4 ms·

Do you use SSH keys? This is SSH keys for signing into websites. Which, yes, means you need at least one device in your possession containing your private key

Do you use SSH keys? This is SSH keys for signing into websites. Which, yes, means you need at least one device in your possession containing your private keys. 1Password has already announced support for storing and syncing passkeys. Apple and Google also allow you to sync them via your account. Nothing ties it specifically to your phone compared to any of your other devices or an online account/vault that you store your keys in.

XorNot 4y ago
I can print out my SSH key and store it in a safe, or freely copy it between systems. All of these services are intended to prevent that by using on device secure enclave functionality and the like - it puts control the keys out of my reach.
- stetrain 4y ago
  But you should be able to use your own password manager that can export them if you choose. I could be wrong but I don't think the standard requires that the keys are stored out of user reach.
  - bakugo 4y ago
    > I could be wrong but I don't think the standard requires that the keys are stored out of user reach. It really doesn't matter what the standard requires when the most popular implementations belong to companies like Google or Apple, they will get to decide how it works.
    - stetrain 4y ago
      So you think Google and Apple will block third party password managers from providing passkeys to the browser?
      - bakugo 4y ago
        Yes, I do.
        stetrain 4y ago
        That's strange and would be a pretty big about-face. Apple, the most locked-down and proprietary OS vendor, has great support for third party password managers in their OSes and has been improving that support in recent years. If they kick 1Password etc. out of the Mac/iOS ecosystem that would be a pretty big deal. It could happen, but why would they do so?
        piperswe 4y ago
        That would be strange, given that Passkeys are just Webauthn tokens synchronized across devices. I don't know of a single application that only supports one vendor of Webauthn token, and I don't see that changing soon.
      - josephcsible 4y ago
        Not quite, but close. They'll convince website owners that for "security reasons", they should refuse passkeys that came from third-party password managers or anything else open source, and instead only accept ones that came from something remotely attestable to be theirs.
        stetrain 4y ago
        Then why bother with Webauthn and the FIDO alliance instead of just making this part of Sign in with Apple / Sign in with Google? That seems easier for Apple and Google if their plan is to be the only sign-in providers.
        bakugo 4y ago
        Ever heard of "embrace, extend, extinguish"?
        brookst 4y ago
p-e-w 4y ago
> This is SSH keys for signing into websites. No it's not. It's a shackle that will tie users to two or three platform providers (Google, Apple, and Microsoft) because websites will refuse to interoperate with implementations that aren't from those. "Your browser is currently unsupported. To log in to your Amazing Bank account, open this website on your Android or iOS phone and place your finger on the home button." Just because the underlying cryptographic primitives are similar to SSH, doesn't mean this will work anything like SSH in practice.
- stetrain 4y ago
  So websites will have whitelisted platform support instead of using the Webauthn / FIDO standard that Google, Apple, Microsoft, 1Password, and others are supporting?
  - p-e-w 4y ago
    They'll be using the standard AND whitelisting browsers. Just like some WebRTC-based services used to tell you "your browser is unsupported" when opened in Firefox, but spoofing the user agent to look like Chrome made everything magically work (Hangouts was a famous example IIRC, though they've since added official Firefox support).
- lll-o-lll 4y ago
  Rubbish. This is literally WebAuthn, a completely open standard. There is no hidden secret sauce here, proprietary vendor lock-in, nothing. We’ve had the functionality forever with Yubikey and so on, the difference is the tight integration with these common platforms making for ease of use. The website you are accessing knows nothing about your device, it’s just doing a protocol dance. You can do it too! I’m sure someone will create a crap, insecure, WebAuthn client so that you can keep using your passwords.
  - knaik94 4y ago
    I look forward to using that crap insecure WebAuthn client. A private key I don't control is a much bigger security issue than a compromised password will ever be. Google currently has no plans of supporting linux for "Local user verification" or "Passkey sync". If it was a truly open standard, I don't see why that would be the case. Needing to use a Google account is the definition of propriety vendor lock-in. Relying on specific hardware is the reason why I haven't embraced Yubikeys. I understand the assumption that the general population doesn't care to and shouldn't need to worry about managing their private keys. But there's nothing secure about not giving me the option to, if I want to. https://developers.google.com/identity/passkeys/supported-environments#:~:text=support%20passkey%20autofill.-,Linux,by%20scanning%20a%20QR%20code https://developers.google.com/identity/passkeys/supported-en....

XorNot 4y ago

I can print out my SSH key and store it in a safe, or freely copy it between systems. All of these services are intended to prevent that by using on device secure enclave functionality and the like - it puts control the keys out of my reach.

stetrain 4y ago
But you should be able to use your own password manager that can export them if you choose. I could be wrong but I don't think the standard requires that the keys are stored out of user reach.
- bakugo 4y ago
  > I could be wrong but I don't think the standard requires that the keys are stored out of user reach. It really doesn't matter what the standard requires when the most popular implementations belong to companies like Google or Apple, they will get to decide how it works.
  - stetrain 4y ago
    So you think Google and Apple will block third party password managers from providing passkeys to the browser?
    - bakugo 4y ago
      Yes, I do.
      - stetrain 4y ago
        That's strange and would be a pretty big about-face. Apple, the most locked-down and proprietary OS vendor, has great support for third party password managers in their OSes and has been improving that support in recent years. If they kick 1Password etc. out of the Mac/iOS ecosystem that would be a pretty big deal. It could happen, but why would they do so?
      - piperswe 4y ago
        That would be strange, given that Passkeys are just Webauthn tokens synchronized across devices. I don't know of a single application that only supports one vendor of Webauthn token, and I don't see that changing soon.
    - josephcsible 4y ago
      Not quite, but close. They'll convince website owners that for "security reasons", they should refuse passkeys that came from third-party password managers or anything else open source, and instead only accept ones that came from something remotely attestable to be theirs.
      - stetrain 4y ago
        Then why bother with Webauthn and the FIDO alliance instead of just making this part of Sign in with Apple / Sign in with Google? That seems easier for Apple and Google if their plan is to be the only sign-in providers.
        bakugo 4y ago
        Ever heard of "embrace, extend, extinguish"?
      - brookst 4y ago

p-e-w 4y ago

> This is SSH keys for signing into websites. No it's not. It's a shackle that will tie users to two or three platform providers (Google, Apple, and Microsoft) because websites will refuse to interoperate with implementations that aren't from those. "Your browser is currently unsupported. To log in to your Amazing Bank account, open this website on your Android or iOS phone and place your finger on the home button." Just because the underlying cryptographic primitives are similar to SSH, doesn't mean this will work anything like SSH in practice.

stetrain 4y ago
So websites will have whitelisted platform support instead of using the Webauthn / FIDO standard that Google, Apple, Microsoft, 1Password, and others are supporting?
- p-e-w 4y ago
  They'll be using the standard AND whitelisting browsers. Just like some WebRTC-based services used to tell you "your browser is unsupported" when opened in Firefox, but spoofing the user agent to look like Chrome made everything magically work (Hangouts was a famous example IIRC, though they've since added official Firefox support).
lll-o-lll 4y ago
Rubbish. This is literally WebAuthn, a completely open standard. There is no hidden secret sauce here, proprietary vendor lock-in, nothing. We’ve had the functionality forever with Yubikey and so on, the difference is the tight integration with these common platforms making for ease of use. The website you are accessing knows nothing about your device, it’s just doing a protocol dance. You can do it too! I’m sure someone will create a crap, insecure, WebAuthn client so that you can keep using your passwords.
- knaik94 4y ago
  I look forward to using that crap insecure WebAuthn client. A private key I don't control is a much bigger security issue than a compromised password will ever be. Google currently has no plans of supporting linux for "Local user verification" or "Passkey sync". If it was a truly open standard, I don't see why that would be the case. Needing to use a Google account is the definition of propriety vendor lock-in. Relying on specific hardware is the reason why I haven't embraced Yubikeys. I understand the assumption that the general population doesn't care to and shouldn't need to worry about managing their private keys. But there's nothing secure about not giving me the option to, if I want to. https://developers.google.com/identity/passkeys/supported-environments#:~:text=support%20passkey%20autofill.-,Linux,by%20scanning%20a%20QR%20code https://developers.google.com/identity/passkeys/supported-en....