4 ms·

I like to explain it like this: If you use a password manager today, then you're already essentially using something you have, because you need to be in posses

by dcow 4y ago

I like to explain it like this: If you use a password manager today, then you're already essentially using something you have, because you need to be in possession of your login database to retrieve passwords, and nobody can remember that in their head. Passkeys is a formalization of the idea that you should be using a password manager where all the passwords are random uncrackable 32 character strings, and if we add this constraint then we can crazy secure things like employ asymmetric crypto to prevent phishing and MITM attacks, so woO!. You are right to be concerned about the whole device thing though. Apple addresses this by requiring that you use/enable iCloud keychain in order to use passkeys. The generalized solution to this is allowing 3rd parties to be your passkey provider, so that you can choose how your passkeys are stored (cloud synced vs device bound) and e.g. whether you want an implementation where you can unlock them with one strong something you know, something you are, something your have, or any combination thereof, the only limit being the features/options the different 3rd party products will offer, depending on their target market, etc.

JohnFen 4y ago
> The generalized solution to this is allowing 3rd parties to be your passkey provider, so that you can choose how your passkeys are stored The password manager I use has no cloud component (which is why I chose it), and addresses this by allowing me to export my password collection to an encrypted backup file. Would this be a thing that the passkey folks would be OK with? That would ease a lot of my hesitation.
- snowwrestler 4y ago
  Yes you can just use a hardware FIDO token like a Yubikey as your passkey. And you can enroll more than one, so if you lose or wreck one, you’re not locked out.
  - danShumway 4y ago
    This is not really the same thing as what GP is asking? They're asking about backing up existing keys, you're talking about creating new ones. I can back up my entire password database just by copying a file. To "back up" a Yubikey I buy a new key then I individually visit every single site I have an account on and attach a new key one by one. That's not equivalent. It also makes setup a lot less convenient than a password manager would be. Every time I set up an account I need to set up two devices? And ideally they should be stored in different places, just having 2 Yubikeys in my pocket isn't really doing much for me, so now every signup is literally a 2-step process that involves going to 2 locations. "Just" is doing a lot of work here.
    - tadfisher 4y ago
      You are describing the tradeoff made by passkeys, yes. The idea is that it shouldn't be possible for someone to phish your passkey, because lives on a piece of hardware and signs challenges, but is not transmitted to the requesting party (or to anyone). Luckily, passkey "syncing" and "backup" means issuing a new key that's signed by an old key, so you can in fact have the convenience of paper-based backups if you want (that's how the QR codes work for syncing between passkey managers). I trust you can appreciate how this improves security in general, by trading some convenience.
      - pabs3 4y ago
        Would be nice if there were something like pass-otp for passkeys :)
      - danShumway 4y ago
        > The idea is that it shouldn't be possible for someone to phish your passkey, because lives on a piece of hardware and signs challenges, but is not transmitted to the requesting party (or to anyone). Passkeys don't live only on the device. iOS syncs to the cloud. They're not unphishable. You can lose your iPhone, get a new iPhone and get all of your passkey logins without having access to the old iPhone. If someone tricks you into giving access to your iCloud account, they can get your passkeys. Heck, if someone tricks you into doing an airdrop, they can get a passkey from you. The whole "these are locked to the device" ship has very much sailed at this point. That's a conscious compromise to security because Apple has decided (I think correctly) that the security gain from blocking backup to the cloud is not actually high enough to justify how much less accessible passkeys would be without that feature. So I don't buy that it's security that's blocking them from also allowing syncing to other places other than iCloud. > You are describing the tradeoff made by passkeys, yes. More to the point though, I wish people would lead with this and not start out by saying, "oh, they're just as portable and easy to back up as a normal password." They're not, there's a tradeoff here. You can not just make an encrypted vault of all of your passkeys and stick that on a USB drive. And that's a tradeoff that was so severe that every major OS provider got together and extended the standard to allow cloud sync for keys. Should they have done that? :shrug: But if someone is asking if they can do the same thing with passkeys that they do with their password manager, the answer is 'no'. You can not export all of your passkeys to an encrypted vault and stick it on a flash drive or sync it to another device using syncthing. Your options are a lot more limited, and the way it's advised to get around that is to authenticate multiple devices for each account. In theory it's something that might be supported in the future? In practice, it's not supported by anyone right now.
  - JohnFen 4y ago
    I'm aware of that, yes, but that doesn't really address my question (or use case).
- dwaite 4y ago
  > Would this be a thing that the passkey folks would be OK with? That would ease a lot of my hesitation. I mean, I don't _like_ it (if I'm a passkey folk) as a widespread feature. I suspect users may be tricked into giving away the keys to the kingdom. However, these are generally just API, there are open source projects for security keys, and having an option to hold down a button on insertion to have it turned into a filesystem with a CSV file sounds kinda neat as a bit of hackery. There are several third party software implementations, such as those built on top of existing password managers which have pre-existing password export/import functionality and tend to document their data vault formats (or have them torn apart in reverse engineering). I suspect this will happen if it hasn't already - it would be better as a command-line tool and not a button with a wordy pop-up. My hope is that we have independent certifications for relying parties to rely upon, but lack of certification won't lead to such a bespoke implementation being rejected by anyone. Instead, some sites may ask for you to continue using additional factors since they don't understand if your passkey meets their requirements.
  - deleted 4y ago
    [deleted]
  - JohnFen 4y ago
    If I'm understanding you correctly, then I should be able to write my own manager to behave in a fashion that is in line with my wishes. Is that correct? That would be a nice escape hatch to have available if need be. > Instead, some sites may ask for you to continue using additional factors On the other hand, if that's the result of doing that, then there'd be no gain. I'll end up going through the whole gauntlet anyway.
    - dwaite 4y ago
      > On the other hand, if that's the result of doing that, then there'd be no gain. Yeah, we'll just have to wait to see. Passkeys are just big enough and different enough that I think they are exposing a lot of the holes in existing modeling of authentication. For example, a party may not want to rely on a separate piece of software or cloud-backed data for authentication, but that is the reality for password managers today, as well as text messages and TOTP for a lot of people. What are these factors that would always survive an attacker getting access to a user device and to their cloud account? You quickly find yourself in the realm of issued hardware key fobs and in-person identity verification for account recovery.
Rufbdbskrufb473 4y ago
So can I set up a self-hosted solution? I don't want to trust a 3rd party to be able to restore access to accounts after losing my phone. I've lost several Google and Yandex accounts that way. Despite knowing the passwords, they refused to let me log in again after loosing my phone.
IMTDb 4y ago
> If you use a password manager today, then you're already essentially using something you have, because you need to be in possession of your login database to retrieve passwords, and nobody can remember that in their head. Which is precisely why I would never use an offline only password manager. In the case outlined above, I would need to connect to my online password manager, using the master password I have in my head; which then would allow me to connect to all my services. How would that work with passkeys ? So far the only way I could see this working is if every single device on earth comes with a fingerprint/face scanner. Because my face and my fingers will always be there for me (hopefully). Otherwise we are back to secrets (aka: passwords).

by dcow 4y ago

JohnFen 4y ago

> The generalized solution to this is allowing 3rd parties to be your passkey provider, so that you can choose how your passkeys are stored The password manager I use has no cloud component (which is why I chose it), and addresses this by allowing me to export my password collection to an encrypted backup file. Would this be a thing that the passkey folks would be OK with? That would ease a lot of my hesitation.

snowwrestler 4y ago
Yes you can just use a hardware FIDO token like a Yubikey as your passkey. And you can enroll more than one, so if you lose or wreck one, you’re not locked out.
- danShumway 4y ago
  This is not really the same thing as what GP is asking? They're asking about backing up existing keys, you're talking about creating new ones. I can back up my entire password database just by copying a file. To "back up" a Yubikey I buy a new key then I individually visit every single site I have an account on and attach a new key one by one. That's not equivalent. It also makes setup a lot less convenient than a password manager would be. Every time I set up an account I need to set up two devices? And ideally they should be stored in different places, just having 2 Yubikeys in my pocket isn't really doing much for me, so now every signup is literally a 2-step process that involves going to 2 locations. "Just" is doing a lot of work here.
  - tadfisher 4y ago
    You are describing the tradeoff made by passkeys, yes. The idea is that it shouldn't be possible for someone to phish your passkey, because lives on a piece of hardware and signs challenges, but is not transmitted to the requesting party (or to anyone). Luckily, passkey "syncing" and "backup" means issuing a new key that's signed by an old key, so you can in fact have the convenience of paper-based backups if you want (that's how the QR codes work for syncing between passkey managers). I trust you can appreciate how this improves security in general, by trading some convenience.
    - pabs3 4y ago
      Would be nice if there were something like pass-otp for passkeys :)
    - danShumway 4y ago
      > The idea is that it shouldn't be possible for someone to phish your passkey, because lives on a piece of hardware and signs challenges, but is not transmitted to the requesting party (or to anyone). Passkeys don't live only on the device. iOS syncs to the cloud. They're not unphishable. You can lose your iPhone, get a new iPhone and get all of your passkey logins without having access to the old iPhone. If someone tricks you into giving access to your iCloud account, they can get your passkeys. Heck, if someone tricks you into doing an airdrop, they can get a passkey from you. The whole "these are locked to the device" ship has very much sailed at this point. That's a conscious compromise to security because Apple has decided (I think correctly) that the security gain from blocking backup to the cloud is not actually high enough to justify how much less accessible passkeys would be without that feature. So I don't buy that it's security that's blocking them from also allowing syncing to other places other than iCloud. > You are describing the tradeoff made by passkeys, yes. More to the point though, I wish people would lead with this and not start out by saying, "oh, they're just as portable and easy to back up as a normal password." They're not, there's a tradeoff here. You can not just make an encrypted vault of all of your passkeys and stick that on a USB drive. And that's a tradeoff that was so severe that every major OS provider got together and extended the standard to allow cloud sync for keys. Should they have done that? :shrug: But if someone is asking if they can do the same thing with passkeys that they do with their password manager, the answer is 'no'. You can not export all of your passkeys to an encrypted vault and stick it on a flash drive or sync it to another device using syncthing. Your options are a lot more limited, and the way it's advised to get around that is to authenticate multiple devices for each account. In theory it's something that might be supported in the future? In practice, it's not supported by anyone right now.
- JohnFen 4y ago
  I'm aware of that, yes, but that doesn't really address my question (or use case).
dwaite 4y ago
> Would this be a thing that the passkey folks would be OK with? That would ease a lot of my hesitation. I mean, I don't _like_ it (if I'm a passkey folk) as a widespread feature. I suspect users may be tricked into giving away the keys to the kingdom. However, these are generally just API, there are open source projects for security keys, and having an option to hold down a button on insertion to have it turned into a filesystem with a CSV file sounds kinda neat as a bit of hackery. There are several third party software implementations, such as those built on top of existing password managers which have pre-existing password export/import functionality and tend to document their data vault formats (or have them torn apart in reverse engineering). I suspect this will happen if it hasn't already - it would be better as a command-line tool and not a button with a wordy pop-up. My hope is that we have independent certifications for relying parties to rely upon, but lack of certification won't lead to such a bespoke implementation being rejected by anyone. Instead, some sites may ask for you to continue using additional factors since they don't understand if your passkey meets their requirements.
- deleted 4y ago
  [deleted]
- JohnFen 4y ago
  If I'm understanding you correctly, then I should be able to write my own manager to behave in a fashion that is in line with my wishes. Is that correct? That would be a nice escape hatch to have available if need be. > Instead, some sites may ask for you to continue using additional factors On the other hand, if that's the result of doing that, then there'd be no gain. I'll end up going through the whole gauntlet anyway.
  - dwaite 4y ago
    > On the other hand, if that's the result of doing that, then there'd be no gain. Yeah, we'll just have to wait to see. Passkeys are just big enough and different enough that I think they are exposing a lot of the holes in existing modeling of authentication. For example, a party may not want to rely on a separate piece of software or cloud-backed data for authentication, but that is the reality for password managers today, as well as text messages and TOTP for a lot of people. What are these factors that would always survive an attacker getting access to a user device and to their cloud account? You quickly find yourself in the realm of issued hardware key fobs and in-person identity verification for account recovery.

Rufbdbskrufb473 4y ago

So can I set up a self-hosted solution? I don't want to trust a 3rd party to be able to restore access to accounts after losing my phone. I've lost several Google and Yandex accounts that way. Despite knowing the passwords, they refused to let me log in again after loosing my phone.

IMTDb 4y ago

> If you use a password manager today, then you're already essentially using something you have, because you need to be in possession of your login database to retrieve passwords, and nobody can remember that in their head. Which is precisely why I would never use an offline only password manager. In the case outlined above, I would need to connect to my online password manager, using the master password I have in my head; which then would allow me to connect to all my services. How would that work with passkeys ? So far the only way I could see this working is if every single device on earth comes with a fingerprint/face scanner. Because my face and my fingers will always be there for me (hopefully). Otherwise we are back to secrets (aka: passwords).