4 ms·

> This is SSH keys for signing into websites. No it's not. It's a shackle that will tie users to two or three platform providers (Google, Apple, and Microsoft)

by p-e-w 4y ago

> This is SSH keys for signing into websites. No it's not. It's a shackle that will tie users to two or three platform providers (Google, Apple, and Microsoft) because websites will refuse to interoperate with implementations that aren't from those. "Your browser is currently unsupported. To log in to your Amazing Bank account, open this website on your Android or iOS phone and place your finger on the home button." Just because the underlying cryptographic primitives are similar to SSH, doesn't mean this will work anything like SSH in practice.

stetrain 4y ago
So websites will have whitelisted platform support instead of using the Webauthn / FIDO standard that Google, Apple, Microsoft, 1Password, and others are supporting?
- p-e-w 4y ago
  They'll be using the standard AND whitelisting browsers. Just like some WebRTC-based services used to tell you "your browser is unsupported" when opened in Firefox, but spoofing the user agent to look like Chrome made everything magically work (Hangouts was a famous example IIRC, though they've since added official Firefox support).
lll-o-lll 4y ago
Rubbish. This is literally WebAuthn, a completely open standard. There is no hidden secret sauce here, proprietary vendor lock-in, nothing. We’ve had the functionality forever with Yubikey and so on, the difference is the tight integration with these common platforms making for ease of use. The website you are accessing knows nothing about your device, it’s just doing a protocol dance. You can do it too! I’m sure someone will create a crap, insecure, WebAuthn client so that you can keep using your passwords.
- knaik94 4y ago
  I look forward to using that crap insecure WebAuthn client. A private key I don't control is a much bigger security issue than a compromised password will ever be. Google currently has no plans of supporting linux for "Local user verification" or "Passkey sync". If it was a truly open standard, I don't see why that would be the case. Needing to use a Google account is the definition of propriety vendor lock-in. Relying on specific hardware is the reason why I haven't embraced Yubikeys. I understand the assumption that the general population doesn't care to and shouldn't need to worry about managing their private keys. But there's nothing secure about not giving me the option to, if I want to. https://developers.google.com/identity/passkeys/supported-environments#:~:text=support%20passkey%20autofill.-,Linux,by%20scanning%20a%20QR%20code https://developers.google.com/identity/passkeys/supported-en....
- codedokode 4y ago
  > The website you are accessing knows nothing about your device, That is not correct. WebAuthn supports attestation of a hardware key storage, which means site operators can refuse to accept your keys unless you use a device from a white list.

by p-e-w 4y ago

stetrain 4y ago

So websites will have whitelisted platform support instead of using the Webauthn / FIDO standard that Google, Apple, Microsoft, 1Password, and others are supporting?

p-e-w 4y ago
They'll be using the standard AND whitelisting browsers. Just like some WebRTC-based services used to tell you "your browser is unsupported" when opened in Firefox, but spoofing the user agent to look like Chrome made everything magically work (Hangouts was a famous example IIRC, though they've since added official Firefox support).

lll-o-lll 4y ago

Rubbish. This is literally WebAuthn, a completely open standard. There is no hidden secret sauce here, proprietary vendor lock-in, nothing. We’ve had the functionality forever with Yubikey and so on, the difference is the tight integration with these common platforms making for ease of use. The website you are accessing knows nothing about your device, it’s just doing a protocol dance. You can do it too! I’m sure someone will create a crap, insecure, WebAuthn client so that you can keep using your passwords.

knaik94 4y ago
I look forward to using that crap insecure WebAuthn client. A private key I don't control is a much bigger security issue than a compromised password will ever be. Google currently has no plans of supporting linux for "Local user verification" or "Passkey sync". If it was a truly open standard, I don't see why that would be the case. Needing to use a Google account is the definition of propriety vendor lock-in. Relying on specific hardware is the reason why I haven't embraced Yubikeys. I understand the assumption that the general population doesn't care to and shouldn't need to worry about managing their private keys. But there's nothing secure about not giving me the option to, if I want to. https://developers.google.com/identity/passkeys/supported-environments#:~:text=support%20passkey%20autofill.-,Linux,by%20scanning%20a%20QR%20code https://developers.google.com/identity/passkeys/supported-en....
codedokode 4y ago
> The website you are accessing knows nothing about your device, That is not correct. WebAuthn supports attestation of a hardware key storage, which means site operators can refuse to accept your keys unless you use a device from a white list.