8 ms·

I will probably use passwords until I am forcibly unable to. I'm happy with my password manager. Tying login credentials to a hardware device that can easily b

I will probably use passwords until I am forcibly unable to. I'm happy with my password manager. Tying login credentials to a hardware device that can easily be lost or stolen, and that (at least from my understanding) are hard to transfer to new devices seems like a risk I'm unwilling to take. And a step back. I'm not adverse to replacing passwords with public/private key cryptography, but I need to be in control of it (not some multinational org) and I don't want it tied to a single hardware device.

JustSomeNobody 4y ago
I have one of the old blue keys. Never found a good use for it. I don't have my keys with me at my desk, so I never put it on my keychain. So then it's just laying around and gets shuffled of the desk and into a drawer. Meanwhile, my phone is always near and bitwarden just works.
goodoldneon 4y ago
I have 2 yubikeys and always register them both. So if one is lost or broken then I still have another to log into sites. As for theft, if you’re using your yubikey as a 2nd factor then they still can’t log in because they don’t know your password. If you’re using your yubikey as both factors then it either has a PIN or biometrics, so the thief can’t log in. My main use for my yubikey is for SSH. I have PIN-protected SSH with a private key that can’t be exfiltrated
- illiac786 4y ago
  But if you register both every time, it means you always carry both yubikeys with you, right? I hope you don’t have both on the same keyring, but if you carry both around, the resilience/redundancy of that setup is lacking in my view.
- neatze 4y ago
  sudo, screen lock, luks, ssh, pgp, weblogins, keepass are all setup with yubikeys. I wish I could generate my own private fido key in similar way as pgp.
  - account-5 4y ago
    This is what I would require before migrating. Opensource local only Fido key generation. But like I said in the comment below, I suspect these vendors are only here for vendor lock-in and targeted advertising. And the websites enabling webauthn are likely to require you to use a vendors app/service. Like banking sites today not allowing me to utilise keepassxc totp functionality trying to force me to download their app or SMS.
  - vladvasiliu 4y ago
    Yes, I think it would be great to be able to create the key otuside of the physical hardware token, just like you can do with the GPG applet on the Yubkey. Store the original on some offline, encrypted media, ideally in multiple places. This way, you don't need to have two yubikeys on hand and register them both on every new site. But in case you lose, it's not impossible to create a new one. Yet, obtaining the key from the hardware token shouldn't be any more possible than with the current system.
    - Godel_unicode 4y ago
      These two goals are mutually exclusive. If you let people generate their own key material outside the enclave, people will be emailing it to themselves just in case.
      - ilyt 4y ago
        Well, non-stupid people also use yubikeys, so they are not mutually exclusive
        Godel_unicode 4y ago
        Maybe, but there are also a lot of people who don’t understand the point of yubikeys that want to use them but export the secrets. Those people cannot be trusted with their own security and need to be protected from themselves.
- Robadob 4y ago
  I have two yubikeys too, but I definitely found services which didn't allow me to register more than one when I first set them up (a couple of years ago now).
  - Semaphor 4y ago
    Not sure how it used to be, but the only braindead implementation like that I’ve seen was AWS.
    - arianvanp 4y ago
      They fixed this a few weeks ago.
      - chrishynes 4y ago
        They announced a fix but it hasn't rolled out everywhere yet -- it requires converting to a new "Amazon Web Service" login that is separate from your normal amazon.com account
      - bostik 4y ago
        Oh cool, this has been my number one complaint about AWS credentials management since early 2016 or so. Over the years I've talked to a number of their project and program managers and until 2019 (that is, before the plague) they all told me that they were aware of the problem but had no plans - or even intent to fix it. Apparently the one-set-of-credentials constraint is so deeply tied into their platform that fixing it was simply deemed infeasible. Appears that while they couldn't fix it, they have gone ahead with a workaround and made multi-device 2FA support a feature in a potential auth replacement system. Must have been a particularly frequent and loud complaint.
- orev 4y ago
  The elephant in the room is that this just isn’t feasible for “normal” (non-IT) people, and those people are usually the ones who need strong protections, as they’re the ones with bad habits like choosing bad passwords, reusing passwords, forgetting them, etc.
  - ilyt 4y ago
    I'd think password managers would be fine here. Also, don't fuck up other user's experience just because average one is clueless...
    - goodoldneon 4y ago
      I use a password manager too. The yubikey is usually my second factor
  - goodoldneon 4y ago
    You’re totally right. I never recommend Yubikeys to non-technical people
- tuatoru 4y ago
  I bought four yubikeys back in 2012, two pairs as recommended - one in use, one backup. At the time Yubi had a video up of their keys being run over and otherwise maltreated, and still working. One of my keys failed spontaneously after a just few weeks in my pocket, on a ring with my other keys. I decided to stop using yubikeys. A password manager has worked very well for me ever since.
  - ViViDboarder 4y ago
    I’ve had one on my keychain for at least 5 years now with no issues. It would have been longer but I did switch to a USB-C key two years ago. I kept the old one enrolled as my backup key. I use a password manager, but my Yubikey has all my 2FA. Including TOTP.
  - Jayschwa 4y ago
    I had a YubiKey fail when I touched it and a static shock wiped its memory. I was able to reinitialize it using their app, but the previously loaded key was lost.
- spiffytech 4y ago
  > I have 2 yubikeys and always register them both How does this work? Do you have to physically retrieve both any time you sign up with a new service? If that's how it works, it sounds like a choice between two bad options: either having both of them handy at the same time, hurting redundancy, or registering them at separate times, hoping you remember to do both. Is that the case?
  - goodoldneon 4y ago
    That’s what I do. I keep my backup in a fireproof, airtight container
    - jdfhfjdhjdhdfj 4y ago
      excuse me if i think this is BS. You will have to retrieve your key when you sign to a new service. at this point you risk losing both. or are you saying you cloned the private keys and know how to correctly advance the counters when you need the backup?
      - goodoldneon 4y ago
        I don’t use 2 factor for most sites. Do I really care if my HN account is compromised? So for sites that I do care about (e.g. GitHub), yes I register both. It isn’t as inconvenient as you’d think because I don’t sign up for many sites. Since I use my Yubikey for SSH, I’m frequently adding both Yubikeys as authorized keys on machines. But I keep an authorized_keys file with both public keys so I don’t need to physically grab my backup
PhilippGille 4y ago
> Tying login credentials to a hardware device The article specifically states (about passkeys as opposed to Yubikeys): > They’re different because Platform created passkeys will be copyable by default using the credentials for the underlying cloud account (plus maybe an additional password manager sync passphrase), whereas passkeys in YubiKeys are bound to the YubiKey’s physical hardware where they can’t be copied. That brings its own challenges of course (e.g. you have to trust the Cloud syncing and E2EE by the vendors).
- account-5 4y ago
  Apologies I was trying to make my second condition about these providers. I don't want hardware specific credentials, or <insert multinational cloud provider> controlled credentials. The first introduces risks with damaged or stolen hardware, not to mention migration. The second introduces lack of control and enables these companies to track you. It's not lost on me that nearly all the companies offering authenticator apps are basically advertising companies: Google, Microsoft, Apple. They're getting in at the start for a reason
  - georgyo 4y ago
    It does not need to be hardware specific. After all, talking to hardware is just software. Your password manger could implement passkey support. And I suspect that 1password will do that soon with their recent acquisition. The real benefit to passkeys is that password isn't sent over the wire, only the proof that you have the secret. Similar to SSH keys. This prevents a whole range of attacks.
    - account-5 4y ago
      I use keepassxc, I would love to manage my private/public keys in the same way I manage my passwords. I'm in complete control. But from my reading, and I believe the way this will be implemented but services, I doubt very much you'll be about to do this. Certainly at the moment it looks like vendor lock-in to me. Vendor lock-in with a heavy dose of targeted advertising.
    - 4y ago
worldsavior 4y ago
Using passwords is not something very comfortable, and needing to remember a password to a password manager, has some risks, like suddenly forgetting. Using a yubikey is also not very practical since it can be stolen or lost. A phone is always with us, and has small chances of being lost (also there are backups).
- bennysonething 4y ago
  I use a yubikey to secure my passwordsafe file https://pwsafe.org/ https://pwsafe.org/ Password safe runs on multiple operating systems. I sync my file to cloud storage so it's up to date on all my devices I have a backup key in a drawer and one on me at all times. I really need to buy a few more backup keys. It's not a perfect set up but it works for me.
  - waych 4y ago
    Consider trying SyncThing to sync your files between your personal devices, rather than entrusting access to your data to a cloud provider. I did this recently and the experience has been surprisingly way easier and better than I could have imagined.
    - bennysonething 4y ago
      That looks great. Looks it might be viable for me. Security risk in my setup is is cloud storage. And also I'm relying on a password safe Dropbox sync app.
- account-5 4y ago
  A phone has the same chances of being lost and I would say a higher chance of being stolen. My question would be who is in control of the backups? The same vendors who want to lock you into their ecosystem?
  - b112 4y ago
    And the same ones that also lock you out without recourse?
AeroNotix 4y ago
You don't have to be tied to a single device. A common set up is a root yubikey you create children of. The root key is held in a safe location and the children have either copies or even better, short live keys signed by the root.
- account-5 4y ago
  I'll have to take your word for it. That all seems complicated to me, maybe it's not and is just out of my frame of reference.
- sebk 4y ago
  YubiKeys can't have copies of themselves, that's a big portion of their selling point. As far as I know and strictily in FIDO, there is no solution here. The closest that Yubico has is this draft: https://github.com/Yubico/webauthn-recovery-extension https://github.com/Yubico/webauthn-recovery-extension which will roughly make an authenticator register two keys with an RP. The draft itself is not implemented anywhere as far as I know and while better than the current state of hardware key backups, it's still not problem free. I personally would love to see it implemented, so it can be used for logging in to the service that provides a WebAuthn sync fabric.
- sigzero 4y ago
  "passkeys in YubiKeys are bound to the YubiKey’s physical hardware where they can’t be copied." Unless you are talking about something entirely different that scenario isn't possible.
- waych 4y ago
  I don't know about this "root key" setup you describe, but you can certainly program sets of yubikeys with the same OTP secrets at setup time, resulting in cloned/backup keys. The OTP secrets can also be stored (presumably offline) to create new copies of the key in case of recovery.
sebk 4y ago
This concern is valid depending on your threat model, but improvements are quickly coming to this area. Apple, Microsoft, and Google have announced that they will allow syncing credentials between devices in their ecosystem (fully end-to-end encrypted, like a password manager), and several password managers have started to add software implementation of FIDO authenticators to their offerings. Hopefully in the near future we'll see the big vendors open up their APIs so that password managers can use the device hardware as well. Of course, multi-device passkeys will not work for high assurance situations, as TFA calls out, but that's not likely the case for any of the services you currently use a password manager for anyway. As it stands today, using passkeys with a software implementation, barring implementation bugs, is no less safe from credential loss than passwords in a password manager.
- b112 4y ago
  Apple, Microsoft, and Google have announced that they will allow syncing credentials While your comment is fair, and I know you were just providing info, from where I sit, these are the sort of entities I never, ever involve in any form of private work, security, or communication.
  - toomuchtodo 4y ago
    This is a minority opinion though when compared to usage and market share of these orgs.
- mistrial9 4y ago
  as a US citizen, I absolutely do not accept these three giant companies running my access to financial services and governmental functions; just, no. Secondly, I will say that the entire surveillance-capitalism ideas of constant-on ID comes from a model of money lending that was built in the 1960s, ultimately by VISA and MasterCard. This worked well enough to generate the holders massive capital. no, no, no
izacus 4y ago
> I will probably use passwords until I am forcibly unable to. I'm happy with my password manager. A random password stored in a password manager is literally what a passkey is. Several password managers have announced support for storing passkeys just like your passwords.
- arcanemachiner 4y ago
  I've been keeping track of this GitHub issue to follow the progress of getting the feature in FOSS password managers: https://github.com/keepassxreboot/keepassxc/issues/8214 https://github.com/keepassxreboot/keepassxc/issues/8214 It appears that we are still in the "walled garden bullshit" phase, so I'll pass for now.
- Biganon 4y ago
  I don't understand your last sentence. If a random password stored in a password manager is a passkey, then all providers already support them
  - jjnoakes 4y ago
    Passkey is about the random password stored in the password manager AND the protocol between the browser and the password manager to ensure the password isn't phished. It is the protocol that needs implementation.
- Renevith 4y ago
  "A random password stored in a password manager is literally what a passkey is." This is not quite true; a passkey is still somewhat more secure than a password in this scenario. With passwords, the password itself is sent to the website and a hashed version is stored in their database. If someone can intercept your connection to the site (MitM) or can access their database (hacker), they might be able to get your password and log in as you, especially if the website doesn't implement their hashing very well. These attack vectors don't apply to passkeys, even generated and synced by a software password manager: the private key never leaves your computer, only the corresponding pubic key. The website generates a unique challenge on each login that can only be solved by your private key, so intercepting a particular challenge or stealing the public key from the website database doesn't let anyone log in as you later.
jolmg 4y ago
> and that (at least from my understanding) are hard to transfer to new devices seems like a risk I'm unwilling to take. It's not really hard. They're quite flexible. You can't read the key from them, but you can write to them. You can generate the key outside, write it, save the backup somewhere you trust to be safe according to your threat model, and that's it. If you lose the device, buy a new one, write the key from the backup. The backup can also be used directly if you can't buy a new device for whatever reason. At least, this is how it works when used as an OpenPGP smartcard.
AugustoCAS 4y ago
I use keys as my default way of login but I have 'phishable' backup methods (OTP codes or backup codes). For me, the main thing is that using the keys by default make my accounts more secure and I would only use the phishable methods in case of emergency (if my house goes up in flames with my keys, computer, mobile, etc). One important thing for me was to remove my mobile number for SMS OTP or password reset, as sim cloning is a posibility. And a password manager is still indispensable as most sites don't accept hardware keys at all.
sudhirj 4y ago
Why is a passkey any different? Can’t one think of it as a password stored in a password manager? Is it more that you don’t want your browser to function as the password manager? There seems to be a API already for a browser to delegate passkey storage to a Yubikey, can’t a password manager do the same thing?
- ilyt 4y ago
  Browsers having just API for password managers is separate discussion but yes, that should happen. Password manager's job should not be to scrape pages for login fields. That still could be a separate plugin (if browser would not do job good enough), but password manager should really get credentials name, some metadata, notes and password to store, nothing more
- cmdli 4y ago
  Right now APIs for third parties are fairly limited, so it can be difficult to have support for passkeys with password managers. I was able to solve it for Bulwark Passkey (https://bulwark.id https://bulwark.id) by emulating a USB device and building the WebAuthN protocol off of that. This means that it supports all browsers, but also means that iOS support will be more difficult, though not impossible.
ilyt 4y ago
With how "secure" average app is I think there is probably much higher chance of them just fucking up than someone that uses password manager and doesn't run random shit off internet getting hacked. If it was "here is your private key, you can use it in sofware or you can load it on a key and just use" I'd be much calmer about it but the whole push "your authentication and sometimes whole identity is inseparably tied to your device" is frankly scary and disgusting.
cmdli 4y ago
I 100% agree. I really like the idea of getting rid of passwords, but I wanted to be able to control my own information. That is why I built Bulwark Passkey (https://bulwark.id https://bulwark.id), an open-source virtual passkey manager which allows you to export your credentials out of it, or sync them across devices. Passkeys have a lot of advantages, but the current plans for implementation are rather limited. If you're interested in passkeys that you can actually control, please check Bulwark Passkey out!
- diggernet 4y ago
  It looks like the only options are local-only (single device) or cloud-synced (bulwark cloud). I want credentials that are not tied to a single device OR tied to a cloud service. I want to be able to make backups to be used in the case of device failure or loss, and I don't want to be tied to some "underlying cloud account" (in Yubico's words). Just standalone, backupable credentials. Can you do that?

JustSomeNobody 4y ago

I have one of the old blue keys. Never found a good use for it. I don't have my keys with me at my desk, so I never put it on my keychain. So then it's just laying around and gets shuffled of the desk and into a drawer. Meanwhile, my phone is always near and bitwarden just works.

goodoldneon 4y ago

I have 2 yubikeys and always register them both. So if one is lost or broken then I still have another to log into sites. As for theft, if you’re using your yubikey as a 2nd factor then they still can’t log in because they don’t know your password. If you’re using your yubikey as both factors then it either has a PIN or biometrics, so the thief can’t log in. My main use for my yubikey is for SSH. I have PIN-protected SSH with a private key that can’t be exfiltrated

illiac786 4y ago
But if you register both every time, it means you always carry both yubikeys with you, right? I hope you don’t have both on the same keyring, but if you carry both around, the resilience/redundancy of that setup is lacking in my view.
neatze 4y ago
sudo, screen lock, luks, ssh, pgp, weblogins, keepass are all setup with yubikeys. I wish I could generate my own private fido key in similar way as pgp.
- account-5 4y ago
  This is what I would require before migrating. Opensource local only Fido key generation. But like I said in the comment below, I suspect these vendors are only here for vendor lock-in and targeted advertising. And the websites enabling webauthn are likely to require you to use a vendors app/service. Like banking sites today not allowing me to utilise keepassxc totp functionality trying to force me to download their app or SMS.
- vladvasiliu 4y ago
  Yes, I think it would be great to be able to create the key otuside of the physical hardware token, just like you can do with the GPG applet on the Yubkey. Store the original on some offline, encrypted media, ideally in multiple places. This way, you don't need to have two yubikeys on hand and register them both on every new site. But in case you lose, it's not impossible to create a new one. Yet, obtaining the key from the hardware token shouldn't be any more possible than with the current system.
  - Godel_unicode 4y ago
    These two goals are mutually exclusive. If you let people generate their own key material outside the enclave, people will be emailing it to themselves just in case.
    - ilyt 4y ago
      Well, non-stupid people also use yubikeys, so they are not mutually exclusive
      - Godel_unicode 4y ago
        Maybe, but there are also a lot of people who don’t understand the point of yubikeys that want to use them but export the secrets. Those people cannot be trusted with their own security and need to be protected from themselves.
Robadob 4y ago
I have two yubikeys too, but I definitely found services which didn't allow me to register more than one when I first set them up (a couple of years ago now).
- Semaphor 4y ago
  Not sure how it used to be, but the only braindead implementation like that I’ve seen was AWS.
  - arianvanp 4y ago
    They fixed this a few weeks ago.
    - chrishynes 4y ago
      They announced a fix but it hasn't rolled out everywhere yet -- it requires converting to a new "Amazon Web Service" login that is separate from your normal amazon.com account
    - bostik 4y ago
      Oh cool, this has been my number one complaint about AWS credentials management since early 2016 or so. Over the years I've talked to a number of their project and program managers and until 2019 (that is, before the plague) they all told me that they were aware of the problem but had no plans - or even intent to fix it. Apparently the one-set-of-credentials constraint is so deeply tied into their platform that fixing it was simply deemed infeasible. Appears that while they couldn't fix it, they have gone ahead with a workaround and made multi-device 2FA support a feature in a potential auth replacement system. Must have been a particularly frequent and loud complaint.
orev 4y ago
The elephant in the room is that this just isn’t feasible for “normal” (non-IT) people, and those people are usually the ones who need strong protections, as they’re the ones with bad habits like choosing bad passwords, reusing passwords, forgetting them, etc.
- ilyt 4y ago
  I'd think password managers would be fine here. Also, don't fuck up other user's experience just because average one is clueless...
  - goodoldneon 4y ago
    I use a password manager too. The yubikey is usually my second factor
- goodoldneon 4y ago
  You’re totally right. I never recommend Yubikeys to non-technical people
tuatoru 4y ago
I bought four yubikeys back in 2012, two pairs as recommended - one in use, one backup. At the time Yubi had a video up of their keys being run over and otherwise maltreated, and still working. One of my keys failed spontaneously after a just few weeks in my pocket, on a ring with my other keys. I decided to stop using yubikeys. A password manager has worked very well for me ever since.
- ViViDboarder 4y ago
  I’ve had one on my keychain for at least 5 years now with no issues. It would have been longer but I did switch to a USB-C key two years ago. I kept the old one enrolled as my backup key. I use a password manager, but my Yubikey has all my 2FA. Including TOTP.
- Jayschwa 4y ago
  I had a YubiKey fail when I touched it and a static shock wiped its memory. I was able to reinitialize it using their app, but the previously loaded key was lost.
spiffytech 4y ago
> I have 2 yubikeys and always register them both How does this work? Do you have to physically retrieve both any time you sign up with a new service? If that's how it works, it sounds like a choice between two bad options: either having both of them handy at the same time, hurting redundancy, or registering them at separate times, hoping you remember to do both. Is that the case?
- goodoldneon 4y ago
  That’s what I do. I keep my backup in a fireproof, airtight container
  - jdfhfjdhjdhdfj 4y ago
    excuse me if i think this is BS. You will have to retrieve your key when you sign to a new service. at this point you risk losing both. or are you saying you cloned the private keys and know how to correctly advance the counters when you need the backup?
    - goodoldneon 4y ago
      I don’t use 2 factor for most sites. Do I really care if my HN account is compromised? So for sites that I do care about (e.g. GitHub), yes I register both. It isn’t as inconvenient as you’d think because I don’t sign up for many sites. Since I use my Yubikey for SSH, I’m frequently adding both Yubikeys as authorized keys on machines. But I keep an authorized_keys file with both public keys so I don’t need to physically grab my backup

PhilippGille 4y ago

> Tying login credentials to a hardware device The article specifically states (about passkeys as opposed to Yubikeys): > They’re different because Platform created passkeys will be copyable by default using the credentials for the underlying cloud account (plus maybe an additional password manager sync passphrase), whereas passkeys in YubiKeys are bound to the YubiKey’s physical hardware where they can’t be copied. That brings its own challenges of course (e.g. you have to trust the Cloud syncing and E2EE by the vendors).

account-5 4y ago
Apologies I was trying to make my second condition about these providers. I don't want hardware specific credentials, or <insert multinational cloud provider> controlled credentials. The first introduces risks with damaged or stolen hardware, not to mention migration. The second introduces lack of control and enables these companies to track you. It's not lost on me that nearly all the companies offering authenticator apps are basically advertising companies: Google, Microsoft, Apple. They're getting in at the start for a reason
- georgyo 4y ago
  It does not need to be hardware specific. After all, talking to hardware is just software. Your password manger could implement passkey support. And I suspect that 1password will do that soon with their recent acquisition. The real benefit to passkeys is that password isn't sent over the wire, only the proof that you have the secret. Similar to SSH keys. This prevents a whole range of attacks.
  - account-5 4y ago
    I use keepassxc, I would love to manage my private/public keys in the same way I manage my passwords. I'm in complete control. But from my reading, and I believe the way this will be implemented but services, I doubt very much you'll be about to do this. Certainly at the moment it looks like vendor lock-in to me. Vendor lock-in with a heavy dose of targeted advertising.
  - 4y ago

worldsavior 4y ago

Using passwords is not something very comfortable, and needing to remember a password to a password manager, has some risks, like suddenly forgetting. Using a yubikey is also not very practical since it can be stolen or lost. A phone is always with us, and has small chances of being lost (also there are backups).

bennysonething 4y ago
I use a yubikey to secure my passwordsafe file https://pwsafe.org/ https://pwsafe.org/ Password safe runs on multiple operating systems. I sync my file to cloud storage so it's up to date on all my devices I have a backup key in a drawer and one on me at all times. I really need to buy a few more backup keys. It's not a perfect set up but it works for me.
- waych 4y ago
  Consider trying SyncThing to sync your files between your personal devices, rather than entrusting access to your data to a cloud provider. I did this recently and the experience has been surprisingly way easier and better than I could have imagined.
  - bennysonething 4y ago
    That looks great. Looks it might be viable for me. Security risk in my setup is is cloud storage. And also I'm relying on a password safe Dropbox sync app.
account-5 4y ago
A phone has the same chances of being lost and I would say a higher chance of being stolen. My question would be who is in control of the backups? The same vendors who want to lock you into their ecosystem?
- b112 4y ago
  And the same ones that also lock you out without recourse?

AeroNotix 4y ago

You don't have to be tied to a single device. A common set up is a root yubikey you create children of. The root key is held in a safe location and the children have either copies or even better, short live keys signed by the root.

account-5 4y ago
I'll have to take your word for it. That all seems complicated to me, maybe it's not and is just out of my frame of reference.
sebk 4y ago
YubiKeys can't have copies of themselves, that's a big portion of their selling point. As far as I know and strictily in FIDO, there is no solution here. The closest that Yubico has is this draft: https://github.com/Yubico/webauthn-recovery-extension https://github.com/Yubico/webauthn-recovery-extension which will roughly make an authenticator register two keys with an RP. The draft itself is not implemented anywhere as far as I know and while better than the current state of hardware key backups, it's still not problem free. I personally would love to see it implemented, so it can be used for logging in to the service that provides a WebAuthn sync fabric.
sigzero 4y ago
"passkeys in YubiKeys are bound to the YubiKey’s physical hardware where they can’t be copied." Unless you are talking about something entirely different that scenario isn't possible.
waych 4y ago
I don't know about this "root key" setup you describe, but you can certainly program sets of yubikeys with the same OTP secrets at setup time, resulting in cloned/backup keys. The OTP secrets can also be stored (presumably offline) to create new copies of the key in case of recovery.

sebk 4y ago

This concern is valid depending on your threat model, but improvements are quickly coming to this area. Apple, Microsoft, and Google have announced that they will allow syncing credentials between devices in their ecosystem (fully end-to-end encrypted, like a password manager), and several password managers have started to add software implementation of FIDO authenticators to their offerings. Hopefully in the near future we'll see the big vendors open up their APIs so that password managers can use the device hardware as well. Of course, multi-device passkeys will not work for high assurance situations, as TFA calls out, but that's not likely the case for any of the services you currently use a password manager for anyway. As it stands today, using passkeys with a software implementation, barring implementation bugs, is no less safe from credential loss than passwords in a password manager.

b112 4y ago
Apple, Microsoft, and Google have announced that they will allow syncing credentials While your comment is fair, and I know you were just providing info, from where I sit, these are the sort of entities I never, ever involve in any form of private work, security, or communication.
- toomuchtodo 4y ago
  This is a minority opinion though when compared to usage and market share of these orgs.
mistrial9 4y ago
as a US citizen, I absolutely do not accept these three giant companies running my access to financial services and governmental functions; just, no. Secondly, I will say that the entire surveillance-capitalism ideas of constant-on ID comes from a model of money lending that was built in the 1960s, ultimately by VISA and MasterCard. This worked well enough to generate the holders massive capital. no, no, no

izacus 4y ago

> I will probably use passwords until I am forcibly unable to. I'm happy with my password manager. A random password stored in a password manager is literally what a passkey is. Several password managers have announced support for storing passkeys just like your passwords.

arcanemachiner 4y ago
I've been keeping track of this GitHub issue to follow the progress of getting the feature in FOSS password managers: https://github.com/keepassxreboot/keepassxc/issues/8214 https://github.com/keepassxreboot/keepassxc/issues/8214 It appears that we are still in the "walled garden bullshit" phase, so I'll pass for now.
Biganon 4y ago
I don't understand your last sentence. If a random password stored in a password manager is a passkey, then all providers already support them
- jjnoakes 4y ago
  Passkey is about the random password stored in the password manager AND the protocol between the browser and the password manager to ensure the password isn't phished. It is the protocol that needs implementation.
Renevith 4y ago
"A random password stored in a password manager is literally what a passkey is." This is not quite true; a passkey is still somewhat more secure than a password in this scenario. With passwords, the password itself is sent to the website and a hashed version is stored in their database. If someone can intercept your connection to the site (MitM) or can access their database (hacker), they might be able to get your password and log in as you, especially if the website doesn't implement their hashing very well. These attack vectors don't apply to passkeys, even generated and synced by a software password manager: the private key never leaves your computer, only the corresponding pubic key. The website generates a unique challenge on each login that can only be solved by your private key, so intercepting a particular challenge or stealing the public key from the website database doesn't let anyone log in as you later.

jolmg 4y ago

> and that (at least from my understanding) are hard to transfer to new devices seems like a risk I'm unwilling to take. It's not really hard. They're quite flexible. You can't read the key from them, but you can write to them. You can generate the key outside, write it, save the backup somewhere you trust to be safe according to your threat model, and that's it. If you lose the device, buy a new one, write the key from the backup. The backup can also be used directly if you can't buy a new device for whatever reason. At least, this is how it works when used as an OpenPGP smartcard.

AugustoCAS 4y ago

I use keys as my default way of login but I have 'phishable' backup methods (OTP codes or backup codes). For me, the main thing is that using the keys by default make my accounts more secure and I would only use the phishable methods in case of emergency (if my house goes up in flames with my keys, computer, mobile, etc). One important thing for me was to remove my mobile number for SMS OTP or password reset, as sim cloning is a posibility. And a password manager is still indispensable as most sites don't accept hardware keys at all.

sudhirj 4y ago

Why is a passkey any different? Can’t one think of it as a password stored in a password manager? Is it more that you don’t want your browser to function as the password manager? There seems to be a API already for a browser to delegate passkey storage to a Yubikey, can’t a password manager do the same thing?

ilyt 4y ago
Browsers having just API for password managers is separate discussion but yes, that should happen. Password manager's job should not be to scrape pages for login fields. That still could be a separate plugin (if browser would not do job good enough), but password manager should really get credentials name, some metadata, notes and password to store, nothing more
cmdli 4y ago
Right now APIs for third parties are fairly limited, so it can be difficult to have support for passkeys with password managers. I was able to solve it for Bulwark Passkey (https://bulwark.id https://bulwark.id) by emulating a USB device and building the WebAuthN protocol off of that. This means that it supports all browsers, but also means that iOS support will be more difficult, though not impossible.

ilyt 4y ago

With how "secure" average app is I think there is probably much higher chance of them just fucking up than someone that uses password manager and doesn't run random shit off internet getting hacked. If it was "here is your private key, you can use it in sofware or you can load it on a key and just use" I'd be much calmer about it but the whole push "your authentication and sometimes whole identity is inseparably tied to your device" is frankly scary and disgusting.

cmdli 4y ago

I 100% agree. I really like the idea of getting rid of passwords, but I wanted to be able to control my own information. That is why I built Bulwark Passkey (https://bulwark.id https://bulwark.id), an open-source virtual passkey manager which allows you to export your credentials out of it, or sync them across devices. Passkeys have a lot of advantages, but the current plans for implementation are rather limited. If you're interested in passkeys that you can actually control, please check Bulwark Passkey out!

diggernet 4y ago
It looks like the only options are local-only (single device) or cloud-synced (bulwark cloud). I want credentials that are not tied to a single device OR tied to a cloud service. I want to be able to make backups to be used in the case of device failure or loss, and I don't want to be tied to some "underlying cloud account" (in Yubico's words). Just standalone, backupable credentials. Can you do that?