4 ms·

> Tying login credentials to a hardware device The article specifically states (about passkeys as opposed to Yubikeys): > They’re different because Platform c

> Tying login credentials to a hardware device The article specifically states (about passkeys as opposed to Yubikeys): > They’re different because Platform created passkeys will be copyable by default using the credentials for the underlying cloud account (plus maybe an additional password manager sync passphrase), whereas passkeys in YubiKeys are bound to the YubiKey’s physical hardware where they can’t be copied. That brings its own challenges of course (e.g. you have to trust the Cloud syncing and E2EE by the vendors).

account-5 4y ago
Apologies I was trying to make my second condition about these providers. I don't want hardware specific credentials, or <insert multinational cloud provider> controlled credentials. The first introduces risks with damaged or stolen hardware, not to mention migration. The second introduces lack of control and enables these companies to track you. It's not lost on me that nearly all the companies offering authenticator apps are basically advertising companies: Google, Microsoft, Apple. They're getting in at the start for a reason
- georgyo 4y ago
  It does not need to be hardware specific. After all, talking to hardware is just software. Your password manger could implement passkey support. And I suspect that 1password will do that soon with their recent acquisition. The real benefit to passkeys is that password isn't sent over the wire, only the proof that you have the secret. Similar to SSH keys. This prevents a whole range of attacks.
  - account-5 4y ago
    I use keepassxc, I would love to manage my private/public keys in the same way I manage my passwords. I'm in complete control. But from my reading, and I believe the way this will be implemented but services, I doubt very much you'll be about to do this. Certainly at the moment it looks like vendor lock-in to me. Vendor lock-in with a heavy dose of targeted advertising.
  - aniforprez 4y ago
    1Password already has passkey support in development. They have a demo[0] which works on the latest version of the browser extension. It even syncs with my Macbook and Windows machines though unfortunately doesn't work on Android yet [0] https://www.future.1password.com/passkeys/#demo https://www.future.1password.com/passkeys/#demo
- brookst 4y ago
  I’m not seeing the threat model. Assuming E2EE of the password manager, how does it track you when syncing keys across devices? Also, how is Microsoft not an enterprise security company? Their revenue from security products is probably 100x that from advertising.
  - account-5 4y ago
    Apologies I don't understand your first paragraph. I'm preferring my password manager because it doesn't track me. It's offline and local. Microsoft might be an enterprise security company. But they are clearly all about tracking and targeting their users too. The two things are not mutually exclusive.
    - brookst 4y ago
      Re: first point, I don’t see how E2EZe sync of keychains exposes you to targeted advertising. My understanding of the systems is that they use a single encrypted DB that does not expose either the sites, usernames, or passwords to the provider. I’d welcome correction if you know otherwise. Re: Microsoft, I suppose there’s no harm in being maximally suspicious. But I have some knowledge of their systems and Google’s and Microsoft does not have , for instance, a single user profile that joins interests and infers demographic data like Google does. I expect the same is true for Apple.
      - account-5 4y ago
        My concern is that of relying on one of these vendors for managing the passkeys. And their knowledge of which sites I have accounts with. And my suspicion you'll have an extremely hard time migrating devices and vendors. I've no internal knowledge of MS systems but the fact that they make it hard to use their operating system without an online account and you can't opt out of all telemetry and the fact it's default opt-in for all telemetry leads me to be extremely suspicious of them. I'm not saying they're any worse than Google or Apple.
        brookst 4y ago

account-5 4y ago

Apologies I was trying to make my second condition about these providers. I don't want hardware specific credentials, or <insert multinational cloud provider> controlled credentials. The first introduces risks with damaged or stolen hardware, not to mention migration. The second introduces lack of control and enables these companies to track you. It's not lost on me that nearly all the companies offering authenticator apps are basically advertising companies: Google, Microsoft, Apple. They're getting in at the start for a reason

georgyo 4y ago
It does not need to be hardware specific. After all, talking to hardware is just software. Your password manger could implement passkey support. And I suspect that 1password will do that soon with their recent acquisition. The real benefit to passkeys is that password isn't sent over the wire, only the proof that you have the secret. Similar to SSH keys. This prevents a whole range of attacks.
- account-5 4y ago
  I use keepassxc, I would love to manage my private/public keys in the same way I manage my passwords. I'm in complete control. But from my reading, and I believe the way this will be implemented but services, I doubt very much you'll be about to do this. Certainly at the moment it looks like vendor lock-in to me. Vendor lock-in with a heavy dose of targeted advertising.
- aniforprez 4y ago
  1Password already has passkey support in development. They have a demo[0] which works on the latest version of the browser extension. It even syncs with my Macbook and Windows machines though unfortunately doesn't work on Android yet [0] https://www.future.1password.com/passkeys/#demo https://www.future.1password.com/passkeys/#demo
brookst 4y ago
I’m not seeing the threat model. Assuming E2EE of the password manager, how does it track you when syncing keys across devices? Also, how is Microsoft not an enterprise security company? Their revenue from security products is probably 100x that from advertising.
- account-5 4y ago
  Apologies I don't understand your first paragraph. I'm preferring my password manager because it doesn't track me. It's offline and local. Microsoft might be an enterprise security company. But they are clearly all about tracking and targeting their users too. The two things are not mutually exclusive.
  - brookst 4y ago
    Re: first point, I don’t see how E2EZe sync of keychains exposes you to targeted advertising. My understanding of the systems is that they use a single encrypted DB that does not expose either the sites, usernames, or passwords to the provider. I’d welcome correction if you know otherwise. Re: Microsoft, I suppose there’s no harm in being maximally suspicious. But I have some knowledge of their systems and Google’s and Microsoft does not have , for instance, a single user profile that joins interests and infers demographic data like Google does. I expect the same is true for Apple.
    - account-5 4y ago
      My concern is that of relying on one of these vendors for managing the passkeys. And their knowledge of which sites I have accounts with. And my suspicion you'll have an extremely hard time migrating devices and vendors. I've no internal knowledge of MS systems but the fact that they make it hard to use their operating system without an online account and you can't opt out of all telemetry and the fact it's default opt-in for all telemetry leads me to be extremely suspicious of them. I'm not saying they're any worse than Google or Apple.
      - brookst 4y ago