7 ms·

I don't understand your point about vendor lock-in, on the devices side YubiCo, Feitian and NitroKey exist (as well as many others probably) and are none are "m

• hackernewds 3y ago
  > are none are "multinational corps" in the derogative sense YET. Remember when LastPass was the second coming liberating us from the devils of Google passwords?
• wepple 3y ago
  I don’t necessarily think OP believes this point of view, but even HN folks seem to think passkey is some wild biometric stealing mega Corp conspiracy. See a lot of the comments in this thread as an example: https://news.ycombinator.com/item?id=35801392 https://news.ycombinator.com/item?id=35801392
  • signal11 3y ago
    > HN folks seem to think passkey is some wild biometric stealing mega Corp conspiracy. What it does is promotes further centralisation, because most users will use one of the big providers. This wouldn’t be a problem either, except that the big providers are not accountable. Google, Meta, etc lock users’ accounts all the time. Users often have no recourse. Passkeys will mean a locked Google account now impacts your ability to sign into all the sites where you used that passkey. Think it can’t happen to you? “Oh Google won’t lock my account out!” That’s exactly what those locked out thought too. The fundamental problem with Passkeys isn’t technical. Even ignoring the centralisation issue, the problem is a lack of organisational accountability on the part of Google, Meta etc. And yeah, the tech industry, including the tech press, needs to own the fact that they’ve given these companies a free pass over this.
    • cyphar 3y ago
      But I don't see how passkeys factor into this discussion at all. Yes, large companies are unaccountable and they do harmful things to their users without recourse. This is unrelated to the method you use to log into microsoft.com. WebAuthn is not Single Sign On (where you are centralising logins) -- it seems a lot of people on HN think that it is. I don't like SSO as the only option for a site (precisely for the centralisation reasons), but that's very explicitly not what WebAuthn is. The test page for WebAuthn (on their site) is completely self-hosted and every site I've seen that supports WebAuthn self-hosts it.
      • signal11 3y ago
        The parent comment I replied to brought up passkeys, trying to paint criticism of it as “conspiracy”.
        • cyphar 3y ago
          Is "passkey" not another word for a WebAuthn/FIDO token?
• account-5 3y ago
  I don't have an issue with simple hardware devices being used but for me that's overkill. And means I always need that device with me, and hope it doesn't break, or get lost or stolen. The only way to avoid these issues is to have multiple devices. Im pretty confident MS, Apple, Google will be pushing for their implementations to be the only accepted form of this authentication. It's not like their isn't precedent for this suspicion. And while it's not immediately obvious how these companies can use this technology to track you doesn't mean it can't be done or that they aren't working on it.
  • cyphar 3y ago
    Why would they bother trying to track you through a specification which is specifically designed to make it hard to track users? If you're using one of these software-based SSO lock-in "tokens" then they can get all the information they want from telemetry (nee spyware) on the device.
    • account-5 3y ago
      A device you must use to authenticate.
  • brookst 3y ago
    That's a lot of speculation to be using as the basis for opinion.
    • account-5 3y ago
      Extrapolation from known facts of past conduct more than speculation. Either one is a good basis for opinion, since opinion is entirely subjective.
      • brookst 3y ago
        Fair enough. I personal try to avoid feedback loops of forming opinions based on what I expect people to do based on my opinions. YMMV.
• michaelt 3y ago
  > I don't understand your point about vendor lock-in, on the devices side YubiCo, Feitian and NitroKey exist (as well as many others probably) and are none are "multinational corps" in the derogative sense (the replies make reference to Google, Microsoft, Apple -- do those companies even produce U2F tokens?). The U2F keys made by Yubikey are indeed OK from a privacy and lock-in perspective. But the new latest thing from Google+Microsoft+Apple is 'passkeys' or 'passwordless' authentication, where you won't have a password. Two-factor authentication will be device+biometric, with the biometrics performed on the device. 'The device' in this case will be your smartphone, or windows PC with TPM. Or maybe a biometric yubikey for 0.01% of users. They've also fixed one of the big usability stumbling blocks of U2F, by allowing your credentials to be synchronized to your cloud account - so even if you lose your iphone you won't be locked out of your account, you can just buy a new iphone and restore the backup. And of course, you can't expect to restore the backups to incompatible devices - that might let attackers bypass the biometrics. It's fairly obvious why Microsoft would like people to not have passwords, and to log into websites using something locked to Windows and their Microsoft account.
  • cyphar 3y ago
    It seems to me that is the same problem as Single Sign On, and I think there simply needs to be legislation to make it not possible to monopolise markets this way (or just enforce the existing legislation on the topic). WebAuthn/FIDO are not the issue here.
  • 0xCMP 3y ago
    A passkey is just a "software yubikey". I highly recommend trying to implement a demo of this and you'll see how little difference there is between them unless you specifically go out of your way.
    • prophesi 3y ago
      That's the point, if I'm reading this thread correctly. Google/Apple/Microsoft's implementation will be going out of their way to tie it specifically to a device and biometrics.
• dathinab 3y ago
  The vendor locking argument is less about "classical" WebAuthn and more about passkeys. But even for "classical" WebAuthn it's still a valid issue. The problem lies in: 1. attestation 2. browsers like chrome possible gate-keeping what can work as an authentication device (independent of attestation) Attestation is a feature where each "batch" of authentication devices get a unique certificate burned in and report that back when registering a key through webauthn. There will be roughly at most 10_000 other people with the same cert. In many cases likely less. And that is _highly_ problematic for many reasons. First while 10_000 sounds big, with just a bit additional fingerprinting information it allows a very unique fingerprinting of people across services (and devices you use to access the services). The combination of cert id + e.g. email + service + optional statistics about usability is _very_ saleable information, I mean a private health care provider would love to know that someone who might be one of their customers has signed up for a online anonymous alcoholic group or similar. They don't even need to know it's them for sure, just knowing it could be them with a 10% chance is enough to make sure to bump what their client has to pay "just to be save" the next chance the provider gets to do so. Furthermore this are "burned in" certs so you can't have a different attestation certificate per service or anything like this without also having different physical devices, which in case of e.g. using your phone might be hard. This "burned in" nature also means that some things can't have attestation, e.g. KeyPassXC or the TKey by nature can't (nor do want to) have this form of attestation. In turn if attestation is required this vendors are basically out of business. But this isn't where the problems stop, attestation can also be used to find out what kind of device you have in general including an approximate date of production. So now the page you auth against knows you use a specific kind of YubiKey or e.g. that you use a specific phone produced in some specific time frame for authentication. This is very useful information for marketing as e.g. lifestyle and believes often influence buying decisions, not necessary in the current HSK market, but on the phone market which with passkey will likely become the most common HSK. Furthermore this information can be used to remove agency from the user, e.g. through attestation a app can know that your HSK does support bio-metric authentication and in turn might force you to use it, even through you might not be able to do so because e.g. the fingerprint reader is broken or you had an op which makes face recognition impossible. Lastly attestation allows applications to not work with HSK vendors they don't like even if they are standard conform. E.g. if Microsoft has beef with YubiKey they could reject them and make it look like a bug. Or a app you have for work could decide that using any HSK which isn't their partner (or from themself) is only usable if you pay a premium or similar. Now the good part is WebAuthn doesn't require attestation. You can set attestation to none, and this can be done for devices which support attestation, too. E.g. Firefox does so by default. The problem is if even just a small number of the big players (e.g. Google + Microsoft) decide they do require attestation on all logins it could be game over for _any form of privacy preserving 2FA for good for ever_ (except if regulators step in). Worse through chrome and edge they can enforce requiring attestation for sides which do not want to enforce it and collect additional private information by sending the attestation information data to their ad-services. Don't forget that not to long ago edge had a bug which wasn't fixed for a long time which lead to it basically sending all links their user followed to bing, including magic sharing links like you e.g. know from google drive. So don't expect vendors to not a And for the big players enforcing attestation through the ecosystem is as easy as flipping a switch. As most HSKs support attestation. Furthermore they could add additional requirements, like only accepting attestation from vendors which have gone through some very expensive security review done by companies of their choice (Google already does so for access to (large pars of) their oauth2 authenticated APIs). This could mean good-by to any smaller or new HSK vendors, and might majorly hurt phone vendors they don't like. Now you might wonder why attestation exist if it's that bad. The reason is requirements for some enterprises like e.g. military contractors requiring FIPS certified devices. Attestation can be used to enforce this. It also can be used to e.g make sure your employees only use HSKs you gave to them. IMHO the main problem I see is not that attestation does exist, but that it's often phrased as a good or desirable thing (instead of a necessary evil) by the groups pushing for WebAuthn/passkey making me believe that there is a extremely high risk of abuse of this feature by Google, Microsoft or similar in the not so distant future. Especially given that it can be monetary wise quite beneficial and could be forced down the throat of users without most realizing it. I would prefer if attestation would by default always be off and the spec requiring vendors to support non-attested devices as long as the user (or company the user belongs to) doesn't require it. Require that attestation information must be enabled on the key instead of being enabled by default, etc. I.e. make it cumbersome enough so that it can't easily be abused but still usable for the rare military contractor like use case. Oh and also there should be ways to have more privacy preserving attestation, too. EDIT: To be clear you don't have the whole cert with all device information burned in, but a private key + some metadata and you can look up all this information based on the metadata depending on the kind of attestation. I.e. it works similar to TPM attestation, but not necessary exactly the same (expect if you used a TPM as HSK then it's exactly the same). EDIT2: Just to be clear WebAuthn is in general a grate idea and could even lead to more privacy if used nicely. But it sadly has also potential for abuse and the parts which allow abuse can't be stripped out for practical reasons. So I'm worried. EDIT3: WebAuthn today is mostly used for second factor in 2FA but it has the potential to become the first factor or fully take over both factors. Providing a more secure and convenient experience. But if abused also enforce more control of big cooperation, leak ton of private information (especially to the big cooperation's) and remove agency from the user in a not really acceptable way. EDIT4: China could use attestation internally to even more control their citizens if they want to (might not be worth the effort), e.g. requiring vendors to be whitelisted (hint: vendor leaks private keys to government) or coupling the citizen score to it in some way.