5 ms·

Goodbye, passwords (1Password Passkey support)

45 points by dewey 4y ago

vlmutolo 4y ago
I wonder if they’ll try to rebrand as “1Pass” or something similar.
- rvz 4y ago
  Makes sense. It will not be surprising to see them shorten their name.
sebk 4y ago
The blogpost manages to not explain what they actually intend to do, but I assume it means WebAuthn PRF. The general idea is nice and it works, but it's hindered by the fact that sync fabrics aren't interoperable or pluggable. Let's say you have an iPad, a Windows PC, and an Android phone, and you set up your 1Password account using a Passkey (0Password?) in your iPad, and now you want to set it up on your Windows PC... except there's no way to sync your Passkey from the Apple sync fabric to the Microsoft sync fabric, so you need some sort of shareable secret between those from which an encryption key can be derived -- a password + secret key. After that set up the encryption key you just derived can be wrapped with a key generated from the Microsoft sync fabric prf and the process starts again with Android. You've managed to unlock all your devices using WebAuthn, but you didn't manage to get rid of the password, and if you decide to change it, then you're in for the whole ride again. The blogpost also reads Use your phone to unlock 1Password on your Mac, PC, and in the browser, so I assume the way to get around the sync fabric problem they envision using is relying on your phone's sync fabric, and relaying the encryption key through hybrid transport, then prompting you to store a Passkey in that new device, which is still a hassle but you don't need a master password for. It is critical for the health of the ecosystem that OS vendors adopt APIs so that third-party vendors can plug-in TPM-backed sync fabrics that work across manufacturers. Several third-party vendors have joined the FIDO alliance, so I'm hopeful.
- alyandon 4y ago
  So far all I've seen mention of is MacOS, Windows, iOS and Android. Where will Linux running on older non-TPM hardware platforms fit into this ecosystem?
  - sebk 4y ago
    For _using_ WebAuthn, Linux without a TPM has the option of using a hardware key like a Yubikey or Nitrokey, or a virtual authenticator like what 1Password proposes here: https://www.future.1password.com/passkeys/ https://www.future.1password.com/passkeys/ For _syncing_ WebAuthn passkeys, then virtual authenticators that sync over the wire like 1Password above is the only option. Using virtual authenticators means that your key material is in-memory alongside the OS and all running apps. That's why it's so critical that OSs expose pluggable sync fabrics; so that vendors like 1Password, or even YubiCo, can implement sync fabrics that roam through whatever hardware the current platform happens to have available.
    - alyandon 4y ago
      Hrm... how would these master keys get stored securely on Linux without a dedicated TPM? It seems that all these methods seem to want to desperately replace "something I know" with "something I have" that can break, get lost/stolen, etc. That is not a very enticing scenario for me.
- kosherhurricane 4y ago
  > except there's no way to sync your Passkey from the Apple sync fabric to the Microsoft sync fabric This is by design. > so you need some sort of shareable secret between those from which an encryption key can be derived No, you just authenticate with your iPad passkey (using qr code), and then generate a new passkey on your Windows PC, which will now sync between your windows devices. So no sharing of secrets between sync-clouds is needed, just one time sideways authentication. I'm guessing 1password is just another passkey that they store/sync.
  - 4y ago
kosherhurricane 4y ago
I love the idea of passkeys. They will be so great for my parents and grandparents. I love the fact that Apple/Google/Microsoft are onboard, and now have implementations. So why the frack are Apple/Google/Microsoft don't support passkeys on their own systems yet? They don't even support Webaunth. These guys really need to set an example if they are actually serious about passkey.
- sebk 4y ago
  >They don't even support Webaunth. Apple iCloud supports WebAuthn as of two months ago: https://www.apple.com/newsroom/2022/12/apple-advances-user-security-with-powerful-new-data-protections/ https://www.apple.com/newsroom/2022/12/apple-advances-user-s... Google has supported WebAuthn for quite a while as well: https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ I'm not very familiar with Microsoft's ecosystem and I believe it's a bit more fragmented, but it seems that at least some portions of it do support it: https://support.microsoft.com/en-us/account-billing/how-to-go-passwordless-with-your-microsoft-account-674ce301-3574-4387-a93d-916751764c43 https://support.microsoft.com/en-us/account-billing/how-to-g...
  - kosherhurricane 4y ago
    Both Apple and Google use webauthn as second factor, never the first.
  - DangitBobby 4y ago
    I tried WebAuthn for the first time on MacOS a few weeks ago (on the WebAuthn demo site), and the site inexplicably didn't support the key that I've been using for the last 4 years for 2FA. It didn't even bother explaining what the problem was, but I assume they want me to buy Yet Another Physical Device if I want to participate. It's definitely still not there, and at this point I don't have high hopes for the future.
mvkel 4y ago
What's the UX like when you do your annual device upgrade?
nateb2022 4y ago
Dupe Goodbye, passwords, https://news.ycombinator.com/item?id=34725322 https://news.ycombinator.com/item?id=34725322, 2 days ago, 10 points, 2 comments
syntheticcdo 4y ago
Their implementation doesn't seem standards compliant. I installed the newest 1Password extension in Chrome and then went to the https://webauthn.io/ https://webauthn.io/ demo and clicked register -- 1Password did nothing, but the Chrome WebAuthn dialog took control. Edit: Interestingly enough, the demo site is listed in 1Password's own directory: https://passkeys.directory/details/web-authn-io/ https://passkeys.directory/details/web-authn-io/
knaik94 4y ago
Passkeys aren't protected when it comes to laws regarding self-incrimination and searches. Information encrypted and locked behind a password, something only you know, is protected. Until laws surrounding biometrics are changed, I personally won't move to passkeys. There have been cases where biometrics have been protected under the same category as pins and passwords but there have also been cases where it was not. https://www.concordlawschool.edu/blog/constitutional-law/fifth-amendment-biometrics/ https://www.concordlawschool.edu/blog/constitutional-law/fif...
- shortcake27 4y ago
  Also, haven’t people been going on for years about how biometrics are _not_ passwords? I would personally feel far less secure replacing my master password with a passkey, especially if the biometric is fingerprint. But I guess this increases security for the vast majority of people while decreasing security for a small minority. Which is probably still an overall win. I’ll continue using a strong master password for as long as it’s possible.
  - tadfisher 4y ago
    Passkeys are tokens that have nothing to do with your biometric data. When you "unlock" a passkey on a smartphone, you are granting access to decrypt the token using a secure element coprocessor. Your biometric data is not the passkey, is only used for local authentication, and does not leave the device.
    - shortcake27 4y ago
      > Passkeys are tokens that have nothing to do with your biometric data. Did you read the linked article? 1Password is allowing users to avoid having a master password at all, instead allowing them to use only biometrics to access their vaults. So this specific implementation that we're talking about right now very much has something to do with biometrics. > Your biometric data is not the passkey. Never said it was. > is only used for local authentication, and does not leave the device. Not my concern. My concern is that my biometric data is public. The same fingerprint that would unlock my phone/laptop also happens to be plastered all over said devices as well as everything else I touch. Plenty of videos on YouTube where people have lifted fingerprints and unlocked devices. Most facial recognition technologies can be fooled with a photo. I have a serious issue with someone being able to access my 1Password vault without needing a secret such as a password that only I know. FaceID is probably the only technology I'd trust to prevent unauthorised access, but as the parent mentioned, biometrics are a bit of a grey area - in certain countries / jurisdictions you can be forced to unlock a device using biometrics even if it's illegal to force a password out of you.
im3w1l 4y ago
What I dont understand is how they store your password-db in a safely encrypted manner, when there isn't a password to encrypt it with. It seems that either losing your device is fatal (if the encryption key is stored in some trusted tamper resistant chip on device), or 1password can access all your passwords in plaintext?
- vlmutolo 4y ago
  I believe I read that 1Password will allow unlocking with a hardware token, like a Yubikey. I wonder if they’ll use the PGP capabilities of the Yubikey to allow decryption.
- sebk 4y ago
  The blogpost is light on details but they’re most likely using WebAuthn prf which was designed with this use case in mind: https://w3c.github.io/webauthn/#prf-extension https://w3c.github.io/webauthn/#prf-extension , with the idea that it’s backed by a sync fabric rather than a single hardware device.
jacooper 4y ago
Bitwarden is working on this too https://community.bitwarden.com/t/store-webauthn-fido2-credentials-in-bitwarden-passkey-support/42153/13 https://community.bitwarden.com/t/store-webauthn-fido2-crede...

45 points by dewey 4y ago

vlmutolo 4y ago

I wonder if they’ll try to rebrand as “1Pass” or something similar.

rvz 4y ago
Makes sense. It will not be surprising to see them shorten their name.

sebk 4y ago

The blogpost manages to not explain what they actually intend to do, but I assume it means WebAuthn PRF. The general idea is nice and it works, but it's hindered by the fact that sync fabrics aren't interoperable or pluggable. Let's say you have an iPad, a Windows PC, and an Android phone, and you set up your 1Password account using a Passkey (0Password?) in your iPad, and now you want to set it up on your Windows PC... except there's no way to sync your Passkey from the Apple sync fabric to the Microsoft sync fabric, so you need some sort of shareable secret between those from which an encryption key can be derived -- a password + secret key. After that set up the encryption key you just derived can be wrapped with a key generated from the Microsoft sync fabric prf and the process starts again with Android. You've managed to unlock all your devices using WebAuthn, but you didn't manage to get rid of the password, and if you decide to change it, then you're in for the whole ride again. The blogpost also reads Use your phone to unlock 1Password on your Mac, PC, and in the browser, so I assume the way to get around the sync fabric problem they envision using is relying on your phone's sync fabric, and relaying the encryption key through hybrid transport, then prompting you to store a Passkey in that new device, which is still a hassle but you don't need a master password for. It is critical for the health of the ecosystem that OS vendors adopt APIs so that third-party vendors can plug-in TPM-backed sync fabrics that work across manufacturers. Several third-party vendors have joined the FIDO alliance, so I'm hopeful.

alyandon 4y ago
So far all I've seen mention of is MacOS, Windows, iOS and Android. Where will Linux running on older non-TPM hardware platforms fit into this ecosystem?
- sebk 4y ago
  For _using_ WebAuthn, Linux without a TPM has the option of using a hardware key like a Yubikey or Nitrokey, or a virtual authenticator like what 1Password proposes here: https://www.future.1password.com/passkeys/ https://www.future.1password.com/passkeys/ For _syncing_ WebAuthn passkeys, then virtual authenticators that sync over the wire like 1Password above is the only option. Using virtual authenticators means that your key material is in-memory alongside the OS and all running apps. That's why it's so critical that OSs expose pluggable sync fabrics; so that vendors like 1Password, or even YubiCo, can implement sync fabrics that roam through whatever hardware the current platform happens to have available.
  - alyandon 4y ago
    Hrm... how would these master keys get stored securely on Linux without a dedicated TPM? It seems that all these methods seem to want to desperately replace "something I know" with "something I have" that can break, get lost/stolen, etc. That is not a very enticing scenario for me.
kosherhurricane 4y ago
> except there's no way to sync your Passkey from the Apple sync fabric to the Microsoft sync fabric This is by design. > so you need some sort of shareable secret between those from which an encryption key can be derived No, you just authenticate with your iPad passkey (using qr code), and then generate a new passkey on your Windows PC, which will now sync between your windows devices. So no sharing of secrets between sync-clouds is needed, just one time sideways authentication. I'm guessing 1password is just another passkey that they store/sync.
- 4y ago

kosherhurricane 4y ago

I love the idea of passkeys. They will be so great for my parents and grandparents. I love the fact that Apple/Google/Microsoft are onboard, and now have implementations. So why the frack are Apple/Google/Microsoft don't support passkeys on their own systems yet? They don't even support Webaunth. These guys really need to set an example if they are actually serious about passkey.

sebk 4y ago
>They don't even support Webaunth. Apple iCloud supports WebAuthn as of two months ago: https://www.apple.com/newsroom/2022/12/apple-advances-user-security-with-powerful-new-data-protections/ https://www.apple.com/newsroom/2022/12/apple-advances-user-s... Google has supported WebAuthn for quite a while as well: https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ I'm not very familiar with Microsoft's ecosystem and I believe it's a bit more fragmented, but it seems that at least some portions of it do support it: https://support.microsoft.com/en-us/account-billing/how-to-go-passwordless-with-your-microsoft-account-674ce301-3574-4387-a93d-916751764c43 https://support.microsoft.com/en-us/account-billing/how-to-g...
- kosherhurricane 4y ago
  Both Apple and Google use webauthn as second factor, never the first.
- DangitBobby 4y ago
  I tried WebAuthn for the first time on MacOS a few weeks ago (on the WebAuthn demo site), and the site inexplicably didn't support the key that I've been using for the last 4 years for 2FA. It didn't even bother explaining what the problem was, but I assume they want me to buy Yet Another Physical Device if I want to participate. It's definitely still not there, and at this point I don't have high hopes for the future.

mvkel 4y ago

What's the UX like when you do your annual device upgrade?

nateb2022 4y ago

Dupe Goodbye, passwords, https://news.ycombinator.com/item?id=34725322 https://news.ycombinator.com/item?id=34725322, 2 days ago, 10 points, 2 comments

syntheticcdo 4y ago

Their implementation doesn't seem standards compliant. I installed the newest 1Password extension in Chrome and then went to the https://webauthn.io/ https://webauthn.io/ demo and clicked register -- 1Password did nothing, but the Chrome WebAuthn dialog took control. Edit: Interestingly enough, the demo site is listed in 1Password's own directory: https://passkeys.directory/details/web-authn-io/ https://passkeys.directory/details/web-authn-io/

knaik94 4y ago

Passkeys aren't protected when it comes to laws regarding self-incrimination and searches. Information encrypted and locked behind a password, something only you know, is protected. Until laws surrounding biometrics are changed, I personally won't move to passkeys. There have been cases where biometrics have been protected under the same category as pins and passwords but there have also been cases where it was not. https://www.concordlawschool.edu/blog/constitutional-law/fifth-amendment-biometrics/ https://www.concordlawschool.edu/blog/constitutional-law/fif...

shortcake27 4y ago
Also, haven’t people been going on for years about how biometrics are _not_ passwords? I would personally feel far less secure replacing my master password with a passkey, especially if the biometric is fingerprint. But I guess this increases security for the vast majority of people while decreasing security for a small minority. Which is probably still an overall win. I’ll continue using a strong master password for as long as it’s possible.
- tadfisher 4y ago
  Passkeys are tokens that have nothing to do with your biometric data. When you "unlock" a passkey on a smartphone, you are granting access to decrypt the token using a secure element coprocessor. Your biometric data is not the passkey, is only used for local authentication, and does not leave the device.
  - shortcake27 4y ago
    > Passkeys are tokens that have nothing to do with your biometric data. Did you read the linked article? 1Password is allowing users to avoid having a master password at all, instead allowing them to use only biometrics to access their vaults. So this specific implementation that we're talking about right now very much has something to do with biometrics. > Your biometric data is not the passkey. Never said it was. > is only used for local authentication, and does not leave the device. Not my concern. My concern is that my biometric data is public. The same fingerprint that would unlock my phone/laptop also happens to be plastered all over said devices as well as everything else I touch. Plenty of videos on YouTube where people have lifted fingerprints and unlocked devices. Most facial recognition technologies can be fooled with a photo. I have a serious issue with someone being able to access my 1Password vault without needing a secret such as a password that only I know. FaceID is probably the only technology I'd trust to prevent unauthorised access, but as the parent mentioned, biometrics are a bit of a grey area - in certain countries / jurisdictions you can be forced to unlock a device using biometrics even if it's illegal to force a password out of you.

im3w1l 4y ago

What I dont understand is how they store your password-db in a safely encrypted manner, when there isn't a password to encrypt it with. It seems that either losing your device is fatal (if the encryption key is stored in some trusted tamper resistant chip on device), or 1password can access all your passwords in plaintext?

vlmutolo 4y ago
I believe I read that 1Password will allow unlocking with a hardware token, like a Yubikey. I wonder if they’ll use the PGP capabilities of the Yubikey to allow decryption.
sebk 4y ago
The blogpost is light on details but they’re most likely using WebAuthn prf which was designed with this use case in mind: https://w3c.github.io/webauthn/#prf-extension https://w3c.github.io/webauthn/#prf-extension , with the idea that it’s backed by a sync fabric rather than a single hardware device.

jacooper 4y ago

Bitwarden is working on this too https://community.bitwarden.com/t/store-webauthn-fido2-credentials-in-bitwarden-passkey-support/42153/13 https://community.bitwarden.com/t/store-webauthn-fido2-crede...