3 ms·

I see a lot of negativity and skepticism in the comments, and I think it's worth saying quite strongly: if you're reading comments on Hacker News, you're a powe

by Shank 4y ago

I see a lot of negativity and skepticism in the comments, and I think it's worth saying quite strongly: if you're reading comments on Hacker News, you're a power user, and you already probably have a good password management system. Either you're superhuman and memorize thousands of different passwords per site, or you have a generator or other system for generating unique passwords and storing them. You may also have security keys, TOTP generation, and an innate ability not to be phished. The reality is the vast majority of the globe does not have any of these traits. People create bad passwords that are reused all the time. People willingly disable 2FA for convenience, or get phished. In attacks over the summer, we've seen people take bribes to just give over passwords and 2FA codes. Passkeys are predicated on a 2FA-by-default philosophy that solves a lot of real-world problems the vast majority of people have. This is a huge win for normal people who use an Android phone or an iPhone in the default configuration and just need to login to places. It may feel like it's too heavy of an instrument for you because your solution is more convenient and well-understood, but most people struggle with this on a day-to-day basis. In my book, passkeys are still not perfect, but they definitely are better than passwords for 99% of the world.

josephcsible 4y ago
We already have regular WebAuthn to fix that problem properly. Passkeys feel like a way to abuse WebAuthn to lock people into your ecosystem forever, on pain of losing all their online accounts.
knaik94 4y ago
If people are going to be using default settings, why not just push a lot harder to force non sms based 2FA? Salted password+2FA should practically match any security benefit being attributed to passkeys. My University forced the entire student and staff population to enroll in Duo 2FA a few years ago and staff/faculty can get a hardware key if they request one. 2FA is required at every single point a University login exists. Everyone just got used to it. I even have to use 2FA when logging in to the VPN using Cisco Anyconnect, there's a third field that says "Duo Action" and it used to say "Second Password" and the options are using a backup code or the word "push" to get a mobile notification. The fact that passkeys are supposed to replace password and TOTP feels like a security risk. I understand that the phone uses a security enclave or TPM along with a pin/pattern/biometrics to attest a valid 2FA unlock, having it be tied to a mobile phone feels incorrect. I understand that's how it's set up for the vast amount of people already, but shifting from potentially separate devices for TOTP and Pass to a single device for everything seems weaker. I understand that power users are not the target, but the issue of vendor/device lock based on attestation and not allowing DIY keys. Moving from a piece of information I know like a password, or even an SSH key/cert I print out, to a "password" of a private key even I am not allowed to read feels less secure. It's not a matter of convenience, it's a question of giving up control of key generation and syncing to a third party. From a standpoint of opsec, not having control of your private keys is a much bigger weakness relative to a compromised password. Changing passwords is trivial, but changing a device secured private key is impossible. Passkeys don't fix the bribes or 5$ wrench loophole [1]. Unless you force users to only use biometrics and pin/patterns are disabled, passkeys will have the same issues that passwords do. In a world where getting people to understand 2FA is hard, it feels short sighted to depend on Bluetooth protocol dependent authentication. Trying to get people to shift from the convenience of a password to the inconvenience of needing to mess with Bluetooth is going to be its own headache. When the topic of needing a superhuman memory to remember passwords comes up, I think of https://xkcd.com/936/ https://xkcd.com/936/ . The conspiracy theorist in me can imagine companies like Netflix forcing passkey reauth every 15 days in order to combat things like password sharing. I respectfully disagree and believe passkeys will serve mostly as an inconvenience for the world. I am struggling to see the use cases where passkeys are meaningfully better than passwords and 2FA unless the use passwords is completely discontinued. And phones would become an even bigger single point of failure. A broken phone would be the same as losing all of your 2FA keys, there would be no password to help demonstrate account ownership to support. [1] https://xkcd.com/538/ https://xkcd.com/538/
codedokode 4y ago
A better solution would be cheap (less than $1) hardware keys, not locking people into Google/Apple ecosystem and allowing them to decrypt the keys when asked nicely. Also, on Android Google's passkeys can be stolen if an attacker gains root privileges. Hardware keys without an OS are much more difficult to hack into.

by Shank 4y ago

josephcsible 4y ago

We already have regular WebAuthn to fix that problem properly. Passkeys feel like a way to abuse WebAuthn to lock people into your ecosystem forever, on pain of losing all their online accounts.

knaik94 4y ago

If people are going to be using default settings, why not just push a lot harder to force non sms based 2FA? Salted password+2FA should practically match any security benefit being attributed to passkeys. My University forced the entire student and staff population to enroll in Duo 2FA a few years ago and staff/faculty can get a hardware key if they request one. 2FA is required at every single point a University login exists. Everyone just got used to it. I even have to use 2FA when logging in to the VPN using Cisco Anyconnect, there's a third field that says "Duo Action" and it used to say "Second Password" and the options are using a backup code or the word "push" to get a mobile notification. The fact that passkeys are supposed to replace password and TOTP feels like a security risk. I understand that the phone uses a security enclave or TPM along with a pin/pattern/biometrics to attest a valid 2FA unlock, having it be tied to a mobile phone feels incorrect. I understand that's how it's set up for the vast amount of people already, but shifting from potentially separate devices for TOTP and Pass to a single device for everything seems weaker. I understand that power users are not the target, but the issue of vendor/device lock based on attestation and not allowing DIY keys. Moving from a piece of information I know like a password, or even an SSH key/cert I print out, to a "password" of a private key even I am not allowed to read feels less secure. It's not a matter of convenience, it's a question of giving up control of key generation and syncing to a third party. From a standpoint of opsec, not having control of your private keys is a much bigger weakness relative to a compromised password. Changing passwords is trivial, but changing a device secured private key is impossible. Passkeys don't fix the bribes or 5$ wrench loophole [1]. Unless you force users to only use biometrics and pin/patterns are disabled, passkeys will have the same issues that passwords do. In a world where getting people to understand 2FA is hard, it feels short sighted to depend on Bluetooth protocol dependent authentication. Trying to get people to shift from the convenience of a password to the inconvenience of needing to mess with Bluetooth is going to be its own headache. When the topic of needing a superhuman memory to remember passwords comes up, I think of https://xkcd.com/936/ https://xkcd.com/936/ . The conspiracy theorist in me can imagine companies like Netflix forcing passkey reauth every 15 days in order to combat things like password sharing. I respectfully disagree and believe passkeys will serve mostly as an inconvenience for the world. I am struggling to see the use cases where passkeys are meaningfully better than passwords and 2FA unless the use passwords is completely discontinued. And phones would become an even bigger single point of failure. A broken phone would be the same as losing all of your 2FA keys, there would be no password to help demonstrate account ownership to support. [1] https://xkcd.com/538/ https://xkcd.com/538/

codedokode 4y ago

A better solution would be cheap (less than $1) hardware keys, not locking people into Google/Apple ecosystem and allowing them to decrypt the keys when asked nicely. Also, on Android Google's passkeys can be stolen if an attacker gains root privileges. Hardware keys without an OS are much more difficult to hack into.