5 ms·

Passkey is an open standard, clients are not limited to Android or IOS devices. You can for example use a Yubikey, on a Linux desktop system, to authenticate t

Passkey is an open standard, clients are not limited to Android or IOS devices. You can for example use a Yubikey, on a Linux desktop system, to authenticate to services implementing the "passkey" standard. Does Google own my Yubikey in some way that I'm unaware of? Nothing is owned by Google or Apple or Microsoft, there is no grand conspiracy trying to lock you into a platform. Try educating yourself before spreading misinformation, and before assuming that everything is an Evil Conspiracy by Big Tech.

deleted 3y ago
[deleted]
bscphil 3y ago
Possibly a dumb question... the Yubikeys a bunch of us own were originally sold as U2F / FIDO keys. My understanding of this system was that it was, as labeled, a "universal second factor" standard. But passkey is supposed (?) to be a single-factor (something you have, not something you know). Is it doing this just by (ab)using the "second factor" approach for single factor auth? Or is there something a little more sophisticated, and hopefully more secure, happening here? I tried to do some research myself, but there's no Wikipedia page for "passkeys" and they aren't mentioned on the Yubikey article. Edit: this user has a helpful comment: https://news.ycombinator.com/item?id=35810144 https://news.ycombinator.com/item?id=35810144 > Passkeys add in user verification as a capability so that you can use them for the entire authentication process rather than as just one of the factors. This typically means a biometric challenge or knowledge based challenge, such as PIN/passcode entry. I'd love to know more about how / whether these challenges are enforced as part of an open standard, or whether it's up to individual implementers of passkeys to roll their own.
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
mastazi 3y ago
Nothing that you said prevents vendor lock-in. If my private keys are stored are in a Secure Enclave, I can’t copy them to a FOSS client or a Yubikey. The list of members of the FIDO alliance is public. It includes several companies that most people refer to as “big tech”.
- chlorion 3y ago
  I'm not sure why you couldn't associate a new key with whatever services you use, like changing a password, or even having multiple keys associated to one account. Also I am not sure that I would consider not being able to access private key material from a enclave vendor lock in, since that's the entire purpose of the device. I guess the same people arguing that passkey is a conspiracy are the same ones that think secure boot and TPM is a Microsofts conspiracy to prevent you from installing Linux.
  - deleted 3y ago
    [deleted]
  - mastazi 3y ago
    Having to regenerate all your keys just to switch client is an order of magnitude (or two) harder than migrating from one password manager to another. The article we are commenting on is titled "the beginning of the end of passwors" as if passkeys were an improvement over passwords. They are an improvement for service providers, sure, but not for users, due to vendor lock-in. This was my initial argument from the start. You kept countering with arguments such as "you can use a FOSS client", "but Google is a contributor to open source" or "Google can't access your Yubikey" - which are irrelevant to my point, which is that the new standard introduces further vendor lock-in. In addition you resorted to personal attacks - calling me and other users in this thread conspiracists or uneducated - but could not counter any of the points we were making with valid arguments.

deleted 3y ago

[deleted]

bscphil 3y ago

Possibly a dumb question... the Yubikeys a bunch of us own were originally sold as U2F / FIDO keys. My understanding of this system was that it was, as labeled, a "universal second factor" standard. But passkey is supposed (?) to be a single-factor (something you have, not something you know). Is it doing this just by (ab)using the "second factor" approach for single factor auth? Or is there something a little more sophisticated, and hopefully more secure, happening here? I tried to do some research myself, but there's no Wikipedia page for "passkeys" and they aren't mentioned on the Yubikey article. Edit: this user has a helpful comment: https://news.ycombinator.com/item?id=35810144 https://news.ycombinator.com/item?id=35810144 > Passkeys add in user verification as a capability so that you can use them for the entire authentication process rather than as just one of the factors. This typically means a biometric challenge or knowledge based challenge, such as PIN/passcode entry. I'd love to know more about how / whether these challenges are enforced as part of an open standard, or whether it's up to individual implementers of passkeys to roll their own.

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

mastazi 3y ago

Nothing that you said prevents vendor lock-in. If my private keys are stored are in a Secure Enclave, I can’t copy them to a FOSS client or a Yubikey. The list of members of the FIDO alliance is public. It includes several companies that most people refer to as “big tech”.

chlorion 3y ago
I'm not sure why you couldn't associate a new key with whatever services you use, like changing a password, or even having multiple keys associated to one account. Also I am not sure that I would consider not being able to access private key material from a enclave vendor lock in, since that's the entire purpose of the device. I guess the same people arguing that passkey is a conspiracy are the same ones that think secure boot and TPM is a Microsofts conspiracy to prevent you from installing Linux.
- deleted 3y ago
  [deleted]
- mastazi 3y ago
  Having to regenerate all your keys just to switch client is an order of magnitude (or two) harder than migrating from one password manager to another. The article we are commenting on is titled "the beginning of the end of passwors" as if passkeys were an improvement over passwords. They are an improvement for service providers, sure, but not for users, due to vendor lock-in. This was my initial argument from the start. You kept countering with arguments such as "you can use a FOSS client", "but Google is a contributor to open source" or "Google can't access your Yubikey" - which are irrelevant to my point, which is that the new standard introduces further vendor lock-in. In addition you resorted to personal attacks - calling me and other users in this thread conspiracists or uneducated - but could not counter any of the points we were making with valid arguments.