11 ms·
The transition from logins to cryptographic passkeys is getting messy
- michaelt 4y ago> Another big challenge with establishing consistency and continuity will be the long transition to passkeys alone. If I wanted passwordless login, why wouldn't I just hit the big 'sign in with facebook' button practically every website has these days?
- vuryleo 4y agoand login facebook w/ password
- izacus 4y agoBecause passkey is owned by you (as in - whichever software vault you're using) and not Facebook. It's no different than stored random 32 character passwords in a password manager... it's pretty much the same really, just that you don't have to copy/paste it in a form.
- KyeRussell 4y agoI think that this question is being posed from the perspective of a civilian.
- izacus 4y agoWhat's a "civilian" in your context?
- Am4TIfIsER0ppos 4y agoProbably: a normie, a layman, the ignorant masses who should never have been given a computer.
- swiftcoder 4y ago> whichever software vault you're using Do consumers perceive a significant difference between "login with Facebook" and "login with LastPass"? In both cases I'm delegating my security credentials to a cloud service I have limitted influence over.
- postalrat 4y agoPasskeys don't require any cloud provider.
- swiftcoder 4y agoIn theory, no, but in practice if I don't have a cloud provider backing up my passkeys, I'm just going to lose them all next time my phone/computer dies (same problem as with local-only 2fac code generators today).
- edgyquant 4y ago[flagged]
- SheinhardtWigCo 4y agoIt's more like a 1000 character password that can only be extracted or transferred to other devices via methods provided by the developer of the software vault. The purpose is lock-in, not security.
- ssss11 4y agoIf you like Facebook tracking everything you do, and the data breach risk associated with their copy of your entire online life, then go for it.
- coldtea 4y agoWouldn't that give somebody having access to your FB account access to every website you used FB login for? At minimum you'd still need 2FA with that to avoid this.
- nly 4y agoIt also gives Facebook themselves access to every service you can 'Login with Facebook' with
- iopq 4y agoOr was it sign in with Google? No, on this website I signed up with Github. I think?
- jeroenhd 4y agoI deleted my Facebook account. I lost access to several accounts that way, luckily none of them were important. At least this time I chose to close my account. Next time it can be Facebook/Google/Microsoft/Twitter/Apple who decide that you're a robot/fraud/whatever after receiving a bunch of automated reports. If Google ever bans me, I'm screwed in many different yet interesting ways.
- AlexandrB 4y agoWhat's really scary is how account access can be lost in retaliation for exercising your rights as a customer (e.g. chargebacks, "too many" returns, lawsuits, etc). As FAANG expand into more parts of our lives there are more and more things you're legally allowed to do but shouldn't do if you want to maintain access to all your shit. The TOSs of these vendors can become a de-facto legal regime that limits your rights in new and exciting ways.
- xracy 4y agoPart of the problem is that right now the most convenient use of things like yubikeys is that the most convenient use of them is just leave them in your computer wherever they may be. That makes them a pretty hard sell for any workplace environment, but also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... Seems like 2FA is the future...
- Helmut10001 4y agoI also decided against yubikey and for Password manager + 2FA (TOTP), for this reason.
- trollied 4y agoPasskey can also use biometrics, if supported by the OS/browser.
- hackernewds 4y agoThe weakest link in security system will always be the humans expected to keep them secure
- md_ 4y agoThis is an extraordinarily bad take. :) - The biggest threat almost all users face is in the form of remote attackers: password phishing, database leaks + password reuse, tricking users into installing malware, etc. Local attackers are so far down the list of concerns that, really, using unique passwords and storing them on Post-Its is, for most people, an improvement in security! - Leaving a Yubikey in the computer is, in fact, the normal, intended mode of operation--that's why Yubico makes low-profile keys that you can just leave in your USB port. Yes, an attacker can just steal the key, but the key alone is insufficient to authenticate in most uses; almost all relying parties using keys that don't support user verification will also require a password. - The article was about passkeys, not FIDO security keys. Subtle difference, but, importantly, passwordless authn using passkeys requires the authenticator to support "user verification" mode (like a PIN/screenlock/biometric).
- 4y ago
- Eduard 4y agohttps://archive.is/1xai9 https://archive.is/1xai9
- nly 4y agoJust give me password auth back. I work in a lab that requires fingerprint login (TrustKey FIDO keys) with no fallback. Every 6-8 weeks I need to have my keys reset with new prints, which is a process that involves meeting a member of the security team in a room for 20 minutes so my key and the backup key (kept in a safe by the firm) can both be reset. Everyday, without fail, I sit there like a chimp taking on average 2 minutes to unlock my workstation. This happens maybe 5 times per day.
- rwmj 4y agoHow does that work for people with poor/unreadable fingerprints? We're 3% of the general population apparently.
- brazzy 4y agoA sane setup would provide an alternative to unlock the passkey, with a PIN. Yes, you're back to entering a password, but you don't have most of the weaknesses and pitfalls of password-based logins in distributed systems (phishing,credential stuffing,keyloggers probably a few others).
- deleted 4y ago[deleted]
- pinkcan 4y agoIt's a ceremony, it's ego stroking.
- freeone3000 4y agoDo they expect your fingerprints to have changed?
- swiftcoder 4y agoUnfortunately, fingerprints do change. Cut your thumb slicing tomatoes? Have fun logging in for the next few days. Took up a fun new hobby, like, say, blacksmithing, or ceramic sculpture? Say permanent goodbye to your fingerprints ever scanning correctly again...
- crooked-v 4y agoI can't wait for companies to use secure passkeys and still force me to use SMS 2FA with no option to disable it.
- pch00 4y agoMicrosoft "consumer" (live.com, etc) accounts are like this. They have a whole set of advanced, secure options like security keys, TOTP, etc but they force you to have either an email or SMS recovery option configured :( Google on the other hand, do this correctly. You can configure a consumer Google account to only have secure options listed.
- probably_wrong 4y ago> Google on the other hand, do this correctly. You can configure a consumer Google account to only have secure options listed. Are you sure about that? I couldn't activate 2FA in my Google account for years because they didn't enable the option without giving a phone number first. Based on my HN experience, many users gave their phone number from the get go and therefore didn't notice that they couldn't activate 2FA without it.
- pch00 4y ago> Are you sure about that? I couldn't activate 2FA in my Google account for years because they didn't enable the option without giving a phone number first. Just checked, and yes, no phone or email recovery methods configured.
- eep_social 4y agoThe trick with a newly created google account (assuming the regular account creation flow) is to give a phone number at signup and then remove it. There are some non-standard account creation workflows that used to work without a phone number at all but I haven’t tired recently and iirc the last time I did it didn’t take long for google to require me to “verify” my humanity with a phone number.
- sdflhasjd 4y ago
- _448 4y agoOh, what could go wrong! Why is there no discussion on users losing their private keys? Ask all those cryptocurrency users who lost their private keys. Now don't tell that there are crypto wallets/vaults that manage private keys; there are many ways key can be lost even when using wallets/vaults. We engineers live in a different world, disconnected from the regular users who have no clue what public-private keys are!
- jeroenhd 4y agoThe standard mantra for physical key-based 2FA has always been "register two keys and keep one in a safe", which seems doable for important accounts (like banks and government stuff) but no way am I going to get a key out of my safe when I want to order a replacement part on JoesDiscountDishwasherParts.biz. I really wish there was a way to register your backup key through your primary key. Luckily, FIDO2 can fix a lot of these problems. People who don't have significant security needs can use a trusted service (currently Apple, Google, and a few small companies) rather than a physical device. Lose your phone? As long as you can get your account onto a new one, you can still access all of your stuff. Once this type of auth will take off, I can imagine a business model for a FIDO2 company that focuses on customer service. The only problem with the system right now is that if you can't log in to your Apple/Google/whatever account, there's no recovery. Try contacting customer support and see how long it takes until they just block your number, because there is nothing they can do. Having a business where you can go to a physical office and show up with ID so you can get your account back would solve this problem. Recovery would still be a massive pain, but it's better than spending years on a legal battle like some people trying to get their pictures back from their cloud providers after getting locked out.
- nmca 4y agoWait - the way this works is you have a backup key, if you lose your primary you replace it using your backup. NB this is only needed when you move to a new device with a new secure enclave too, so at no point is this pizza situation likely.
- 4y ago
- wslh 4y agohttps://archive.is/1xai9 https://archive.is/1xai9
- RobotToaster 4y agoDoesn't this just mean handing over authentication keys to proprietary systems? I couldn't find a single open source hardware FIDO L2 implementation. Looking at the specification, is it even possible for an open source implementation to gain L3+ certification?
- crote 4y agoTo the people designing this it is a feature, not a bug. Authenticator certification is inherently incompatible with open source, so you are forced to use a proprietary implementation.
- upofadown 4y agoThe root issue here is that most people do not know how identities based on public/private keys work. So the stuff about using bluetooth and and QR codes is just a pointless and meaningless ritual. If anything goes wrong the user will have no idea about what they should do to resolve that issue. They won't know what they have to do to prevent things from going wrong. The modern cryptography that this stuff is based on was invented only 40 years ago. There is as of yet no useful cultural context to base systems on. You can't expect people to be able to use concepts that don't really exist yet.
- doodlesdev 4y agoMaybe we should create a religion around cryptography and share the knowledge as sacred books, this way the knowledge won't be lost regardless of context or culture and will be subconsciously in everyone's minds (even the atheists since they will also be exposed to it).
- 007asdflkjsfd 4y agoName one system that accepts passkeys and allows you to setup two of them. as is the recommended best practice everywhere. even OTP tokens generators goes to great lengths to give a false sense o security that their seed is unique simply by hiding it from the user UI. Google authenticator will happily save the seed and seed tokens in their cloud and allow you to restore. all while still hiding it from the user. if you have twenty accounts on your OTP, and get a new phone, you have to log in on each site/product. Disable and re-enable 2fa. That's some 2~5min each. back to passkeys... do you think this will last when google is getting tons of spam on gmail because microsoft is not careful on their spam bot protection? likely google will just shutdown the integration and demand you use google or apple for gmail. This will happen all over all the time.
- dvzk 4y agoLike 99% of people in this thread, you are conflating distributed non-device-bound credentials (passkeys) with hardware security keys.
- donmcronald 4y ago> distributed non-device-bound credentials If they can be distributed they can be stolen, right? I don't see how it's any better than a password manager at that point.
- dvzk 4y agoYes. Depending on the threat model, it may or may not be better. Many organizations won't be allowing remote passkey sign-in for employees. For people at home, the elimination of passwords will reduce rates of phishing and credential-stuffing attacks.
- Ajedi32 4y agoIt seems like most people commenting here don't know what passkeys are. I'm seeing a lot of complaints about things that simply aren't a problem with Passkeys, only with plain WebAuthn. Passkeys are based on WebAuthn, but they are not the same from a user experience perspective. The simplest way to describe Passkeys would be "WebAuthn, but with the keys stored in a password manager instead of being tied to a specific device." Apple has a pretty good overview of how things look from a user's perspective: https://support.apple.com/guide/iphone/sign-in-with-passkeys-iphf538ea8d0/ios https://support.apple.com/guide/iphone/sign-in-with-passkeys... Note that while that while that article is about Apple's specific implementation, passkeys are an open standard with multiple independent implementations. The biggest issue with Passkeys right now (aside adoption by sites) is vendor lock in. Many implementations don't allow the key database to be exported or transferred to a different Passkey client. That's an issue with those implementations though, not an inherent problem with the protocol.
- eep_social 4y ago> Passkeys on iPhone require that you use iCloud Keychain. If you don’t have iCloud Keychain turned on when you try to save a passkey, you’ll be asked to turn it on. Passkeys also require that two-factor authentication is enabled for your Apple ID. Nope, sorry. Enshittification makes this entire concept, as-presented, a non-starter.
- philsnow 4y agoWhich is the "shitty" part, 2FA on apple ID or iCloud Keychain? Both?
- Ajedi32 4y agoThat's how credential management works on iOS. The built-in password manager works the same way. What exactly is your concern?
- eep_social 4y agoYeah and I don’t use that except where it’s unavoidable (wifi passwords) because apple cannot be trusted any more than any other public company.