6 ms·

I don’t necessarily think OP believes this point of view, but even HN folks seem to think passkey is some wild biometric stealing mega Corp conspiracy. See a l

by wepple 3y ago

I don’t necessarily think OP believes this point of view, but even HN folks seem to think passkey is some wild biometric stealing mega Corp conspiracy. See a lot of the comments in this thread as an example: https://news.ycombinator.com/item?id=35801392 https://news.ycombinator.com/item?id=35801392

signal11 3y ago
> HN folks seem to think passkey is some wild biometric stealing mega Corp conspiracy. What it does is promotes further centralisation, because most users will use one of the big providers. This wouldn’t be a problem either, except that the big providers are not accountable. Google, Meta, etc lock users’ accounts all the time. Users often have no recourse. Passkeys will mean a locked Google account now impacts your ability to sign into all the sites where you used that passkey. Think it can’t happen to you? “Oh Google won’t lock my account out!” That’s exactly what those locked out thought too. The fundamental problem with Passkeys isn’t technical. Even ignoring the centralisation issue, the problem is a lack of organisational accountability on the part of Google, Meta etc. And yeah, the tech industry, including the tech press, needs to own the fact that they’ve given these companies a free pass over this.
- cyphar 3y ago
  But I don't see how passkeys factor into this discussion at all. Yes, large companies are unaccountable and they do harmful things to their users without recourse. This is unrelated to the method you use to log into microsoft.com. WebAuthn is not Single Sign On (where you are centralising logins) -- it seems a lot of people on HN think that it is. I don't like SSO as the only option for a site (precisely for the centralisation reasons), but that's very explicitly not what WebAuthn is. The test page for WebAuthn (on their site) is completely self-hosted and every site I've seen that supports WebAuthn self-hosts it.
  - signal11 3y ago
    The parent comment I replied to brought up passkeys, trying to paint criticism of it as “conspiracy”.
    - cyphar 3y ago
      Is "passkey" not another word for a WebAuthn/FIDO token?
      - signal11 3y ago
        They’re similar but differ in some important ways[1]. Passkeys were built on top of work done by FIDO though. [1] https://css-tricks.com/passkeys-what-the-heck-and-why/#the-difference-between-passkeys-and-webauthn https://css-tricks.com/passkeys-what-the-heck-and-why/#the-d...
      - deleted 3y ago
        [deleted]
  - jtbayly 3y ago
    Just to be clear, because I do t know the answer to this… if Google locks your account, can you still use your Android device to login with a passkey to that other site?
    - growse 3y ago
      I guess that'll depend on whether you phone still functions if Google dlocks your account. But worst case, yes, but only in the same way that if you put all your photos on Google photos and then they block your account, you won't have access to your photos any more. If that's a concern, then don't do that. I think the passkey design actively encourages sites to support multiple authenticators, so you just enrol your yubikey as well as your phone and you're good.
      - jtbayly 3y ago
        So what I hear you saying is that if a normal person gets locked out of their Google account, they will also be locked out of every other website they have accounts with. Yikes. I guess I’ll be telling everybody to stay far away from passkeys. *By “normal,” I mean the people who don’t have yubikeys, like myself. Lol. Edit: wait, what do you mean if your phone still works? Also, does this mean if you lose your phone you can’t log into anything? How do you recover from that?
        growse 3y ago
        > So what I hear you saying is that if a normal person gets locked out of their Google account, they will also be locked out of every other website they have accounts with. > Yikes. I guess I’ll be telling everybody to stay far away from passkeys. This is a bit like telling everyone to stay away from password managers, just because Google offers one with Chrome that potentially disappears (taking all your passwords with it) when they nuke your account. No, passkeys are fine. Just don't rely on a single, central provider who you consider an adversary. > Edit: wait, what do you mean if your phone still works? Also, does this mean if you lose your phone you can’t log into anything? How do you recover from that? If you lose your yubikey/Google authenticator/whatever TOTP, you're in a similar pickle. So then you do account recovery (recovery codes etc.)
- throwaway2056 3y ago
  > What it does is promotes further centralisation, because most users will use one of the big providers. Because there are no easy non-centralised solutions (that works for Average Joe)? Remember Average Joe cannot - backup keepass - 3-2-1 backups using ZFS BTW, if so many average Joe's lost google accounts then there would be outrage and great chaos (like ticketmaster etc). So some people lost Google accounts - true. Same some people list U2F key. > the tech industry, including the tech press, n Pragmatism will win. This reminds me of IRC vs WhatsApp (or Signal). People want things to be simple.
  - danShumway 3y ago
    > People want things to be simple. As a reminder, if you ask what the best way is to back up a Yubikey, the advice is: - Buy a second Yubikey - Store it in a separate physical location, preferably within a fireproof safe - Whenever you make a new account, set yourself a reminder to go get your second Yubikey, log in with the first Yubikey and then go through whatever process the site has (on a site-by-site basis without a consistent UI) and add the second Yubikey as another credential. - Then go back to whatever secondary location you've chosen and put the second Yubikey back. - And then repeat that process every single time you make a new account. In contrast, dragging a KeePassXC vault into a Dropbox folder one time and just leaving it there and using it from Dropbox is incredibly simple and I feel like pretty much anyone is capable of doing that.
    - cyphar 3y ago
      If you don't need a proper second factor, just set up TOTP and store it in KeePassXC. There is little benefit to a WebAuthn/FIFO "key" stored in your password manager over a password manager with your TOTP stored in it -- almost all of the benefits of WebAuthn (making phishing much harder) already exist with password managers that auto-fill. There are usecases where you need proper multi-factor authentication, and in those cases you are either a professional (meaning you can handle backups yourself) or you're working for a large company where the management of the keys is done by IT and normal workers don't have to care about it.

by wepple 3y ago

signal11 3y ago

> HN folks seem to think passkey is some wild biometric stealing mega Corp conspiracy. What it does is promotes further centralisation, because most users will use one of the big providers. This wouldn’t be a problem either, except that the big providers are not accountable. Google, Meta, etc lock users’ accounts all the time. Users often have no recourse. Passkeys will mean a locked Google account now impacts your ability to sign into all the sites where you used that passkey. Think it can’t happen to you? “Oh Google won’t lock my account out!” That’s exactly what those locked out thought too. The fundamental problem with Passkeys isn’t technical. Even ignoring the centralisation issue, the problem is a lack of organisational accountability on the part of Google, Meta etc. And yeah, the tech industry, including the tech press, needs to own the fact that they’ve given these companies a free pass over this.

cyphar 3y ago
But I don't see how passkeys factor into this discussion at all. Yes, large companies are unaccountable and they do harmful things to their users without recourse. This is unrelated to the method you use to log into microsoft.com. WebAuthn is not Single Sign On (where you are centralising logins) -- it seems a lot of people on HN think that it is. I don't like SSO as the only option for a site (precisely for the centralisation reasons), but that's very explicitly not what WebAuthn is. The test page for WebAuthn (on their site) is completely self-hosted and every site I've seen that supports WebAuthn self-hosts it.
- signal11 3y ago
  The parent comment I replied to brought up passkeys, trying to paint criticism of it as “conspiracy”.
  - cyphar 3y ago
    Is "passkey" not another word for a WebAuthn/FIDO token?
    - signal11 3y ago
      They’re similar but differ in some important ways[1]. Passkeys were built on top of work done by FIDO though. [1] https://css-tricks.com/passkeys-what-the-heck-and-why/#the-difference-between-passkeys-and-webauthn https://css-tricks.com/passkeys-what-the-heck-and-why/#the-d...
    - deleted 3y ago
      [deleted]
- jtbayly 3y ago
  Just to be clear, because I do t know the answer to this… if Google locks your account, can you still use your Android device to login with a passkey to that other site?
  - growse 3y ago
    I guess that'll depend on whether you phone still functions if Google dlocks your account. But worst case, yes, but only in the same way that if you put all your photos on Google photos and then they block your account, you won't have access to your photos any more. If that's a concern, then don't do that. I think the passkey design actively encourages sites to support multiple authenticators, so you just enrol your yubikey as well as your phone and you're good.
    - jtbayly 3y ago
      So what I hear you saying is that if a normal person gets locked out of their Google account, they will also be locked out of every other website they have accounts with. Yikes. I guess I’ll be telling everybody to stay far away from passkeys. *By “normal,” I mean the people who don’t have yubikeys, like myself. Lol. Edit: wait, what do you mean if your phone still works? Also, does this mean if you lose your phone you can’t log into anything? How do you recover from that?
      - growse 3y ago
        > So what I hear you saying is that if a normal person gets locked out of their Google account, they will also be locked out of every other website they have accounts with. > Yikes. I guess I’ll be telling everybody to stay far away from passkeys. This is a bit like telling everyone to stay away from password managers, just because Google offers one with Chrome that potentially disappears (taking all your passwords with it) when they nuke your account. No, passkeys are fine. Just don't rely on a single, central provider who you consider an adversary. > Edit: wait, what do you mean if your phone still works? Also, does this mean if you lose your phone you can’t log into anything? How do you recover from that? If you lose your yubikey/Google authenticator/whatever TOTP, you're in a similar pickle. So then you do account recovery (recovery codes etc.)
throwaway2056 3y ago
> What it does is promotes further centralisation, because most users will use one of the big providers. Because there are no easy non-centralised solutions (that works for Average Joe)? Remember Average Joe cannot - backup keepass - 3-2-1 backups using ZFS BTW, if so many average Joe's lost google accounts then there would be outrage and great chaos (like ticketmaster etc). So some people lost Google accounts - true. Same some people list U2F key. > the tech industry, including the tech press, n Pragmatism will win. This reminds me of IRC vs WhatsApp (or Signal). People want things to be simple.
- danShumway 3y ago
  > People want things to be simple. As a reminder, if you ask what the best way is to back up a Yubikey, the advice is: - Buy a second Yubikey - Store it in a separate physical location, preferably within a fireproof safe - Whenever you make a new account, set yourself a reminder to go get your second Yubikey, log in with the first Yubikey and then go through whatever process the site has (on a site-by-site basis without a consistent UI) and add the second Yubikey as another credential. - Then go back to whatever secondary location you've chosen and put the second Yubikey back. - And then repeat that process every single time you make a new account. In contrast, dragging a KeePassXC vault into a Dropbox folder one time and just leaving it there and using it from Dropbox is incredibly simple and I feel like pretty much anyone is capable of doing that.
  - cyphar 3y ago
    If you don't need a proper second factor, just set up TOTP and store it in KeePassXC. There is little benefit to a WebAuthn/FIFO "key" stored in your password manager over a password manager with your TOTP stored in it -- almost all of the benefits of WebAuthn (making phishing much harder) already exist with password managers that auto-fill. There are usecases where you need proper multi-factor authentication, and in those cases you are either a professional (meaning you can handle backups yourself) or you're working for a large company where the management of the keys is done by IT and normal workers don't have to care about it.