7 ms·

"A passkey doesn't leave your mobile device when signing in like this. Only a securely generated code is exchanged with the site so, unlike a password, there's

"A passkey doesn't leave your mobile device when signing in like this. Only a securely generated code is exchanged with the site so, unlike a password, there's nothing that could be leaked." How to circumvent this in order to store the "passkey" in a regular password manager on the same desktop machine, not an external mobile device, so you can do proper backups of it and need no secondary device? NOTICE: I am aware of the security implications. I don't care about them. I don't want any locked-down hardware to prevent me from accessing my own keys. I want control of my own keys.

aiiane 4y ago
You don't have to use a mobile device; you can just generate a passkey on a desktop machine.
- punk_ihaq 4y ago
  Unless you're using Linux. https://developers.google.com/identity/passkeys/supported-environments#linux https://developers.google.com/identity/passkeys/supported-en...
  - psanford 4y ago
    You can use an opensource fido key implementation on linux though.
ganbatekudasai 4y ago
It sounds like you just want to continue randomly generated passwords, instead of passkeys? They seem to already solve exactly your problem?
- RjQoLCOSwiIKfpm 4y ago
  Yes. But Google wants people to make a "transition", so I assume they will not allow passwords at some point in the future.
  - ganbatekudasai 4y ago
    If that is ever the case, which I honestly think is doubtful (though I could be wrong), given that it's an open standard, I don't think there's anything preventing people from writing a passkey implementation that saves the secret key material in a plain file or anything similar. It likely already exists.
    - Arnavion 4y ago
      Sure, but that works for passwords because you can copy-paste them from an external program. The WebAuthn API in question is built around using JS in the website's context to manipulate the passkey. [1] You have to hope that the browser gives a way for an external program to be involved in that JS API's implementation. Looking at KeepassXC's WebAuthn WIP implementation, it works by injecting JS into the website context that overrides the default JS API to its own implementation instead. [2] I don't see any API in the chrome extensions docs [3] that could be used to customize passkeys, so I assume 1Password's passkey implementation (mentioned in other comments in this thread) does the same thing. I sure hope the browsers don't decide to crack down on it by making the API uninterceptable in the name of security. [1]: https://web.dev/passkey-registration/#call-webauthn-api-to-create-a-passkey https://web.dev/passkey-registration/#call-webauthn-api-to-c... [2]: https://github.com/keepassxreboot/keepassxc-browser/commit/4f41255dc22133a7006f5c99b83e521b69c725dc#diff-7c02874f3604ceafcc3aee3a2f3da102983fdf9fe68a5a6c87afb1ac3e60d695R59 https://github.com/keepassxreboot/keepassxc-browser/commit/4... [3]: https://developer.chrome.com/docs/extensions/reference/ https://developer.chrome.com/docs/extensions/reference/
      - pas 4y ago
        use a browser that honors user freedom the whole problem boils down to this this thread is full of people already anxious of this new thing because they rightfully see this as one more step toward total loss of user control/freedom (which wouldn't be if people trusted their browser vendor, etc)
        Arnavion 4y ago
- Dylan16807 4y ago
  That doesn't prevent leaking, which can matter even if it's unique password.
  - ganbatekudasai 4y ago
    What does, under these constraints?
kpollls 4y ago
you could also buy a hardware key like a Yubikey
- RjQoLCOSwiIKfpm 4y ago
  "I don't want any locked-down hardware to prevent me from accessing my own keys."
punk_ihaq 4y ago
Linux users be damned: "Chrome on Linux doesn't support passkeys with a built-in platform authenticator. Linux users can use passkeys from another device such as an Android phone or an iPhone by scanning a QR code." No plans to support it either [1] https://developers.google.com/identity/passkeys/supported-environments#linux https://developers.google.com/identity/passkeys/supported-en...
- philistine 4y ago
  Considering the Linux weirdos have equated a secure enclave with an overreach of kafkaesque proportion into their computer, I wouldn't hold my breath.
  - punk_ihaq 4y ago
    That's an unfair, hasty generalization of people who use Linux.
- lll-o-lll 4y ago
  You just use your phone. Because otherwise you need a ton of OS integration to make this work, which I guess Linux doesn’t really care about (at least for now).
  - knaik94 4y ago
    I think black box OS integration defeats the point of security. If I can't access and manage the private keys myself, it's effectively a black box implementation.
    - p-e-w 4y ago
      Which is precisely the point of all this. You won't be able to log in to your bank without a smartphone, and since the bank's website will only be tested with Google's and Apple's implementations (which of course will slightly deviate from the actual standard), everyone who doesn't use those two platforms will be locked out.
lll-o-lll 4y ago
Google Password Manager, and the Apple equivalent, backup the passkeys for you. How they do this is fairly complicated. https://security.googleblog.com/2022/10/SecurityofPasskeysintheGooglePasswordManager.html https://security.googleblog.com/2022/10/SecurityofPasskeysin... You don’t have control of your keys exactly, but Google can’t see your keys either and you can survive device theft/failure and transfer to a new device. So it’s pretty good in my opinion.
- knaik94 4y ago
  If I don't control my keys, they are not my keys. It seems more limiting and worse in practice than what it's supposed to be improving on. Google already encrypts my password in password manager, it already can't see my password and can't generate my 2 factor. Being fairly complicated is not a good excuse to let Google manage the keys for me.
  - lll-o-lll 4y ago
    WebAuthn is a huge improvement from a security perspective. The private key is an anchor to a combination of factors. Proof of ownership (I have the device), proof of person (biometric) and/or proof of knowledge (pin code). Your password is not protected, it’s transmitted when you use it. If you’re infected with malware, that’s it, password exposed. With WebAuthn, nothing can be exposed.
    - knaik94 4y ago
      That is the purpose of 2 factor. 2 factor + password matches those same goals. I am not worried about transmitting my password on a device I own to a website I trust. If I am infected with malware, my 2 factor and separate login recovery email will keep me safe. I understand the theory of using SSH like public private keys to move one step away from passwords, but the reality is if I don't have control over the private keys, they are not my keys. Not having control over my private keys outweighs any benefits I would get from using WebAuthn.
    - codedokode 4y ago
stetrain 4y ago
1Password has announced support for PassKeys: https://www.future.1password.com/passkeys/ https://www.future.1password.com/passkeys/ It would make sense that other password managers could also manage PassKeys as long as they have an extension to integrate with the browser.
varjolintu 4y ago
KeePassXC already has a development branch where WebAuthn is supported in both extension and KeePassXC, so the keys will be stored to your database and can be exported/imported normally. The support needs to be extended and tested for Passkeys also. So yes, controlling your own keys is possible. Browsers just wanted users to use their own walled gardens.

aiiane 4y ago

You don't have to use a mobile device; you can just generate a passkey on a desktop machine.

punk_ihaq 4y ago
Unless you're using Linux. https://developers.google.com/identity/passkeys/supported-environments#linux https://developers.google.com/identity/passkeys/supported-en...
- psanford 4y ago
  You can use an opensource fido key implementation on linux though.

ganbatekudasai 4y ago

It sounds like you just want to continue randomly generated passwords, instead of passkeys? They seem to already solve exactly your problem?

RjQoLCOSwiIKfpm 4y ago
Yes. But Google wants people to make a "transition", so I assume they will not allow passwords at some point in the future.
- ganbatekudasai 4y ago
  If that is ever the case, which I honestly think is doubtful (though I could be wrong), given that it's an open standard, I don't think there's anything preventing people from writing a passkey implementation that saves the secret key material in a plain file or anything similar. It likely already exists.
  - Arnavion 4y ago
    Sure, but that works for passwords because you can copy-paste them from an external program. The WebAuthn API in question is built around using JS in the website's context to manipulate the passkey. [1] You have to hope that the browser gives a way for an external program to be involved in that JS API's implementation. Looking at KeepassXC's WebAuthn WIP implementation, it works by injecting JS into the website context that overrides the default JS API to its own implementation instead. [2] I don't see any API in the chrome extensions docs [3] that could be used to customize passkeys, so I assume 1Password's passkey implementation (mentioned in other comments in this thread) does the same thing. I sure hope the browsers don't decide to crack down on it by making the API uninterceptable in the name of security. [1]: https://web.dev/passkey-registration/#call-webauthn-api-to-create-a-passkey https://web.dev/passkey-registration/#call-webauthn-api-to-c... [2]: https://github.com/keepassxreboot/keepassxc-browser/commit/4f41255dc22133a7006f5c99b83e521b69c725dc#diff-7c02874f3604ceafcc3aee3a2f3da102983fdf9fe68a5a6c87afb1ac3e60d695R59 https://github.com/keepassxreboot/keepassxc-browser/commit/4... [3]: https://developer.chrome.com/docs/extensions/reference/ https://developer.chrome.com/docs/extensions/reference/
    - pas 4y ago
      use a browser that honors user freedom the whole problem boils down to this this thread is full of people already anxious of this new thing because they rightfully see this as one more step toward total loss of user control/freedom (which wouldn't be if people trusted their browser vendor, etc)
      - Arnavion 4y ago
Dylan16807 4y ago
That doesn't prevent leaking, which can matter even if it's unique password.
- ganbatekudasai 4y ago
  What does, under these constraints?

kpollls 4y ago

you could also buy a hardware key like a Yubikey

RjQoLCOSwiIKfpm 4y ago
"I don't want any locked-down hardware to prevent me from accessing my own keys."

punk_ihaq 4y ago

Linux users be damned: "Chrome on Linux doesn't support passkeys with a built-in platform authenticator. Linux users can use passkeys from another device such as an Android phone or an iPhone by scanning a QR code." No plans to support it either [1] https://developers.google.com/identity/passkeys/supported-environments#linux https://developers.google.com/identity/passkeys/supported-en...

philistine 4y ago
Considering the Linux weirdos have equated a secure enclave with an overreach of kafkaesque proportion into their computer, I wouldn't hold my breath.
- punk_ihaq 4y ago
  That's an unfair, hasty generalization of people who use Linux.
lll-o-lll 4y ago
You just use your phone. Because otherwise you need a ton of OS integration to make this work, which I guess Linux doesn’t really care about (at least for now).
- knaik94 4y ago
  I think black box OS integration defeats the point of security. If I can't access and manage the private keys myself, it's effectively a black box implementation.
  - p-e-w 4y ago
    Which is precisely the point of all this. You won't be able to log in to your bank without a smartphone, and since the bank's website will only be tested with Google's and Apple's implementations (which of course will slightly deviate from the actual standard), everyone who doesn't use those two platforms will be locked out.

lll-o-lll 4y ago

Google Password Manager, and the Apple equivalent, backup the passkeys for you. How they do this is fairly complicated. https://security.googleblog.com/2022/10/SecurityofPasskeysintheGooglePasswordManager.html https://security.googleblog.com/2022/10/SecurityofPasskeysin... You don’t have control of your keys exactly, but Google can’t see your keys either and you can survive device theft/failure and transfer to a new device. So it’s pretty good in my opinion.

knaik94 4y ago
If I don't control my keys, they are not my keys. It seems more limiting and worse in practice than what it's supposed to be improving on. Google already encrypts my password in password manager, it already can't see my password and can't generate my 2 factor. Being fairly complicated is not a good excuse to let Google manage the keys for me.
- lll-o-lll 4y ago
  WebAuthn is a huge improvement from a security perspective. The private key is an anchor to a combination of factors. Proof of ownership (I have the device), proof of person (biometric) and/or proof of knowledge (pin code). Your password is not protected, it’s transmitted when you use it. If you’re infected with malware, that’s it, password exposed. With WebAuthn, nothing can be exposed.
  - knaik94 4y ago
    That is the purpose of 2 factor. 2 factor + password matches those same goals. I am not worried about transmitting my password on a device I own to a website I trust. If I am infected with malware, my 2 factor and separate login recovery email will keep me safe. I understand the theory of using SSH like public private keys to move one step away from passwords, but the reality is if I don't have control over the private keys, they are not my keys. Not having control over my private keys outweighs any benefits I would get from using WebAuthn.
  - codedokode 4y ago

stetrain 4y ago

1Password has announced support for PassKeys: https://www.future.1password.com/passkeys/ https://www.future.1password.com/passkeys/ It would make sense that other password managers could also manage PassKeys as long as they have an extension to integrate with the browser.

varjolintu 4y ago

KeePassXC already has a development branch where WebAuthn is supported in both extension and KeePassXC, so the keys will be stored to your database and can be exported/imported normally. The support needs to be extended and tested for Passkeys also. So yes, controlling your own keys is possible. Browsers just wanted users to use their own walled gardens.