14 ms·
Passkeys: A Loss of User Control?
- jrm4 4y agoExactly. I don't doubt that there are a lot of well-meaning techies inside the big companies who get how this works and want to do the right thing by most people; but the loss of control here is unacceptable.
- fbdab103 4y agoPhones are fragile and get lost, stolen, or destroyed. I need a security system for which I am able to make an offline backup.
- lolsowrong 4y agoGoogle’s implementation allows multiple passkeys. I have a passkey for my iPhone, one from Windows Hello, and 3 from different yubikeys I’ve picked up over the years. The yubikey implementation requires setting a PIN, so I’m not even really worried about one of them being lost of stolen.
- wg0 4y agoCloud you please elaborate in detail how someone not using Yubi keys should adopt it by having hardware keys and how much keys should one have? How Keys are different than an OTP app like Authy?
- themagician 4y agoThe Apple security model for Apple ID and iCloud already works like this. Every device is effectively a “passkey” even if they don’t call it that. Been that way for a while now. Every device (except accessories like AppleTV, HomePod, etc.) you log into iCloud with effectively has Super Admin control over your entire iCloud account. Any logged-in device can remove, modify, or change (almost) anything without a password… including the account password (hence the almost). Once authorized, that access is controlled by biometrics with a backup PIN. As long as you maintain control of a single device you have access to everything. Yubikeys work the same way. Doubly so when dealing with resident credentials and passkeys. Key as as many as possible—just make sure the PIN is not obvious. If you hold the key and know the PIN, you can do anything. No other information is needed. The big difference between this and OTP is two fold: 1) much more resistant against phishing; and 2) the underlying key is less likely (or impossible-ish) to be exposed. Phishing a 2FA OTP is actually not hard with a good fake UI. It just requires someone to act quickly on the other end or a good script that can quickly change the password/security settings once a password and OTP are successfully phished.
- eptcyka 4y agoEasy, buy a backup phone, rest easy and boost the economy.
- jupp0r 4y agoWhat's wrong with an online backup? Offline backups are tied to their physical representation and can get lost in disasters for example. Spread your risk.
- Topgamer7 4y agoMoreso about providing the capability to roll your own backup. Online backups an be foiled if they only provide gdrive backup for example.
- LeoPanthera 4y ago> What's wrong with an online backup? If Google decides you have Done A Bad, suddenly you can't login to anything, anywhere.
- jupp0r 4y agoThat's like saying that all food is unhealthy because of McDonalds.
- fbdab103 4y agoOnline backup stuck inside Google's walls is the opposite of spreading my risk. An offline backup I can control, I can put in a safe for my relatives in case I die unexpectedly. Or I am robbed. Or any number of foreseeable circumstances where the physical manifestation of my secret is lost.
- SebastianKra 4y agoAFAIK, you can use a physical key anywhere you can use a passkey [1]. And you can register multiple passkeys. So it would be perfectly possible to have your logins in a safe somewhere while having additional passkeys for daily use. You just need create the backup manually for each account provider. You can't extract all your passkeys from a device. But for me, the online-backup provides enough redundancy. In order to be locked out, I'd have to loose all my devices and, at the same time, be banned by my cloud provider. [1] at least that's what the Safari-UI suggests.
- userbinator 4y agoTOTP keys, written down, would probably be ideal for that.
- lelandbatey 4y agoTOTP written down does work well, but the parent and I are both interested in how we should write down (on paper, like by printing) the various secrets necessary to reconstruct our passkeys in an emergency. Once that's known, I'll gladly adopt passkeys.
- dv_dt 4y agoA lot of people in the world only have one primary digital device - a phone. If that phone breaks, or is lost or stolen, how do those users get back access to their keys? Will the store holders like Google and Apple validate their identity w/ personal information frequently stolen from credit agencies and healthcare industry data stores?
- nimbius 4y agoIts also worth pointing out that google, the company making the big passkey push, has a track record of just disabling accounts they don't like for any arbitrary algorithmic reason. Lose your (google) passkeys account for whatever reason (ai says no, wrongthink, itar ban), and you risk losing your digital life. Edit: If you need MFA please do check out solokey, an open source Fido project. https://solokeys.com/ https://solokeys.com/
- josteink 4y agoThat just means avoid making passkeys and/or Google passkeys your only login option. There are other options out there.
- XorNot 4y agoGoogle's stated goal of killing the password though gives the game away. They want to give you no other option.
- acdha 4y agoYou really want to learn how this technology works before spreading FUD which will cause people to pick less secure options. Passkeys are a W3C standard and they’re not an SSO system which requires a third-party server to function. If Google closed operations tomorrow, it wouldn’t affect anyone using a passkey to login to any service other than Google’s own.
- deleted 4y ago[deleted]
- Aeolun 4y agoUnless you are storing all your passkeys on a Google server, as Apple seems to require ATM (see article).
- jasonjayr 4y agoIf I use passkeys right now, with Google or Apple, and they close up shop tomorrow, I'm screwed. They need to prove that this isn't going to be a bait and switch. Give users 100% control over their pass keys NOW before we consider using the service. Otherwise, they're gonna play the "Oh, but most non-tech users will benifit from this" and then we get critical mass becuse a majority of users are non-tech users, and then the import/export function ends up being like the Official Linux Google Drive Client.
- waboremo 4y agoThe title and article don't really match (not an HN problem). The subject matter should be about passkeys, but this is almost entirely about Apple's implementation and forced iCloud aspect.
- lapcat 4y agoThe blog post is Apple-centric, yes, but it appears that right now Google only allows passkeys to be saved to Google accounts?
- waboremo 4y agoYou can see where Google stores them here https://developers.google.com/identity/passkeys/supported-environments https://developers.google.com/identity/passkeys/supported-en...
- nullfield 4y agoAnd their neglect of Linux, where you’re welcome to use one of their devices (phone) to log in, gets a hard pass.
- miles 4y agoA few hours ago, pabs3 mentioned[0] a pull request for adding passkeys to KeePassXC[1]; see also "Support for passkey #8214"[2]. [0] https://news.ycombinator.com/item?id=35851476 https://news.ycombinator.com/item?id=35851476 [1] https://github.com/keepassxreboot/keepassxc/pull/8825 https://github.com/keepassxreboot/keepassxc/pull/8825 [2] https://github.com/keepassxreboot/keepassxc/issues/8214 https://github.com/keepassxreboot/keepassxc/issues/8214
- tacker2000 4y agoI agree. Of course the concept of passwords needs an overhaul, but there needs to be some open solution and not some silo’ed approach where a couple of large corps can exert control. Im curious to see if this reaches mass adoption.
- jeroenhd 4y agoThe standard allows any company to provide passkeys or to host your own. KeepassXC already has a pull request open, I believe. If you choose to use Google's passkey then you're taking quite the leap of confidence, but you don't have to pick between Apple and Google. We just need to wait a bit longer until passkeys are more widely supported.
- waboremo 4y agoAn open solution... like WebAuthn?
- latexr 4y agoFrom Ricky Mondello, who works on password-related stuff at Apple: > Passkeys will be importable and exportable, cross-device, and across passkey managers. They aren’t at this time, but they will be. It’s something that’s being defined and designed. https://hachyderm.io/@rmondello/110329118270492669 https://hachyderm.io/@rmondello/110329118270492669
- jupp0r 4y agoIf password managers can store passkeys, why not choose one of them and do your offline backup through there?
- atoponce 4y ago2FA is rife with problems. FIDO2/WebAuthn isn't tied to biometrics and can be inconvenient. TOTP can get out of sync and can be phished. Email can also be phished. Voice and SMS are vulnerable to SIM swaps. Now we're seeing that passkeys are horribly opaque without proper management and at risk of getting lost. Le sigh.
- dragonwriter 4y ago> FIDO2/WebAuthn isn't tied to biometrics Good. Biometrics (“something you are”) aren’t a second factor.
- atoponce 4y agoBiometrics aren't the second factor when using WebAuthn, the hardware security key is. But anyone with access to the security key can use the second factor. Biometrics would tie the key to you preventing them from being used by others. The best we have right now for unlocking the security key are PINs, AFAIK.
- ivlad 4y agoPasskeys are just software backed FIDO keys with no attestation and less features. FIDO is flexible enough to distinguish userPresence (I.e., touching the key) from userVerification (commonly, entering a PIN), but this is only defined for physical keys IIRC.
- sowbug 4y agoAll those problems are also true of 2FA's competition, which is plain old passwords. 2FA is progress. Don't let the perfect be the enemy of the good.
- cmdli 4y agoI am a bit biased (I've been working on passkeys for about a year now on https://bulwark.id https://bulwark.id), but I don't think that passkeys either should nor have to reduce user control. Ultimately, passkeys do not have to be tied to hardware, and could just as easily be stored in software, much like passwords. What the industry needs right now is more open standards around passkeys, such as a shared file format for storing them or standard ways of transferring them, all of which should be possible. Because passkeys have had a lot of support from the megacorps like Google/Apple, people can obviously get the impression that passkeys are just about locked-down ecosystems, but that isn't true at all. From a technological standpoint, passkeys are just as versatile as passwords and IMO will eventually be just as widespread.
- JohnFen 4y ago> From a technological standpoint, passkeys are just as versatile as passwords I don't need special software to authenticate with a password, and passwords can be used to authenticate on very low-grunt devices. So not quite as versatile. I'm not arguing against passkeys at all, but passwords are much more versatile and convenient than them, albeit at the cost of being more difficult to use securely.
- katbyte 4y agoi kinda see passkeys being useful for all those websites i really don't care about and just have a short simple password for/something saved in a password manager i use once in a blue moon and wouldn't be too upset to loose access.
- boring_twenties 4y agoI don't see how passkeys would be better for that (or for anything, really) than simply letting the browser autogenerate a password and save it in its built-in password manager?
- acdha 4y ago
- donmcronald 4y agoI refuse to use “login with XX”. I don’t want this either. It makes you dependent on somebody and I think the average person will eventually get strong armed into paying a subscription fee for their “passkey manager” even though they only have a few logins.
- waboremo 4y agoI don't believe someone who only has a few logins is really the target here. Someone with only a handful of logins can easily remember separately complex passwords for them. For most others, they are using a variety of services and are reusing their simple passwords which put them at greater risk.
- robertoandred 4y agoPasskeys aren't "log in with X".
- api 4y agoI’ve been predicting that for OIDC for a while: “Starting January 1st 2025 the use of Google accounts to log in to third party services will require a premium subscription unless those services subscribe to Google Authentication services…” Wham, now Google levies a tax on all SaaS vendors or users that allowed Google login. It’d be a great way to monetize gmail after AI ruins their search business. Computers are annoying and so people will always tend to trade freedom and autonomy for convenience. But if you do that, realize that once you are locked in that relationship will either be directly monetized or (often worse) abused for surveillance. A certain amount of inconvenience is probably going to always be the cost of privacy and actually owning your data. An even shadier thing OIDC providers could do is start logging into user services as the user to spider them for surveillance data. I’m sure the terms of service allow that. The ToS always allows everything, especially for anything free.
- RobotToaster 4y agoDoes FIDO have a method to require keys are stored on devices certified to a certain level? One thing that concerns me is that if passkeys gain acceptance, certification requirements could be used to block open source/self hosted implementations.
- gruez 4y ago> Does FIDO have a method to require keys are stored on devices certified to a certain level? yes: https://developers.yubico.com/U2F/Attestation_and_Metadata/ https://developers.yubico.com/U2F/Attestation_and_Metadata/
- allset_ 4y agoThis is for U2F, which is not FIDO2, though FIDO2 is backward compatible with U2F with a limited set of features. U2F-only hardware is not compatible with the passkeys model. See https://fidoalliance.org/specs/fido-v2.0-ps-20150904/fido-key-attestation-v2.0-ps-20150904.html https://fidoalliance.org/specs/fido-v2.0-ps-20150904/fido-ke... for the FIDO2 attestation specs.
- ho_schi 4y agoGoogle also seems to push Passkeys bound to Google Accounts (Cloud). This should make us wary. Google and Apple have a long history of vendor lock-in and “was compatible until our position was strong enough”. Passkeys itself are SSH-Keys for normal users. A good thing as long as you have them stored safely and a login/password to access them.
- upofadown 4y ago>The major difference between passkeys and ssh keys is how they are managed. You can, and should as good practice, generate separate ssh keys for each ssh service that you use, just as you should generate separate random passwords for each web service that you use. The two cases seen entirely different to me. I think that in most cases a single SSH keypair is fine. Some discussion of the question here: * https://security.stackexchange.com/questions/40050/best-practice-separate-ssh-key-per-host-and-user-vs-one-ssh-key-for-all-hos https://security.stackexchange.com/questions/40050/best-prac... >On the other hand, passkeys are always associated with a single web service, never with multiple services, so that's an improvement in security over ssh keys and passwords. Is it? I suppose that would be true if you didn't want the various services you use to know you were the same entity. That's more of an anonymity issue. Then why does the passkey scheme even bother with public key cryptography? Why not just generate random passwords for each site and store those? This seems to be logically equivalent to a password manager.
- sowbug 4y agoWhy not just generate random passwords for each site and store those? That approach is susceptible to a man-in-the-middle attack. FIDO isn't.
- supriyo-biswas 4y agoIf you’re using a password manager, it would fill in the password only for the target website.
- acdha 4y agoThe problem is that sites are sloppy about this and many password managers allow you to fill in passwords even from other domains. WebAuthn makes that impossible even in the face of good social engineering.
- sowbug 4y agoThat's the intent of password managers, but there are all sorts of attacks/bugs/footguns that could still let the wrong thing happen. You could imagine scenarios where you don't have time to investigate why your @#$(#! password manager isn't autofilling today, and you do it manually. The confused deputy problem is real. Contrast FIDO's design, in which it's actually not catastrophic to give the secret to the phishing site, because they can't do anything useful with it. There simply isn't a "hunter2" for them to obtain, even if the confused deputy wanted to give them one. (If you believe you personally are impervious to social engineering, imagine how many other people would respond in this situation: https://www.mercurynews.com/2023/04/27/larry-magid-how-i-nearly-fell-for-a-frightening-virtual-kidnapping-scam/ https://www.mercurynews.com/2023/04/27/larry-magid-how-i-nea....)
- 1bent 4y agoAre there any open source passkey implementations? My password manager of choice is open source, and cross-platform, and can export and later (or elsewhere) import an encrypted backup.
- Ciantic 4y agoYes, https://bulwark.id/ https://bulwark.id/ and it's fully on software, it looks pretty cool. I haven't tested it and can't vouch for it but it's author [1] was commenting here that's why I found it. [1]: https://news.ycombinator.com/item?id=35854698 https://news.ycombinator.com/item?id=35854698
- FlxMgdnz 4y agoWe’re building https://www.hanko.io https://www.hanko.io It’s a passkey-first authentication solution for websites and mobile apps.
- deleted 4y ago[deleted]
- mfwit 4y ago"Passkeys will be importable and exportable, cross-device, and across passkey managers. They aren’t at this time, but they will be. It’s something that’s being defined and designed." -Apple Authentication Experience manger https://hachyderm.io/@rmondello/110329118270492669 https://hachyderm.io/@rmondello/110329118270492669
- dv_dt 4y agoUntil Google, or Apple, or facebook, or whoever is the passkey store holder decides to put up an interoperability wall, either through neglect, cost savings, or intentional user retention. The big providers could provide cross company SSO (e.g. sign onto my google mail account w/ my apple identity) for all their accounts already, but for some reason that hasn't happened...
- josephcsible 4y agoI'll believe this when it actually happens and I can audit the whole implementation stack myself. Until then, I trust Apple about as far as I can throw them. Remember when they got sued for lying in ads and their defense was "no reasonable person in Plaintiff's position could have reasonably relied on or misunderstood Apple's statements as claims of fact"? https://www.wired.com/2008/12/apple-says-cust/ https://www.wired.com/2008/12/apple-says-cust/
- Mindwipe 4y ago"Now, FaceTime is based on a lot of open standards -- H.264 video, AAC audio, and a bunch of alphabet soup acronyms -- and we're going to take it all the way. We're going to the standards bodies starting tomorrow, and we're going to make FaceTime an open industry standard." - Steve Jobs.
- AlexandrB 3y agoIt's great that they're aiming for this, but there's no reason to take them at their word until they actually ship something. Also, considering that there are already multiple software vendors providing passkey hosting functionality, it seems a little late to start designing the "cross-device, and across passkey managers" part of this. If it's not in the standard already, what assurance does a user have that any of these third-party entities will implement it?
- crazygringo 4y agoI share the view that I'm not going to trust Google or Apple with my passkeys, not for any ideological/trust/privacy reason but just not putting all my eggs in one basket. I assume I'll use 1Password's implementation they're building, which should meet all my needs, provided they provide a mechanism to export (which I expect). And I also assume a similar open-source solution will arise. So I'm not worried about a loss of user control at all. As long as iOS, Chrome, Safari, and Android all allow integration with third-party passkey managers. And I don't see how that wouldn't happen.
- __MatrixMan__ 4y agoJust like there are diehards still running their own email servers (kudos to them), will there be people running their own passkey backends? If so, I'm open minded. If it's a situation where you have to be in some kind if in-group to do that, then I'm preparing to be as much of a Luddite as I need to in order to avoid them.
- crote 4y agoThe specification is open, so anyone can create their own implementation. However, the implementation also supports attestation, which means a website is able to only allow certain "trusted" passkey implementations.
- EvanAnderson 4y agoSo, no— self-hosted won’t realistically be an option because “security”. I should just give up and live in a shack in the woods. The entire industry is hell-bent on subjugating me to one of the big-tech fiefdoms.
- allset_ 4y agoAttestation for hardware-backed FIDO authenticators is worthwhile. You can attest to various properties, such as whether or not the credential is protected by a PIN.
- deleted 4y ago[deleted]
- EvanAnderson 4y agoOf course it has value, but it’s a tradeoff for freedom. I don’t want that “security”, personally. I would love to not do business with anyone who requires that of me. Unfortunately, I think that will increasingly force disconnection from society.
- __MatrixMan__ 4y ago
- deleted 4y ago[deleted]
- d-z-m 4y agoOne of the really cool uses of passkeys is cross-platform sign-in via the QR code flow. (i.e. passkey on phone, scan qrcode on desktop, desktop logs you in). However as I understand it, to be able to do this you need to use the platform's(google,apple, microsoft) caBLE infrastructure[0]. Will open-source passkey managers have the ability to hook into this? [0]:https://blog.millerti.me/2021/06/18/previewing-chromes-cable-v2-support-for-webauthn/ https://blog.millerti.me/2021/06/18/previewing-chromes-cable...
- fmajid 4y agoI have the opposite concern. The great thing about Yubikeys and other FIDO U2F/FIDO2 keys is they can't be cloned. With Passkeys living on your iOS or Android phone, they are only one successful Pegasus exploit away from being compromised. What is essential is the ability to have multiple credentials associated with an account. Possibly so you have redundant Yubikeys, but also to have an Apple and a Google passkey so you are not locked out if your phone is lost (thanks to Apple's brain-dead decision to allow phone + passcode to reset the recovery key) or if Google decides to close your account on a whim.
- josephcsible 4y ago> What is essential is the ability to have multiple credentials associated with an account. Since not every website will let you do that, even though they should, it's of paramount importance that passkeys can be cloned.
- fmajid 4y agoThe eternal trade-off between security and availability... Some like Apple actually require a minimum of two FIDO keys before allowing you to turn on hardware key-based 2FA.
- lukeschlather 4y agoThe whole messaging on passkeys are extraordinarily confusing. When I start reading, it sounds like a great thing: instead of passwords, I authorize devices to my account by associating a public key with the account. But it's unclear if supporting passkeys actually requires services to support more than one public key associated with an account. The fact that you can sync passkeys to the cloud (rather than just using a key stored in a TPM) suggests that it's not actually a requirement, and it isn't even the default behavior. It seems like passkeys are intended as a fancier version of "log in with" rather than an actual private key/hardware-based replacement for passwords. A properly secure system would have a mode that made sync impossible, you would have to generate a unique and hardware-secure passkey for each device. It sounds like maybe I can achieve that, but not with any of the standard implementations.
- WorldMaker 4y agoPasskeys are a brand name for an "all of the above" buffet of menu options and sorting out specific "branding efforts" versus the practical, achievable, standardized options is going to be a real ongoing challenge. On the one hand, because it allows for and often uses so many different practical options that should mean that no one path is better tested than any other. On the other hand, yeah it adds for a lot of complications when trying to figure out what people (will) mean by "passkeys" support. > But it's unclear if supporting passkeys actually requires services to support more than one public key associated with an account. Present best practice for WebAuthn is to always support an arbitrary number of public keys associated with an account. That shouldn't change with Passkeys and some present passkeys implementations are allowed to present an arbitrary number of public keys at enrollment time. > A properly secure system would have a mode that made sync impossible, you would have to generate a unique and hardware-secure passkey for each device. You should be able to do that in theory. It's obviously going to be harder to operate and maintain than a system involving synced keys and yes it may be too soon to have a good idea of what sort of practical obstacles might exist.
- discerning_ 4y agoPasskeys are half baked as implemented and rolled out by apple and Google. Personally, I will never use them until apple and gooqgle can explain what the implications are across all their services and all my devices. For example, say I switch to passkeys for my Google login. How do I login to YouTube on my Roku device? If I buy into apple passkeys how do I log in to apple music on android? The answer to the above will always be via passwords. Personally I want one passkey for Google and one for apple on my yubikey and that's it and password backup for limited devices with password backup for login. The author is correct that requiring the cloud is asking for tons of trouble, but people that say they have to dig yubikeys out of a drawer are not yubikey users. Yubikey users attach them to Keychains or wallets because they ACTUALLY use them and keep backups of them. Personally, I think Apple's 2 factor is a joke and likely dangerous. I dont trust Google to not screw up passkeys either.
- snailmailman 4y ago> How do I login to YouTube on my Roku device? The passkey does not have to be on the same device. It can be, but does not have to be. The Roku can display a QR code, and a passkey on a phone can perform the login. I logged into google on my windows laptop yesterday with a passkey on my iPhone. A prompt in chrome appeared basically asking “is your passkey on this laptop, or on a phone” and then displayed a code after I picked phone. I hope eventually one of the major password managers implements Passkey support. I have Vaultwarden on all of my devices; I’d ideally love for Vaultwarden to store my passkey(s). It wouldn’t be any different from how I login currently, but with fewer passwords. There really isn’t much reason to stay locked into Apple or Google as far as I can tell.
- MikeGale 4y agoIf there's an option to using alternatives to those you don't trust, like Google or Apple, that's good. If not you need to find an alternative service. You need the choice.
- SahAssar 4y ago> The whole thing seems to be a bit of security theater too, because the YubiKey is not keyed to my biometrics, so anyone in physical possession could touch the button to authenticate. This is clearly misunderstanding the point of a hardware security key. If I can reduce the number of people that can hack you to the people who can access a single, uncloneable, physical object, is that not greatly increasing your security? It is the "Something you have" part of security.
- wesley123 3y agoI googled a few recovery companies and after a few days of research I came across a crypto expert who introduced me to a programmer that helped me recover my lost coins. I was very skeptical as can be imagined but I’m glad to say my bitcoin was recovered and sent back to me after an hour. You should file a complaint directly to her via email: zattrecoverypro1 @ gmail com. in case u need help recovering your lost transactions, I recently recovered mine within an hour.