4 ms·

I think this addresses most of my concerns regarding passkeys. The biggest remaining one is still that fingerprint locked information is not protected under th

I think this addresses most of my concerns regarding passkeys. The biggest remaining one is still that fingerprint locked information is not protected under the fifth amendment in the US. Even pin protected information/logins has been ruled as both protected and not protected by different courts. The "key vs combination" debate hasn't been decided one way or another. I can imagine a government push to not count fingerprint locked passkeys as equivalent to passwords, but that's not a weakness of passkey technology. I am also interested in seeing how phone secured passkeys will work, iOS currently forces the use of keychain, excluding users who opt for a third party password manager like bitwarden. I also wonder if phones will be able to be used to login without enabling bluetooth. https://www.concordlawschool.edu/blog/constitutional-law/fifth-amendment-biometrics/ https://www.concordlawschool.edu/blog/constitutional-law/fif...

dwaite 3y ago
> The biggest remaining one is still that fingerprint locked information is not protected under the fifth amendment in the US. Is this comment more about the ongoing existential concern for everyone, or wondering if this is a specific concern for yourself? The Apple implementation protects with either a biometric or passcode; you should be able to still use it if you disable the biometric features of the phone. A third-party implementation might instead support requiring a PIN rather than accepting a passcode for their users with such concerns. This is very close to the existing situation with password managers. > I am also interested in seeing how phone secured passkeys will work, iOS currently forces the use of keychain, excluding users who opt for a third party password manager like bitwarden. The system implementation uses iCloud Keychain, but a password manager can ship a web extension to supplant the existing browser API with their own implementation. On Android, there is a system level API in beta that allows third party password managers to offer passwords and passkeys to native apps and browsers. > I also wonder if phones will be able to be used to login without enabling bluetooth. There are complications to supporting USB on multi-purpose devices, and unfortunately nowhere near enough NFC reader adoption for such support to be prioritized. NFC also has some UX complications. The bluetooth support is used for proximity checks; a pure network-based approach would be open to lower sophistication MITM attacks.
latexr 3y ago
On iPhones, pressing the home/lock button five times in quick succession or pressing and holding the lock button and one of the volume buttons for a couple of seconds will disable biometric unlock for the next use, i.e. the passcode will be required.
JohnFen 3y ago
> The biggest remaining one is still that fingerprint locked information is not protected under the fifth amendment in the US. Fortunately, that's not a threat vector that is a real concern for most people. If it is for you, then yes -- solely protecting access through biometrics is probably inadequate.
- knaik94 3y ago
  It's not, until it is. There have been cases of everyday people are forced to turn over the passwords at borders when entering or leaving the country. I fundamentally disagree about whether or not this is a real concern for most people. I have no problem with people using biometrics, I understand people will always choose the most convenient option, that's why it's important. I think the iOS "cop mode" feature to disable the fingerprint with 5 presses of the power button shows companies are concerned about it too.

dwaite 3y ago

> The biggest remaining one is still that fingerprint locked information is not protected under the fifth amendment in the US. Is this comment more about the ongoing existential concern for everyone, or wondering if this is a specific concern for yourself? The Apple implementation protects with either a biometric or passcode; you should be able to still use it if you disable the biometric features of the phone. A third-party implementation might instead support requiring a PIN rather than accepting a passcode for their users with such concerns. This is very close to the existing situation with password managers. > I am also interested in seeing how phone secured passkeys will work, iOS currently forces the use of keychain, excluding users who opt for a third party password manager like bitwarden. The system implementation uses iCloud Keychain, but a password manager can ship a web extension to supplant the existing browser API with their own implementation. On Android, there is a system level API in beta that allows third party password managers to offer passwords and passkeys to native apps and browsers. > I also wonder if phones will be able to be used to login without enabling bluetooth. There are complications to supporting USB on multi-purpose devices, and unfortunately nowhere near enough NFC reader adoption for such support to be prioritized. NFC also has some UX complications. The bluetooth support is used for proximity checks; a pure network-based approach would be open to lower sophistication MITM attacks.

latexr 3y ago

On iPhones, pressing the home/lock button five times in quick succession or pressing and holding the lock button and one of the volume buttons for a couple of seconds will disable biometric unlock for the next use, i.e. the passcode will be required.

JohnFen 3y ago

> The biggest remaining one is still that fingerprint locked information is not protected under the fifth amendment in the US. Fortunately, that's not a threat vector that is a real concern for most people. If it is for you, then yes -- solely protecting access through biometrics is probably inadequate.

knaik94 3y ago
It's not, until it is. There have been cases of everyday people are forced to turn over the passwords at borders when entering or leaving the country. I fundamentally disagree about whether or not this is a real concern for most people. I have no problem with people using biometrics, I understand people will always choose the most convenient option, that's why it's important. I think the iOS "cop mode" feature to disable the fingerprint with 5 presses of the power button shows companies are concerned about it too.