www.youtube.com/watch?v=SWocv4BhCNg * Can I share the keys between chrome, firefox, and safari? You don't need to. That's not how it works. Chrome, Firefox, and Safari and every device will have a different key for the same service (see video) * How do I share keys between different types of devices? (mac, ios, android, windows) You don't. You authenticate and a new key is created on each device, possibly on each piece of software (Firefox, Chrome, Safari, App). To be more clear, when and if you decide to use a service from a new device or new browser you'll be asked if you want to login via passkey. If you have a passkey on another device you can (see video) use that to login from the other device (similar to how google asks viat the gmail app of you were trying to log into some other device or Apple asks across your device). After you authenticate you can then create a new passkey for this device/software you're using. This new passkey is separate from the previous passkey. You effectively have 2 passkeys now, one to login with one device/software, one to with a different device/software. (See video) * What happens if my devices are gone? You follow whatever recovery procedures the service has, just like if you forgot your password. * What happens if I want to change my login (email to a new email for example)? Unrelated. Your email is not shared with passkey. So login and set a new email * What's the difference between a password and passkey? A password can be use by any one from anywhere. A passkey can only be used with the piece of software/device it was associated with when created. A passkey is useless if stolen/leaked
- shortcake27 4y ago
  > What happens if my devices are gone? You follow whatever recovery procedures the service has, just like if you forgot your password Are you sure? If so, why? Passkeys are advertised as a replacement for username + password + 2FA. Current practices generally allow for a password to be reset via email, but not MFA, as half the point of MFA is to protect against password resets. So the reset process for a passkey can’t be the same as a password otherwise you don’t have “real” MFA. I feel that account recovery is either going to get a lot harder (eg KYC for what would have been previously been an email), or services will enforce additional data collection (eg phone number) to aid recovery. Neither of these are good.
psanford 4y ago
Passwords have had a good run but on the modern internet they are a failure. 99% of the population uses the same bad passwords everywhere. We've tried to get people to behave securely with passwords but it just doesn't work. Its not their fault! Humans did not evolve to remember long distinct random strings. It is unfair to expect humans to never be tricked into typing their password into the wrong website. Its time for something new. I think WebAuthn and passkeys have a real shot to let us finally move onto a better form of authentication than passwords. They have real security benefits and hopefully usability benefits. I know that there's a lot of distrust of Apple and Google here when it comes to passkeys. But seriously this is not a giant ploy to trick you into buying an iPhone/Android. You can use a yubikey on sites that support passkeys. You can use an opensource solokey. You can use a software based fido key. You can use a an opensource tpm-fido authenticator. There will be opensource passkey implementations that support roaming. The standards are all open and there's nothing blocking interoperability. This is not a locked-in ecosystem. We've given passwords a good long try. They served their purpose but now are showing a lot of downsides. We need to be serious about looking for better alternatives that serve our end users. Passkeys is a good attempt at that. Lets give it a shot.
- knaik94 4y ago
  The current implementation shows that there is already an issue of openness. Requiring Apple or Google's password manager to manage and sync the passkeys is an issue. Google explicitly stating there is no planned support for "Local user verification" or "Passkey sync" shows they don't plan on support interoperability. A company following proper password hashing protocol means that repeat passwords isn't an issue. Pushing for 2FA using TOPT/HOTP protects people who reuse passwords and accidentally has one compromised. Until open source, free roaming, implementations of passkeys exist that expose the private key to the end user, it's effectively a locked-in ecosystem. I still haven't seen a good reason to replace tried and tested pass+2fa with passkeys. A simple push to force non-sms 2FA is an existing solution to the problem passkeys is attempting to solve. A compromised password is much less valuable now than it was even a few years ago. Even if you miss when a password was compromised, companies that care about security have started sending those "a new login was detected" emails that would alert you of any concerning activity.
Tigress8780 4y ago
While WebAuthn is an open standard, but the fact that it explicitly provides attestation API [1][2] and related database that can be used to verify devices [3] is already worrying. Site owners really have the option to lock you into one or a dozen of ecosystems should they decide to. It is entirely possible that your home-made hardware key or software password manager will be disallowed from logging into Google or Apple. For example, Cloudflare actively uses the attestation feature [4] to replace captchas, and they probably only allow a few manufacturers. [1] https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Attestation_and_Assertion https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent... [2] https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Attestation.html https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Gu... [3] https://fidoalliance.org/metadata/ https://fidoalliance.org/metadata/ [4] https://blog.cloudflare.com/introducing-cryptographic-attestation-of-personhood/ https://blog.cloudflare.com/introducing-cryptographic-attest...
thedougd 4y ago
I have research to do, but I've been struggling a bit with the introduction of iCloud sync for WebAuthN. I was excited to offer WebAuthN as a method for 2FA/MFA to replace the use of phone apps, OTP, etc. However, now it seems that both the WebAuthN secret and the password could both be synced to iCloud. Now I we to worry about employees syncing both factors to iCloud and properly securing their iCloud accounts? That's not good and will almost certainly require new intrusive controls.

120 points by aborsy 4y ago

fud101 4y ago

does this work with yubikeys?

deleted 4y ago
[deleted]
ac50hz 4y ago
Yes, https://passkey.org/ https://passkey.org/

tedd4u 4y ago

Good to see this. Apple's WWDC video on Passkeys [1] has a good explanation of how passkeys work, including the nifty feature where you can use your phone to log in on a laptop without the laptop getting your credentials. [1] https://developer.apple.com/videos/play/wwdc2022/10092/ https://developer.apple.com/videos/play/wwdc2022/10092/

kccqzy 4y ago
And what's more nifty is that the phone can be Android or iOS, the laptop can be Windows or macOS and it will all work.
- knaik94 4y ago
  How is that different from password+2 factor? Logging-in is already platform independent.
  - yencabulator 4y ago
    Webauthn is immune to phishing. The message sent to the server cryptographically depends on the target domain. With Webauthn, you can't be fooled into typing your password+2factor into gmai1.com.
  - stetrain 4y ago
    Password+2 factor sends your password across the wire to the website, and trusts that website and the path between to handle it securely and not store or log it anywhere. Passkey never sends your private key to the website you are signing in to.
    - knaik94 4y ago
      That's the purpose of the 2 factor. The "private key" used to generate the 5/6 digit pin stays on my device and isn't transmitted.
      - stetrain 4y ago
        Well what if we got rid of the password and just used the private key part?
        knaik94 4y ago
        That's how SSH commits work on github. It's an option, but for complete multi-factor security passwords take care of the "something you know" factor. The factors "something you know" like a password, "something you are" like biometrics, along with "something you have" like a hardware authenticator that implements TOTP/HOTP.
        stetrain 4y ago
        But modern password best practices require long, unique passwords for each website. Most users either don’t follow this, or use a password manager. If you use a password manager, the “something you know” has become just another “something you have” like an SSH or 2 factor key. Basically for good security practices, passwords are converging on becoming SSH keys except less secure since you trust the website (or any device that isn’t yours that you type them into) to not leak them. At that point, what value is the password providing when you are always pairing it with an actual private key challenge?
        4y ago
knaik94 4y ago
I don't see why I should be worried about storing and using credentials on my own devices. What would be the point, what threat does it protect against, and in what way is it more useful than using OAuth 2.0 "sign in with" feature?
- taftster 4y ago
  Logging into devices you don't own, for example.
  - knaik94 4y ago
    I log in to devices I don't own using a password+2factor. I have a long but memorable password that I just type in. I don't have some obtuse password where I require a password manager to log-in, I refuse to use the suggested password that chrome generates. What is the point of a password I don't remember? I am going to link this helpful xkcd comic https://xkcd.com/936/ https://xkcd.com/936/ that was published August 10, 2011 that is still relevant.
    - stetrain 4y ago
      If you type your password into a device you don’t own, what value is left in the password? Shouldn’t you basically consider it compromised at that point? If you rely on remembering your passwords, do you also keep them unique for every website?
      - brookst 4y ago
        It’s easy to have memorable and unique passwords for every website. You just create a personal hash algorithm to derive a password from the site name. For instance: number of letters in site name + second letter of site name in caps + last letter of site name + number of repeat letters in site name + (! if even number of letters, * if odd) + capitalized first letter google.com = 6Oe1!G bestbuy.com = 7Ey0*B Longer rules than that, but once you remember than you can derive the password for any site. If an adversary gets a few of your passwords and the sites they’re for, it would be easy to crack the rules. But that’s not an attack vector that typical hackers are exploring.
FeistySkink 4y ago
What's wrong with any of the existing methods of logging into my laptop?
- deleted 4y ago
  [deleted]

zagrebian 4y ago

I hope Firefox gets this soon.

josephg 4y ago

Any updates on passkey support in Firefox? Firefox seems to (still) only support hardware keys. (FF 107 / MacOS) https://webauthn.io/ https://webauthn.io/

evolve2k 4y ago

I’m very glad to see passkeys coming especially for the contribution they make to improving user experience. Concerned for the “Big tech” vendor lock-in this will likely facilitate. Anyone played with this in Chrome yet? How hard will it be to migrate away from Chrome with this in place?

tryptophan 4y ago
I also think passkeys are great and the future...but the issue of who controls the keys is really important to resolve. If chrome holds them and never lets you export...then those accounts are not yours. They are Google's. No thanks.
knaik94 4y ago
I think I got a prompt for this yesterday on a Google account, I was logging into an incognito window while connected to a VPN. I am staying away from enabling because it's not clear how to manage the private and public keys myself.

abdullahkhalids 4y ago

What is interoperability like and does Chrome employ open standards? If I generate a key in Chromium, can I use it in some other browser that supports passkeys?

cokeandpepsi 4y ago
It's mostly WebAuthn isn'it it?
josephg 4y ago
You can noodle around with it on https://webauthn.io/ https://webauthn.io/ . Keys will sync within ecosystems - so, if you login with safari on iOS, the same credentials show up on desktop Safari on a mac. That doesn't seem to work between Chrome and Safari, but you can scan a QR code to sign in on chrome using a passkey on your phone. Right now I'm not sure if this stuff good enough to use instead of passwords. I'd want Firefox support, and preferably built in support in 1Password too. But it might be good enough to use alongside passwords. We need to collectively figure out how to do that. (Do you get a password and a passkey? Or just a passkey & reset via email? How should the user flows work? Any good examples?)

RjQoLCOSwiIKfpm 4y ago

"A passkey doesn't leave your mobile device when signing in like this. Only a securely generated code is exchanged with the site so, unlike a password, there's nothing that could be leaked." How to circumvent this in order to store the "passkey" in a regular password manager on the same desktop machine, not an external mobile device, so you can do proper backups of it and need no secondary device? NOTICE: I am aware of the security implications. I don't care about them. I don't want any locked-down hardware to prevent me from accessing my own keys. I want control of my own keys.

aiiane 4y ago
You don't have to use a mobile device; you can just generate a passkey on a desktop machine.
- punk_ihaq 4y ago
  Unless you're using Linux. https://developers.google.com/identity/passkeys/supported-environments#linux https://developers.google.com/identity/passkeys/supported-en...
  - psanford 4y ago
    You can use an opensource fido key implementation on linux though.
ganbatekudasai 4y ago
It sounds like you just want to continue randomly generated passwords, instead of passkeys? They seem to already solve exactly your problem?
- RjQoLCOSwiIKfpm 4y ago
  Yes. But Google wants people to make a "transition", so I assume they will not allow passwords at some point in the future.

NikolaNovak 4y ago

I don't understood this. I keep not understanding this. What's my basic authentication method to a site or system I can write down, backup, export or memorize? What happens if I go naked to a friend and want to use their devices to access my systems? What happens if I lose one or more of my existing devices? What happens if I get locked out of one or more of my devices? Basically am I the only one who doesn't think phone is my life and I don't want my life to be over if I lose my phone? I feel like I'm in a twilight zone of phone dependencies. Already so many systems refuse to let me in if I don't have my phone with me due to sms 2fa I didn't ask for, even though I have dozen other devices and valid credentials. Now we just want to stop pretending and just lock me in to phone forever? My phone goes with me everywhere I go and is super likely to get lose broken or stolen. I don't want it to be a dependency to my online access.

p-e-w 4y ago
> What's my basic authentication method to a site or system I can write down, backup, export or memorize? There isn't one. This is by design. Logging into your bank or email provider will in the future require mobile device shenanigans that are either proprietary or so complex and opaque that you have no chance of "controlling" anything, or even really understanding what's actually going on. The main lobby driving this forward consists of Google, Apple, and Microsoft. This should tell you all you need to know.
- stetrain 4y ago
  Which part of passkeys / Webauthn / FIDO requires a mobile device?
  - p-e-w 4y ago
    In principle, none. In practice, many websites will check the user agent and flat out refuse service unless it's one of a pre-approved list of implementations, regardless of whether it would work or not. This has been happening for a long, long time already, for many browser features, and such "standards" pushed forward by the major mobile vendors will only make the problem worse.

vouaobrasil 4y ago

The problem with passkeys is that you need your phone to use them. The more it is adopted, the more likely technology will only work with them in the future. Thus, we will be more tied to our mobile devices. No thanks.

deleted 4y ago
[deleted]
stetrain 4y ago
Why does it need a phone? It's like SSH keys, you just need access to your keys from where you are logging in. They give the example of using your phone because that's a convenient portable key vault you may have with you. But if you want to keep your keys just on a desktop or in some other password manager that integrates with the browser I don't see any barrier to that. 1Password for example has already announced passkey support.
- vouaobrasil 4y ago
  Hmm, I didn't know that. Thanks! When I watched Apple's video on passkeys, it seemed to imply a phone was needed.
encryptluks2 4y ago
I don't believe you do. You just need an app that supports passkeys, but I could be wrong. The notice says that it integrates with other password managers.

knaik94 4y ago

I realized I got prompted to start an enroll for this yesterday after reading this webpage. I reacted exactly like this first bullet point: "Some users may be surprised if a biometric authentication suddenly appears on a website or an app and think this is sending sensitive information to the server. With passkeys, the user's biometric information is never revealed to the website or the app. Biometric material never leaves the user's personal device." Having a notification asking me to enable Bluetooth immediately concerned me even though it was clearly the genuine prompt you get get when Google asks you to sign-in by accepting a prompt on a phone. I don't see myself using this authentication over pass+2factor even though it should be safer because of 2 main reasons. I avoid turning or keeping Bluetooth on and I don't see a clear way to manually control and export the passkey private key. I understand that it's synced via the OS and Google's password manager, but I don't trust it unless I can back it up and restore it to a device myself. Is there an open, Google independent implementation like Aegis is for 2 factor? If I can't control and manage my private keys, it's not my private keys. The more I read about this, the less this feels like an improvement to pass+2 factor. Phishing attempts are easier because Banks don't allow non-sms tied 2 factor authentication. Thinking of this like SSH key based authentication for website made the value of this clear for me. But I don't want my passkey dependent on my Google login. https://developers.google.com/identity/passkeys https://developers.google.com/identity/passkeys

stetrain 4y ago
Nothing about passkeys needs to be tied to Google. You can use other password managers, and it seems like the major players are all supporting the same standard. For example you can use 1Password: https://www.future.1password.com/passkeys/ https://www.future.1password.com/passkeys/ If they can do it, other password managers both cloud and local should be able to do this as well.
- knaik94 4y ago
  I look forward to that, but as it stands currently, only Google and Apple's password managers are supported. All of the support documents mention its tied to the OS and linux support isn't planned. The table on this page shows there are no plans of "Local user verification" or "Passkey sync" when using Linux. Additionally it also states that to access the passkey, you need to log in to the given Google account. "Passkeys generated in Chrome on Android are stored in the Google Password Manager. These passkeys are available on all other Android devices as long as Google Password Manager is available and the same user's Google account is signed in." https://developers.google.com/identity/passkeys/supported-environments#:~:text=support%20passkey%20autofill.-,Linux,by%20scanning%20a%20QR%20code https://developers.google.com/identity/passkeys/supported-en....

deleted 4y ago

[deleted]

nmeagent 4y ago

> With the latest version of Chrome, we're enabling passkeys on Windows 11, macOS, and Android. Notable absence of GNU/Linux. If I used chromium, I'd feel like even more of a second-class citizen.

TheBrokenRail 4y ago

This all seems really cool, but right now I'm just dreading when some site inevitably start forcing you to use it out of some misplaced desire to protect the user from themselves. It's my account, it should be my choice whether to make the security/convenience tradeoff. Sometimes I just want to use a plain password, stick it in my web browser, and forget about it.

baybal2 4y ago

kosherhurricane 4y ago

I have a novice question: If I create a new passkey using Chrome on a Mac, is that passkey stored in chrome (via google account) or on MacOS iCloud Keychain? Would I get to pick one or the other?

codedokode 4y ago

Password authentication is an example of bad UI design (they are hard to remember and easy to forget), but passkeys are not great either. They have at least three weak points: First, they are stored in a phone internal storage. This is not secure because phones have complicated software with large attack surface, and if an attacker finds a vulnerability, then they can gain access to all private keys on that device. If the phone is lost or stolen, then the keys can be recovered by reading phone's internal storage. Even if the keys are protected by a PIN, the PINs are usually short and can be easily bruteforced. If they are protected by a fingerprint or biometric lock then I assume that they are not encrypted at all. Second, to synchronize keys between devices, private keys are uploaded to Google's cloud [1]. The post metions that they are end-to-end encrypted, by doesn't specify any details. However, it says that the keys can be decrypted on a new device if the user provides a PIN or unlock pattern: > To recover the end-to-end encryption key, the user must provide the lock screen PIN, password, or pattern of another existing device that had access to those keys. This means that keys stored in Google cloud are either not encrypted or use weak encryption keys that can be easily bruteforced by Google. Third, synchronizing keys relies on Google's infrastructure. If you ever get banned from Google, you will lose the ability to synchronize keys, and maybe access to them as well. So instead of promoting secure, easy to use, vendor-independent, cheap hardware keys, Google suggests that everyone stores their private keys either in a Google cloud or on devices where Google has root access. I don't think that it's a great idea. [1] https://security.googleblog.com/2022/10/SecurityofPasskeysintheGooglePasswordManager.html https://security.googleblog.com/2022/10/SecurityofPasskeysin... Also, I don't like FIDO standard because it requires attestation of hardware keys and doesn't allow to use DIY keys for example.

yencabulator 4y ago
> PINs are usually short and can be easily bruteforced The tamperproof hardware compartment storing that data is supposed to rate limit the guesses (and maybe lock up after too many tries). Ask FBI how easy it has been guessing iPhone PINs.

greatgib 4y ago

Annoying points with passkey is that one way or another, your creds (ie the passkey) has to stay on your device/app or you are fucked. Good thing with password is that you can have it not stored on any device and just used when you need. Gives you plausible deniability. Also, now your chrome passkey/password manager has all your creds. Protected only with a single thing (password/biometry). Imagine your are at the Chinese or US border, and tsa is overreaching: with just your finger they can access to all your accounts: Facebook, twitter, Google, Dropbox, ... You can't temporary delete from a device and readd without redoing the whole setup with the website. To create a passkey on Chrome for Android, you need the Google Play services beta. Otherwise the call to navigator.credentials.create() below will fail. You see it the moment where apps and websites will not work without the Google play ecosystem just before they added a new lock in? Also, I can see in advance that most website will only accept a single passkey public key per account. So you can't have one on each of your devices or even easily randomly connect from different web browser to the same site.

yencabulator 4y ago
> Annoying points with passkey is that one way or another, your creds (ie the passkey) has to stay on your device/app or you are fucked. Good thing with password is that you can have it not stored on any device and just used when you need. The key is just a bunch of random data used as a cryptographic private key. You could make an authenticator that argon2id's a passphrase to generate the private key, to go back to the world of passwords. Meanwhile, the average person using passkeys will become immune to phishing.
stetrain 4y ago
Or use a third party password manager where you can export the keys to some other storage if you wish, or apply other security measures to access those keys?
greatgib 4y ago
Last but not least, now, even in private browsing the public key used could easily tell which device you are using.

chrismarlow9 4y ago

Look on the bright side: implementing, supporting, and fixing this over the next decade means job security for everyone here.

Shank 4y ago

I see a lot of negativity and skepticism in the comments, and I think it's worth saying quite strongly: if you're reading comments on Hacker News, you're a power user, and you already probably have a good password management system. Either you're superhuman and memorize thousands of different passwords per site, or you have a generator or other system for generating unique passwords and storing them. You may also have security keys, TOTP generation, and an innate ability not to be phished. The reality is the vast majority of the globe does not have any of these traits. People create bad passwords that are reused all the time. People willingly disable 2FA for convenience, or get phished. In attacks over the summer, we've seen people take bribes to just give over passwords and 2FA codes. Passkeys are predicated on a 2FA-by-default philosophy that solves a lot of real-world problems the vast majority of people have. This is a huge win for normal people who use an Android phone or an iPhone in the default configuration and just need to login to places. It may feel like it's too heavy of an instrument for you because your solution is more convenient and well-understood, but most people struggle with this on a day-to-day basis. In my book, passkeys are still not perfect, but they definitely are better than passwords for 99% of the world.

josephcsible 4y ago
We already have regular WebAuthn to fix that problem properly. Passkeys feel like a way to abuse WebAuthn to lock people into your ecosystem forever, on pain of losing all their online accounts.
knaik94 4y ago
If people are going to be using default settings, why not just push a lot harder to force non sms based 2FA? Salted password+2FA should practically match any security benefit being attributed to passkeys. My University forced the entire student and staff population to enroll in Duo 2FA a few years ago and staff/faculty can get a hardware key if they request one. 2FA is required at every single point a University login exists. Everyone just got used to it. I even have to use 2FA when logging in to the VPN using Cisco Anyconnect, there's a third field that says "Duo Action" and it used to say "Second Password" and the options are using a backup code or the word "push" to get a mobile notification. The fact that passkeys are supposed to replace password and TOTP feels like a security risk. I understand that the phone uses a security enclave or TPM along with a pin/pattern/biometrics to attest a valid 2FA unlock, having it be tied to a mobile phone feels incorrect. I understand that's how it's set up for the vast amount of people already, but shifting from potentially separate devices for TOTP and Pass to a single device for everything seems weaker. I understand that power users are not the target, but the issue of vendor/device lock based on attestation and not allowing DIY keys. Moving from a piece of information I know like a password, or even an SSH key/cert I print out, to a "password" of a private key even I am not allowed to read feels less secure. It's not a matter of convenience, it's a question of giving up control of key generation and syncing to a third party. From a standpoint of opsec, not having control of your private keys is a much bigger weakness relative to a compromised password. Changing passwords is trivial, but changing a device secured private key is impossible. Passkeys don't fix the bribes or 5$ wrench loophole [1]. Unless you force users to only use biometrics and pin/patterns are disabled, passkeys will have the same issues that passwords do. In a world where getting people to understand 2FA is hard, it feels short sighted to depend on Bluetooth protocol dependent authentication. Trying to get people to shift from the convenience of a password to the inconvenience of needing to mess with Bluetooth is going to be its own headache. When the topic of needing a superhuman memory to remember passwords comes up, I think of https://xkcd.com/936/ https://xkcd.com/936/ . The conspiracy theorist in me can imagine companies like Netflix forcing passkey reauth every 15 days in order to combat things like password sharing. I respectfully disagree and believe passkeys will serve mostly as an inconvenience for the world. I am struggling to see the use cases where passkeys are meaningfully better than passwords and 2FA unless the use passwords is completely discontinued. And phones would become an even bigger single point of failure. A broken phone would be the same as losing all of your 2FA keys, there would be no password to help demonstrate account ownership to support. [1] https://xkcd.com/538/ https://xkcd.com/538/

josephcsible 4y ago

A lot of people here aren't differentiating between WebAuthn, a good thing that basically solves phishing, and these new implementations of it, bad things that lock you into one vendor's ecosystem forever because you can't log into your accounts from other operating systems anymore.

psanford 4y ago
You are not locked in. You can create a passkey in ios, on an android phone and on your desktop for the same website. This is going to accelerate the adoption of WebAuthn across sites on the internet. I consider that to be very good. You can benefit from the better security that your accounts will get from WebAuthn without ever using a synchronizing passkey.

nigamanth 4y ago

I don't understand this, to be honest the more complicated it gets for the user, the more the user gets locked out by themselves. We need a simple username + password thing with an option for 2-factor authentication. Not a madness of lock screens, passkeys, and all this nonsense. Google shouldn't add this in Google Chrome.

aborsy 4y ago

The private keys are encrypted when synced from one device to another. The key for this encryption seems to be a short PIN or biometrics. Is that true? If yes, the platform provider can easily decrypt the encrypted keys on their servers. If not, what’s the other secret known only by the user that encrypts the passkeys in transit? I hope the option of a password is provided. Further, a closed source unverified password manager such as the iCloud Keychain doesn’t sound a great idea. I could use passkeys in Android (and if there is no external hardware key support), but not on Apple’s platform.

stetrain 4y ago
Apple supports third party password managers at the system level on iOS and as browser extensions in Safari.
codedokode 4y ago
> Is that true? It seems so. The article [1] mentions that you can copy the keys to a new device and you need only a backup stored in a Google cloud and PIN/unlock pattern which are easy to bruteforce: > In some cases, for example, when the older device was lost or damaged, users may need to recover the end-to-end encryption keys from a secure online backup. > To recover the end-to-end encryption key, the user must provide the lock screen PIN, password, or pattern of another existing device that had access to those keys. So it means that Google and their friends from government organizations will be able to decrypt cloud backups easily. [1] https://security.googleblog.com/2022/10/SecurityofPasskeysintheGooglePasswordManager.html https://security.googleblog.com/2022/10/SecurityofPasskeysin...

nunez 4y ago

for those concerned about vendor lock-in, 1password and others are working on ways to support passkey auth. it's an open standard.

ohCh6zos 4y ago
So far all of these solutions involve the cloud in some way, including 1password. Why would I store my passwords in the cloud?

pronlover723 4y ago

this entire comment section is so full of BS! People ranting about stuff they don't understand and coming up with random conspiracy theories that have no basis in reality PassKeys are NOT proprietary. They're a standard. You can implement it yourself if you want or use several other implementations not run by FAMG. Here's a video on how it works https://www.youtube.com/watch?v=SWocv4BhCNg https://www.youtube.com/watch?v=SWocv4BhCNg * Can I share the keys between chrome, firefox, and safari? You don't need to. That's not how it works. Chrome, Firefox, and Safari and every device will have a different key for the same service (see video) * How do I share keys between different types of devices? (mac, ios, android, windows) You don't. You authenticate and a new key is created on each device, possibly on each piece of software (Firefox, Chrome, Safari, App). To be more clear, when and if you decide to use a service from a new device or new browser you'll be asked if you want to login via passkey. If you have a passkey on another device you can (see video) use that to login from the other device (similar to how google asks viat the gmail app of you were trying to log into some other device or Apple asks across your device). After you authenticate you can then create a new passkey for this device/software you're using. This new passkey is separate from the previous passkey. You effectively have 2 passkeys now, one to login with one device/software, one to with a different device/software. (See video) * What happens if my devices are gone? You follow whatever recovery procedures the service has, just like if you forgot your password. * What happens if I want to change my login (email to a new email for example)? Unrelated. Your email is not shared with passkey. So login and set a new email * What's the difference between a password and passkey? A password can be use by any one from anywhere. A passkey can only be used with the piece of software/device it was associated with when created. A passkey is useless if stolen/leaked

shortcake27 4y ago
> What happens if my devices are gone? You follow whatever recovery procedures the service has, just like if you forgot your password Are you sure? If so, why? Passkeys are advertised as a replacement for username + password + 2FA. Current practices generally allow for a password to be reset via email, but not MFA, as half the point of MFA is to protect against password resets. So the reset process for a passkey can’t be the same as a password otherwise you don’t have “real” MFA. I feel that account recovery is either going to get a lot harder (eg KYC for what would have been previously been an email), or services will enforce additional data collection (eg phone number) to aid recovery. Neither of these are good.

psanford 4y ago

Passwords have had a good run but on the modern internet they are a failure. 99% of the population uses the same bad passwords everywhere. We've tried to get people to behave securely with passwords but it just doesn't work. Its not their fault! Humans did not evolve to remember long distinct random strings. It is unfair to expect humans to never be tricked into typing their password into the wrong website. Its time for something new. I think WebAuthn and passkeys have a real shot to let us finally move onto a better form of authentication than passwords. They have real security benefits and hopefully usability benefits. I know that there's a lot of distrust of Apple and Google here when it comes to passkeys. But seriously this is not a giant ploy to trick you into buying an iPhone/Android. You can use a yubikey on sites that support passkeys. You can use an opensource solokey. You can use a software based fido key. You can use a an opensource tpm-fido authenticator. There will be opensource passkey implementations that support roaming. The standards are all open and there's nothing blocking interoperability. This is not a locked-in ecosystem. We've given passwords a good long try. They served their purpose but now are showing a lot of downsides. We need to be serious about looking for better alternatives that serve our end users. Passkeys is a good attempt at that. Lets give it a shot.

knaik94 4y ago
The current implementation shows that there is already an issue of openness. Requiring Apple or Google's password manager to manage and sync the passkeys is an issue. Google explicitly stating there is no planned support for "Local user verification" or "Passkey sync" shows they don't plan on support interoperability. A company following proper password hashing protocol means that repeat passwords isn't an issue. Pushing for 2FA using TOPT/HOTP protects people who reuse passwords and accidentally has one compromised. Until open source, free roaming, implementations of passkeys exist that expose the private key to the end user, it's effectively a locked-in ecosystem. I still haven't seen a good reason to replace tried and tested pass+2fa with passkeys. A simple push to force non-sms 2FA is an existing solution to the problem passkeys is attempting to solve. A compromised password is much less valuable now than it was even a few years ago. Even if you miss when a password was compromised, companies that care about security have started sending those "a new login was detected" emails that would alert you of any concerning activity.

Tigress8780 4y ago

While WebAuthn is an open standard, but the fact that it explicitly provides attestation API [1][2] and related database that can be used to verify devices [3] is already worrying. Site owners really have the option to lock you into one or a dozen of ecosystems should they decide to. It is entirely possible that your home-made hardware key or software password manager will be disallowed from logging into Google or Apple. For example, Cloudflare actively uses the attestation feature [4] to replace captchas, and they probably only allow a few manufacturers. [1] https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Attestation_and_Assertion https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent... [2] https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Attestation.html https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Gu... [3] https://fidoalliance.org/metadata/ https://fidoalliance.org/metadata/ [4] https://blog.cloudflare.com/introducing-cryptographic-attestation-of-personhood/ https://blog.cloudflare.com/introducing-cryptographic-attest...

thedougd 4y ago

I have research to do, but I've been struggling a bit with the introduction of iCloud sync for WebAuthN. I was excited to offer WebAuthN as a method for 2FA/MFA to replace the use of phone apps, OTP, etc. However, now it seems that both the WebAuthN secret and the password could both be synced to iCloud. Now I we to worry about employees syncing both factors to iCloud and properly securing their iCloud accounts? That's not good and will almost certainly require new intrusive controls.