6 ms·

I don't understood this. I keep not understanding this. What's my basic authentication method to a site or system I can write down, backup, export or memorize?

I don't understood this. I keep not understanding this. What's my basic authentication method to a site or system I can write down, backup, export or memorize? What happens if I go naked to a friend and want to use their devices to access my systems? What happens if I lose one or more of my existing devices? What happens if I get locked out of one or more of my devices? Basically am I the only one who doesn't think phone is my life and I don't want my life to be over if I lose my phone? I feel like I'm in a twilight zone of phone dependencies. Already so many systems refuse to let me in if I don't have my phone with me due to sms 2fa I didn't ask for, even though I have dozen other devices and valid credentials. Now we just want to stop pretending and just lock me in to phone forever? My phone goes with me everywhere I go and is super likely to get lose broken or stolen. I don't want it to be a dependency to my online access.

p-e-w 4y ago
> What's my basic authentication method to a site or system I can write down, backup, export or memorize? There isn't one. This is by design. Logging into your bank or email provider will in the future require mobile device shenanigans that are either proprietary or so complex and opaque that you have no chance of "controlling" anything, or even really understanding what's actually going on. The main lobby driving this forward consists of Google, Apple, and Microsoft. This should tell you all you need to know.
- stetrain 4y ago
  Which part of passkeys / Webauthn / FIDO requires a mobile device?
  - p-e-w 4y ago
    In principle, none. In practice, many websites will check the user agent and flat out refuse service unless it's one of a pre-approved list of implementations, regardless of whether it would work or not. This has been happening for a long, long time already, for many browser features, and such "standards" pushed forward by the major mobile vendors will only make the problem worse.
    - stetrain 4y ago
      Well if we're making up things that websites haven't done yet then yeah I'm angry too.
  - ajvs 4y ago
    Unless you're using one of the proprietary desktop OSes then you have to use one of the proprietary mobile OSes. https://developers.google.com/identity/passkeys/supported-environments#linux https://developers.google.com/identity/passkeys/supported-en...
    - stetrain 4y ago
      Assuming desktop Chrome doesn’t support third party password managers like 1Password and Lastpass that are similarly part of the FIDO alliance. Passkeys aren’t a Chrome feature they’re a Webauthn feature. So if Chrome doesn’t provide the features you want on your platform you should be able to use another browser / password manager combo that does.
    - psanford 4y ago
      No you do not need to use anything proprietary to use WebAuthn. There are open source software[0] and hardware keys[1]. [0]: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido [1]: https://solokeys.com/ https://solokeys.com/
      - codedokode 4y ago
        WebAuthn supports attestation of key storage and site owners might choose not to trust keys coming from an unknown DIY device.
        psanford 4y ago
        Fortunately that feature isn't used outside of enterprise environments. Apple's passkeys don't support it so there will not be any mainstream adoption for requiring an attestation cert.
- mynameisvlad 4y ago
  What part of WebAuthn, a W3C standard, is "proprietary or [...] complex and opaque"? The FIDO alliance also consists of far more companies than just "Google, Apple, and Microsoft", although they're certainly members. https://fidoalliance.org/members/ https://fidoalliance.org/members/
  - p-e-w 4y ago
    > What part of WebAuthn, a W3C standard, is "proprietary or [...] complex and opaque"? Ask Mozilla. FIDO U2F is so complicated that Firefox support was hidden behind a config flag for a long time, then "a hard-coded permission for Google Accounts"[1] was implemented in order to not fall too far behind Chrome. The linked email thread is an eye-opener on how many intricacies and unresolved questions there are, with multiple mentions of non-standard behavior implemented in the Google ecosystem, undermining WebAuthn. This is how such "standards" work in practice, and passkeys will be no exception. [1] https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGTEA/m/lC834665BQAJ https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGT...
    - mynameisvlad 4y ago
      FIDO U2F is not WebAuthn, and if you had even bothered to skim the link you provided, you probably would have realized that considering: - they go out of their way to explicitly differentiate them, and - the entire discussion is about U2F and bringing in support for it in a limited sense so that people adopt WebAuthn instead of U2F. Like, did you even read the link you provided? So, again, what about WebAuthn is proprietary or complicated?
      - p-e-w 4y ago
        I'm not claiming they're the same. What matters is that U2F is what many websites implemented, which is why those problems arose in the first place. This time, websites will implement "Chrome passkeys", which will be almost-but-not-quite WebAuthn, just like Internet Explorer's box model was almost-but-not-quite CSS. If there are only two or three major players and the standard is sufficiently complex, "standard" becomes synonymous with "what iOS and Android do". But to answer your question: > So, again, what about WebAuthn is proprietary or complicated? The WebAuthn standard is 184 pages of A4 size. That's a technical document, the length of a typical novel. Are you seriously asking what's "complicated" about that?
stetrain 4y ago
Do you use SSH keys? This is SSH keys for signing into websites. Which, yes, means you need at least one device in your possession containing your private keys. 1Password has already announced support for storing and syncing passkeys. Apple and Google also allow you to sync them via your account. Nothing ties it specifically to your phone compared to any of your other devices or an online account/vault that you store your keys in.
- XorNot 4y ago
  I can print out my SSH key and store it in a safe, or freely copy it between systems. All of these services are intended to prevent that by using on device secure enclave functionality and the like - it puts control the keys out of my reach.
  - stetrain 4y ago
    But you should be able to use your own password manager that can export them if you choose. I could be wrong but I don't think the standard requires that the keys are stored out of user reach.
    - bakugo 4y ago
      > I could be wrong but I don't think the standard requires that the keys are stored out of user reach. It really doesn't matter what the standard requires when the most popular implementations belong to companies like Google or Apple, they will get to decide how it works.
      - stetrain 4y ago
        So you think Google and Apple will block third party password managers from providing passkeys to the browser?
        bakugo 4y ago
        Yes, I do.
FeistySkink 4y ago
I'm in the process of migrating to a new phone. My old phone had an eSIM that was tied to some 2FA (not by choice, and it couldn't be changed, because security), and my temp phone doesn't support an eSIM, so until the new one arrives I can't access some services. You don't even need to lose anything to be locked out.
- knaik94 4y ago
  Did you not keep any of the backup code? I am not sure why 2FA is related to the eSIM unless you mean certain services force using SMS as the method to receive 2FA. I have experienced that same restriction with financial services in the US. I agree, it's frustrating and feels counterproductive to security because it could motivate someone to borrow a friend's device temporarily to access the services. eSIMs are even more annoying as there is a limited amount of times you can switch devices.
  - philsnow 4y ago
    It is the very rare site or service that actually refuses to let you back in with an email confirmation or something. Sites with SMS 2FA / mobile app 2FA will nearly 100% of the time let you fall back to email. And why not? It's a huge support burden to do otherwise. You can say "we told you that you'd be locked out" and not even confirm to the user that an account exists with that user ID, but then half of the users who get locked out will complain about it on social media. You can only really enforce 2FA if your site has to do with money or similar.
    - knaik94 4y ago
      For major sites, FAMG having access to email is not enough in my experience. I was recently locked out of my Instagram account and lost my 2FA. Instagram required me to contact support from a known previously associated email, but on top of that I had to upload a picture of myself holding a piece of paper with a handwritten nonce and they checked against my previously uploaded pictures. I also had to wait a period of time before they would telling me what nonce to use and starting the verification process. I have heard stories of people not being let in and having to contact friends who work at Facebook and have access to the internal support queue. I know my friend had to do something similar at Google and have a friend make a internal support ticket when they were locked out of a gmail account. That experience with Instagram is the reason I moved away from using DUO for everything to Aegis where I can copy a password encrypted backup of my 2FA secret keys like I would any file. I am grateful I learned that lesson by losing 2FA to a single account.
bakugo 4y ago
> Basically am I the only one who doesn't think phone is my life and I don't want my life to be over if I lose my phone? A huge percentage of internet users today don't own any devices other than their phone and most big corporations like Google want that percentage to become 100% in the near future because it's within their best interests if users have no control whatsoever over the device they rely on to live their life.
lettergram 4y ago
Imagine when google bans you like people get banned off Twitter… “sorry your keys were revoked on chrome for an attempted search on an unauthorized topic” (so you can no longer access your bank website) I imagine it’ll even get more dystopian as mistakes / bugs will happen and Google has no tech support
- stetrain 4y ago
  Then don’t store/sync your passkeys with Google.
  - nigamanth 4y ago
    That makes this an even worse idea. Imagine losing everything because your phone gets stolen. Phone insurance should become real very soon.
    - stetrain 4y ago
      Or use something like 1Password, LastPass, or any other password manager that ends up supporting Passkeys.
      - LoganDark 4y ago
        I use KeePassXC specifically so that I can publish my encrypted database to the open Internet and access it anywhere, from any platform.
        stetrain 4y ago
        Someone else in this thread linked to Webauthn supporting coming for KeePassXC. Hopefully we end up with a variety of password manager options that support these standards and devices/browsers that allow you to use your own password manager for the passkey flow.
        LoganDark 4y ago
pronlover723 4y ago
I don't know where you get the idea that a mobile device is needed
alanfranz 4y ago
It is bad when the dependency is phone only. Example: 2FA codes based on HOTP/TOTP are printable & exportable already, and you could use them on an external devices that are not a phone. Passkeys are based on FIDO standards, so I believe a phoneless approach should work as well, given the proper device is available. The bad part is that plenty of bad implementations exist for such external devices. For 2FA many, too many places allow just one device "for security" - which is total bs, of course. This was true for AWS until a couple of years ago, I didn't check this recently. Google and Github get this right; but a lot of other parties just don't.

p-e-w 4y ago

> What's my basic authentication method to a site or system I can write down, backup, export or memorize? There isn't one. This is by design. Logging into your bank or email provider will in the future require mobile device shenanigans that are either proprietary or so complex and opaque that you have no chance of "controlling" anything, or even really understanding what's actually going on. The main lobby driving this forward consists of Google, Apple, and Microsoft. This should tell you all you need to know.

stetrain 4y ago
Which part of passkeys / Webauthn / FIDO requires a mobile device?
- p-e-w 4y ago
  In principle, none. In practice, many websites will check the user agent and flat out refuse service unless it's one of a pre-approved list of implementations, regardless of whether it would work or not. This has been happening for a long, long time already, for many browser features, and such "standards" pushed forward by the major mobile vendors will only make the problem worse.
  - stetrain 4y ago
    Well if we're making up things that websites haven't done yet then yeah I'm angry too.
- ajvs 4y ago
  Unless you're using one of the proprietary desktop OSes then you have to use one of the proprietary mobile OSes. https://developers.google.com/identity/passkeys/supported-environments#linux https://developers.google.com/identity/passkeys/supported-en...
  - stetrain 4y ago
    Assuming desktop Chrome doesn’t support third party password managers like 1Password and Lastpass that are similarly part of the FIDO alliance. Passkeys aren’t a Chrome feature they’re a Webauthn feature. So if Chrome doesn’t provide the features you want on your platform you should be able to use another browser / password manager combo that does.
  - psanford 4y ago
    No you do not need to use anything proprietary to use WebAuthn. There are open source software[0] and hardware keys[1]. [0]: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido [1]: https://solokeys.com/ https://solokeys.com/
    - codedokode 4y ago
      WebAuthn supports attestation of key storage and site owners might choose not to trust keys coming from an unknown DIY device.
      - psanford 4y ago
        Fortunately that feature isn't used outside of enterprise environments. Apple's passkeys don't support it so there will not be any mainstream adoption for requiring an attestation cert.
mynameisvlad 4y ago
What part of WebAuthn, a W3C standard, is "proprietary or [...] complex and opaque"? The FIDO alliance also consists of far more companies than just "Google, Apple, and Microsoft", although they're certainly members. https://fidoalliance.org/members/ https://fidoalliance.org/members/
- p-e-w 4y ago
  > What part of WebAuthn, a W3C standard, is "proprietary or [...] complex and opaque"? Ask Mozilla. FIDO U2F is so complicated that Firefox support was hidden behind a config flag for a long time, then "a hard-coded permission for Google Accounts"[1] was implemented in order to not fall too far behind Chrome. The linked email thread is an eye-opener on how many intricacies and unresolved questions there are, with multiple mentions of non-standard behavior implemented in the Google ecosystem, undermining WebAuthn. This is how such "standards" work in practice, and passkeys will be no exception. [1] https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGTEA/m/lC834665BQAJ https://groups.google.com/g/mozilla.dev.platform/c/q5cj38hGT...
  - mynameisvlad 4y ago
    FIDO U2F is not WebAuthn, and if you had even bothered to skim the link you provided, you probably would have realized that considering: - they go out of their way to explicitly differentiate them, and - the entire discussion is about U2F and bringing in support for it in a limited sense so that people adopt WebAuthn instead of U2F. Like, did you even read the link you provided? So, again, what about WebAuthn is proprietary or complicated?
    - p-e-w 4y ago
      I'm not claiming they're the same. What matters is that U2F is what many websites implemented, which is why those problems arose in the first place. This time, websites will implement "Chrome passkeys", which will be almost-but-not-quite WebAuthn, just like Internet Explorer's box model was almost-but-not-quite CSS. If there are only two or three major players and the standard is sufficiently complex, "standard" becomes synonymous with "what iOS and Android do". But to answer your question: > So, again, what about WebAuthn is proprietary or complicated? The WebAuthn standard is 184 pages of A4 size. That's a technical document, the length of a typical novel. Are you seriously asking what's "complicated" about that?

stetrain 4y ago

Do you use SSH keys? This is SSH keys for signing into websites. Which, yes, means you need at least one device in your possession containing your private keys. 1Password has already announced support for storing and syncing passkeys. Apple and Google also allow you to sync them via your account. Nothing ties it specifically to your phone compared to any of your other devices or an online account/vault that you store your keys in.

XorNot 4y ago
I can print out my SSH key and store it in a safe, or freely copy it between systems. All of these services are intended to prevent that by using on device secure enclave functionality and the like - it puts control the keys out of my reach.
- stetrain 4y ago
  But you should be able to use your own password manager that can export them if you choose. I could be wrong but I don't think the standard requires that the keys are stored out of user reach.
  - bakugo 4y ago
    > I could be wrong but I don't think the standard requires that the keys are stored out of user reach. It really doesn't matter what the standard requires when the most popular implementations belong to companies like Google or Apple, they will get to decide how it works.
    - stetrain 4y ago
      So you think Google and Apple will block third party password managers from providing passkeys to the browser?
      - bakugo 4y ago
        Yes, I do.

FeistySkink 4y ago

I'm in the process of migrating to a new phone. My old phone had an eSIM that was tied to some 2FA (not by choice, and it couldn't be changed, because security), and my temp phone doesn't support an eSIM, so until the new one arrives I can't access some services. You don't even need to lose anything to be locked out.

knaik94 4y ago
Did you not keep any of the backup code? I am not sure why 2FA is related to the eSIM unless you mean certain services force using SMS as the method to receive 2FA. I have experienced that same restriction with financial services in the US. I agree, it's frustrating and feels counterproductive to security because it could motivate someone to borrow a friend's device temporarily to access the services. eSIMs are even more annoying as there is a limited amount of times you can switch devices.
- philsnow 4y ago
  It is the very rare site or service that actually refuses to let you back in with an email confirmation or something. Sites with SMS 2FA / mobile app 2FA will nearly 100% of the time let you fall back to email. And why not? It's a huge support burden to do otherwise. You can say "we told you that you'd be locked out" and not even confirm to the user that an account exists with that user ID, but then half of the users who get locked out will complain about it on social media. You can only really enforce 2FA if your site has to do with money or similar.
  - knaik94 4y ago
    For major sites, FAMG having access to email is not enough in my experience. I was recently locked out of my Instagram account and lost my 2FA. Instagram required me to contact support from a known previously associated email, but on top of that I had to upload a picture of myself holding a piece of paper with a handwritten nonce and they checked against my previously uploaded pictures. I also had to wait a period of time before they would telling me what nonce to use and starting the verification process. I have heard stories of people not being let in and having to contact friends who work at Facebook and have access to the internal support queue. I know my friend had to do something similar at Google and have a friend make a internal support ticket when they were locked out of a gmail account. That experience with Instagram is the reason I moved away from using DUO for everything to Aegis where I can copy a password encrypted backup of my 2FA secret keys like I would any file. I am grateful I learned that lesson by losing 2FA to a single account.

bakugo 4y ago

> Basically am I the only one who doesn't think phone is my life and I don't want my life to be over if I lose my phone? A huge percentage of internet users today don't own any devices other than their phone and most big corporations like Google want that percentage to become 100% in the near future because it's within their best interests if users have no control whatsoever over the device they rely on to live their life.

lettergram 4y ago

Imagine when google bans you like people get banned off Twitter… “sorry your keys were revoked on chrome for an attempted search on an unauthorized topic” (so you can no longer access your bank website) I imagine it’ll even get more dystopian as mistakes / bugs will happen and Google has no tech support

stetrain 4y ago
Then don’t store/sync your passkeys with Google.
- nigamanth 4y ago
  That makes this an even worse idea. Imagine losing everything because your phone gets stolen. Phone insurance should become real very soon.
  - stetrain 4y ago
    Or use something like 1Password, LastPass, or any other password manager that ends up supporting Passkeys.
    - LoganDark 4y ago
      I use KeePassXC specifically so that I can publish my encrypted database to the open Internet and access it anywhere, from any platform.
      - stetrain 4y ago
        Someone else in this thread linked to Webauthn supporting coming for KeePassXC. Hopefully we end up with a variety of password manager options that support these standards and devices/browsers that allow you to use your own password manager for the passkey flow.
        LoganDark 4y ago

pronlover723 4y ago

I don't know where you get the idea that a mobile device is needed

alanfranz 4y ago

It is bad when the dependency is phone only. Example: 2FA codes based on HOTP/TOTP are printable & exportable already, and you could use them on an external devices that are not a phone. Passkeys are based on FIDO standards, so I believe a phoneless approach should work as well, given the proper device is available. The bad part is that plenty of bad implementations exist for such external devices. For 2FA many, too many places allow just one device "for security" - which is total bs, of course. This was true for AWS until a couple of years ago, I didn't check this recently. Google and Github get this right; but a lot of other parties just don't.