12 ms·

Passage by 1Password: Add passkey support to your app or website

135 points by donutshop 3y ago

strangelove026 3y ago
Say I initially created an account with my computer. If a passkey is tied to a device, what do I do when I want to login with my phone?
- mooreds 3y ago
  Disclosure, I work for FusionAuth. This is the primary issue with passkeys. When FusionAuth implemented WebAuthn/passkeys last year[0], we decided to have passkeys be a separate, additional login method, just like social sign-on or magic links, for this exact reason. My understanding is that there is some work in the next version of WebAuthn[1] to allow sharing of passkeys across devices, addressing this user experience issue. 0: https://fusionauth.io/docs/v1/tech/premium-features/webauthn/ https://fusionauth.io/docs/v1/tech/premium-features/webauthn... 1: https://www.w3.org/TR/webauthn-3/ https://www.w3.org/TR/webauthn-3/
  - tehbeard 3y ago
    Does there need to be work on webauthn for it? (maybe some wording sugggestions around "resident keys" which I think are meant to be persistent and within a singleTPM or such, but no technical constraints beyond that afaik). My understanding was passkeys was just Apple Marketing(tm) around their implementation and integrating it with iCloud/keychain?
    - mooreds 3y ago
      Looks like they have had a section on key loss since at least webauthn 2[0], and explicitly rule out backing up keys. The suggested answer is "use multiple devices" which doesn't work great with platform authenticators (which are tied to a device). From the spec: > This specification defines no protocol for backing up credential private keys, or for sharing them between authenticators. In general, it is expected that a credential private key never leaves the authenticator that created it. Losing an authenticator therefore, in general, means losing all credentials bound to the lost authenticator, which could lock the user out of an account if the user has only one credential registered with the Relying Party. Instead of backing up or sharing private keys, the Web Authentication API allows registering multiple credentials for the same user. For example, a user might register platform credentials on frequently used client devices, and one or more roaming credentials for use as backup and with new or rarely used client devices. So I guess you are right, it is on the vendors to handle backing up the keys from devices. 0: https://www.w3.org/TR/webauthn-2/#sctn-credential-loss-key-mobility https://www.w3.org/TR/webauthn-2/#sctn-credential-loss-key-m...
- paxys 3y ago
  You create another passkey on your phone, and the site accepts both of them.
  - recursive 3y ago
    But what if I want to be able to use the same account, but I don't want other people to be able to use my account?
    - paxys 3y ago
      That has nothing to do with anything. Think of this as a password, except the password is autogenerated and stored on the device itself. And you can have multiple passwords for the same account.
      - recursive 3y ago
        Who is allowed to add an additional password and how are they authenticated? The answer has to be simple enough for me to understand if I'm to consider using passkeys.
        paxys 3y ago
        All that is up to the website to decide. This protocol is only for user authentication between the browser and a website.
        recursive 3y ago
        The authentication scheme it seeks to replace has an answer for this. Sounds like a drawback.
  - drdaeman 3y ago
    TBH, I don't get how "normal" users without a roaming authenticator are going to do this. Let's say I'm a layman person, nothing fancy, my password is my cat's birthday and I have a home desktop PC for gaming and laptop for my work. My desktop Windows computer can authenticate to a website, and is currently have it open and me logged in as "Alice". Now, I want to access the site from my Mac laptop. I go to the website, but I assume that to add an additional passkey to account "Alice" I must somehow authenticate. I cannot do this on my laptop - only my desktop has a valid passkey so far. Let's assume it's not removable, and I don't have any fancy password manager that syncs across my computers - again, our Alice is completely non-technical. So we must either: a) somehow create a passkey on laptop, transfer its public key to desktop, register it there, then be able to log in from the laptop; or b) initialize login flow on laptop, but transfer the request to desktop, make it generate a valid authentication response, transfer it back to laptop, get logged in, then proceed with registering a new passkey. Are we going to have fun with waving laptop camera, or there's some BLE protocol, or we're ditching all our fancy cryptography-protected authenticators and going straight for access recovery aka "code over email/sms" lowest-common-denominator? (Which possibly implies spam^W contact methods are mandatory?) All the demos I've found online seem to completely disregard this aspect, they just show me "start over" after I log in with the first device, and I haven't found any showcase of how can I enroll a second device. Their FAQs sorta imply I'm either all-Apple or all-Google or all-Microsoft person because all they say is that software providers will sync keys across devices. Which - I hope to be wrong - but I find unlikely.
- CharlesW 3y ago
  > Say I initially created an account with my computer. If a passkey is tied to a device, what do I do when I want to login with my phone? You create an additional passkey for that device, or use a password/passkey manager that syncs your passkeys across devices. (Note: I've actually done the former with my Google account. I'm waiting for passkey support in 1Password to test the latter scenario, but believe this is how it'll work.)
  - Zamicol 3y ago
    I do not believe this is true. Passkey is only a 1 user, 1 key system. This means that to login on a second device, the 1. key must be exported from the first device, 2. encrypted, and 3. transferred to the second device. Each device needs a copy of the private key.
    - kccqzy 3y ago
      You can add multiple passkeys on your Google account today. If a website is dumb enough that they only allow a single passkey per account, they have misunderstood passkeys profoundly.
      - Zamicol 3y ago
        Google != passkeys. Google may allow multiple keys, but that is outside of what FIDO specifies for passkeys. Here's a source saying that passkeys expect one and only one key: https://auth0.com/blog/our-take-on-passkeys/ https://auth0.com/blog/our-take-on-passkeys/ "Passkeys are designed to [...] allow the FIDO credential to roam across multiple devices. This [means that there's ] no need to repeat enrollment on each device [.]" > If a website is dumb enough that they only allow a single passkey per account And that's exactly my point.
tootie 3y ago
Interesting but I dislike the opaque pricing. Free for 1000 MAUs, beyond that it's "contact sales"
- micah-1password 3y ago
  Hey there. Passage products are in early beta, so some of the details are being worked out. We expect more specifics to be added to the pricing page in the coming weeks. Stay tuned!
obituary_latte 3y ago
Interesting concept. I like the idea of being able to easily leverage Biometrics for auth, but am reluctant to be tied to a third-party to support authentication. I'm sure it could be switched out quickly for something else, but that could be a shock to less tech savvy etc. users.
- mooreds 3y ago
  Disclosure, I work for FusionAuth, an auth provider. There are other options out there that let you self host WebAuthn. I was on a python podcast[0] and found some python libraries. It's public key management and a JS API that you need to carefully implement, not rocket science. I've written elsewhere about the tradeoffs of using an in-house auth solution vs an outsource auth provider[1], so I won't say more about that here. 0: https://realpython.com/podcasts/rpp/133/ https://realpython.com/podcasts/rpp/133/ 1: https://news.ycombinator.com/item?id=35814332 https://news.ycombinator.com/item?id=35814332
colinclerk 3y ago
Does the crowd on HN expect passkey support to become more ubiquitous in the future, similar to Google OAuth today? I’ve been surprised at how few sites seem to be adopting rapidly since there are UX gains, but I suppose Google had a fairly slow trajectory as well.
- timeimp 3y ago
  Once Apple and Google have pushed it out with their mobile devices, things will move along fast. I'd argue within 5-ish years you'll start encountering people who have never used a username + password combo at all. Passkeys are the future - but how they will work across ecosystems remains to be seen (without a subscription)
  - barkerja 3y ago
    Passkey support has been on iOS since the release of iOS 16 -- so more than a half-year! Google has actually had support for passkey for many many months now, but for whatever reason, waited to formally announce it until just recently. Cross-platform is also already solved. See the FAQ directly from the FIDO Alliance: https://fidoalliance.org/passkeys/#faq https://fidoalliance.org/passkeys/#faq
    - howinteresting 3y ago
      > If the user does not have their old device or a security key, then the RP can treat sign-in from the new device (which might be from a different vendor) as a normal account recovery situation and take appropriate steps to get the user signed in. LOL. This is not a serious answer.
  - vbezhenar 3y ago
    > I'd argue within 5-ish years you'll start encountering people who have never used a username + password combo at all. But can one register apple/google account without password with fresh phone on setup screen? What would happen if that phone would die? Apple often asks for icloud password in various places (which really surprises me, I mean it's Apple app on Apple device which logged in, why ask me about it). It still looks to me like master password (which is google/icloud password) and other accounts are accessible with this master password. Just less friction: no need to copy random passwords around.
WA 3y ago
Interesting, but weird pricing. "Contact us" for 1,000+ MAU, which is every useful app out there. Compare this with Supabase, which is $25 for 100,000 MAUs.
- edsimpson 3y ago
  Or Bitwarden's Passwordless.dev which is free for 10,000 users. The pro plan is $0.05 per user/month for the first 10,000 users and $0.01/user for users above 10,000.
- deleted 3y ago
  [deleted]
- iancarroll 3y ago
  Yeah, this "contact sales" threshold is pretty absurd. Presumably this is targeting B2C apps but who is going to bother with such a low number?
  - micah-1password 3y ago
    Hey there! We expect to add more pricing details to the page in the coming weeks. The ambiguity is just because the products are currently in early beta.
- micah-1password 3y ago
  Hey there. The Passage products are in early beta, so some of the details are being worked out. We expect to be able to add more specific pricing info in the coming weeks. Stay tuned!
noodlesUK 3y ago
The question I have with something like this is essentially “does it support SSO”? If I’m building software for end users, at least some subset of those users will want SSO.
- madeofpalk 3y ago
  I think you can think about passkeys as an equivalent to username + password. Supporting usernames + passwords on your site does not prevent you from also supporting SSO - it's just a auth mechanism you might use to grant access to an account, on top of SSO, Passkeys, email sign-up link, etc
  - toomuchtodo 3y ago
    Correct! Your IdP would be where the passkeys would be supported. From there, auth is federated to other systems.
- mooreds 3y ago
  Disclosure, I work at an auth provider. I haven't looked deeply at what 1password offers, but I know that "does it support SSO" is a question other providers that started with passkeys only had to answer "yes" to relatively quickly. (Stytch comes to mind.) The honest truth is that auth is the front door to your application. For most applications, you want a secure door, but also one that lets in as many people as possible. So social sign-on, federation/SSO, passkeys, magic links, and even username/passwords are all methods you want to support asap.
- paxys 3y ago
  Passkeys are just the authentication mechanism. They have nothing to do with SSO. You can use a passkey to log in to randomsite.com, OR you can use a passkey to log in to okta.com which then forwards your session to randomsite.com.
deleted 3y ago
[deleted]
nailer 3y ago
I do not understand how the demo is different from just using webauthn normally.
- Hackbraten 3y ago
  The difference is 1Password not pocketing their share in the latter case.
drcongo 3y ago
As a CTO / dev, I'm sure I'm 1Password's target market for this. As a 1Password customer though, I'm painfully aware of how they treat their customers, so I'd rather use almost any other provider than 1Password.
- regnerba 3y ago
  Can you expand on that? We are 1Password customers and have one had good experience.
  - drcongo 3y ago
    I've been a 1Password customer for as long as they've existed - every major version release is worse than the last with features we rely on removed. I haven't dared try the latest electron version, but 1P7 managed to even kill keyboard navigation (try editing a login and see if you can generate a new password without moving your hands from the keyboard, or tab between fields to enter new information).
- kstrauser 3y ago
  That's not been my experience. I work for a small company and we have less than 100 1Password licenses, but I still have an account rep emailing me to set up a quarterly check-in. They've escalated technical questions to engineers for us and everything. That's not to disclaim any problems you've had with them. Just saying, they've been solid for us.
appleaday1 3y ago
[flagged]
- PKop 3y ago
  What the hell are you talking about?
  - appleaday1 3y ago
    There is an entire housing or real estate crisis in many parts of the world, for some people seeing a real estate search site could be triggering.
    - PKop 3y ago
      There is always a housing or real estate crisis in many parts of the world. So what? And yet, people still need tools and services to purchase real estate, so it is good that they are built and promoted so people find them and can use them. How does hiding the existence of these tools help anyone? I'm not sure why a tech service company should concern themselves with catering to the emotional whims of people "triggered" after seeing software tools that enable real estate deals. These people don't sound like a valuable market segment. And these people should follow the advice of Tyler the creator [0] [0] https://twitter.com/tylerthecreator/status/285670822264307712 https://twitter.com/tylerthecreator/status/28567082226430771...
      - appleaday1 3y ago
        Except what you might think is not a valuable market segment is growing steadily every year. Newer generations of consumers are increasingly becoming hyper aware of the situations around them. It's not necessarily a good idea to poke the bear if you can avoid it in the first place. I know all this sounds absurd and this is coming from a developer myself. The companies that are just developing tooling or protocols should not have to worry about silly things like this and focus on improving their platform or the quality of it. I am personally aware of what people are facing as I moderate one of the biggest housing activist forums out there and even highly paid software engineers are suffering allegedly according to a very popular post. This is why I think companies like 1passwd should be wary with what kind of content they are promoting as it might come back to bite them in the future. As I am writing this, there is a petition that was started by a 13 year old girl to stop our housing minister from profiting off the real estate market as many people think it's a conflict of interest. But yes mistakes do happen and sometimes you wonder how something could get passed or if something had any oversight at all. Take a look at with what's going on with the .zip domain that was released by Google domains, a portion of the infosec community is furious because their work got doubled this week, there are blocklists such as blocklist.zip passing around so that people can remediate actions that is happening in that space with the ongoing phishing campaigns or the potentials of it. Part of this is letting go of your ego and realizing that you might have made a mistake and owning upto it and taking the action. In this case its a non-issue from 1passwd, because they are providing a tool to make authentication easier, but if companies keep promoting real estate content excessively in the future or a pattern forms it might become an issue to the point of losing subscribers. However, I think this is an opportunity for companies like 1passwd to be involved in the future by appealing to the newer generations as it might net them subscribers in the long term as well as positive mindshare from the community.
nerdjon 3y ago
I really don't know how I feel about this shift in passwords. I have long preferred the use of a password manager knowing that if they do something shady I don't like (like when I moved from lastpass to 1password) I could just pick up and move and I was not locked into that platform. That doesn't mean I have not used SSO before with my Apple ID, but it was not my preferred way to log in. My primary worry is being locked into a specific provider of login (like 1password) and not able to ever leave them. I ditched google long ago but I still have some accounts I have to log in with Google. Is there a part of Passkey that makes this a non issue that I am unaware of or are we kinda just doing another version of SSO with a biometric component? Also related, what about devices without biometrics? Does it fall back to your phone or something? I also don't love the idea of the provider of the passkey authentication having data about where I go, where I login and when.
- ecesena 3y ago
  At the end of the day passkeys are a public/private key pair. While now they're new and it seems everybody's doing some sort of lock in, I would expect standards to emerge soon to export the private keys and reimport them in a different apps. Unlike passwords, passkeys protect against phishing and are not shared with the server (the server knows the public key, not the private one). Biometrics on phone are used to unlock password manager/passkeys, but they're not sent to the server (thanks god!) for verification. So they can't really be used for remote authentication.
  - nerdjon 3y ago
    So this really isn't just an updated SSO implementation its an entirely different mechanism. I did not realize that. I am a bit worried that the standards and ability to move around is not just part of the implantation right out the gate. I do worry what this will mean for the more average user, this is a major shift in how things work.
    - AviationAtom 3y ago
      Correct. Nothing is centralized about Passkey (other than where you may choose to store your authenticators). Each site gets a unique keypair. If your keypair is compromised you can delete it on that given site. Passkeys is more or less just a more convenient implementation of FIDO2 or the like, as you'd traditionally have with a Yubikey token. Instead you move it to a supported password manager or mobile device. If you want to try it out go to https://passkeys.io https://passkeys.io on your Android or iOS device. I do believe Passage is more or less what Passkeys is/already was.
NelsonMinar 3y ago
Is this 1Password's first server-side product? I think of them only as having the consumer password agent (and related IT management stuff)
- noahmasur 3y ago
  They also have 1Password Connect, which allows you to bridge an API into your data for automation workflows, Terraform, syncing with Kubernetes, HashiCorp Vault, etc.
sega_sai 3y ago
I am personally not switching to passkeys unless I see a clear description of all possible failure modes. I.e. Google blocks you, you loose your phone, you want to migrate from one provider to another, when passkeys offer more security and when less. I feel with authentication, it's always those special cases that determine the usefulness and security, but when passkeys are discussed I never have seen a proper discussion a pros and cons and special cases. At least with regular passwords + 1password I kind'a understand what i am protected against and how to restore from disasters.
- drdaeman 3y ago
  Here's what I care about: 1. If I can fully physically own some of my authenticators. Aka if Yubikeys or similar hardware tokens are supported, so I don't have to long-term trust any corporation to correctly and securely store my credentials - with Yubikeys the only trust is that hardware is free of vulnerabilities or backdoors. 2. If I'm guaranteed to be not bound to any single specific authenticator. Aka if I'm safe if I lose a Yubikey, assuming that I've prepared ahead of time (also see the next point). 3. If I can enroll an authenticator without having it physically present. Aka if I can sign up with one Yubikey and then tell the website "here is my phone, here's the public key of the Yubikey I keep in a safe, and here's a public key of a keypair I've generated on an airgapped machine, etched onto a titanium plate and buried in a secret stash, accept those for me as my alternative authenticators even though I don't have my private keys present". Aka if I don't have to run around the house (or worse) to just sign up for a website. 4. If I'm guaranteed to be able to use a software authenticator of my own development, shall I want it (despite whatever site owners may think of it). Aka if there are no attestation requirements that force me to use authenticators I don't trust. If it's "yes" to all four, then I'm in and advertising this to everyone I know about, because this is much better than a password manager. If 1, 2 and 4 are "yes" then I'm probably in with a mix of one HSM and one software authenticator with exportable private keys (so I have a guaranteed way out), but voicing my displeasure wherever I can as the system is inconvenient. If not, then I'm probably sticking with passwords for the time being.
  - saool 3y ago
    1, 2, and 4) Yes, that's already possible. Look into Solo Keys for open source hardware and firmware. The standard allows for key manufacturer attestation but seems like the way it is going (especially with the proliferation of software authenticators) it likely won't be relevant in practice. You can also enroll many authenticators to the same account (provided the service allows it, which most do). 3) This is pretty hard/impossible, I think. The authenticators don't use the same key-pair for all websites (a la SSH through Yubikey), but rather create a per-service, per-credential key-pair, and encrypt it with the main key-pair. The encrypted credential key-pair is then handed off to the server for storage, and the service sends it back for the authenticator to decrypt and use during a challenge. Clever trick to not depend on local hardware memory and be able to have unlimited per-credential key-pairs, but afaik prevents you from just "adding lists of public keys". I'm also not mentioning the resident keys aspect of the standard but that won't fix it as they're still service and credential based.
cmsj 3y ago
Surely passkey support is an open source kinda thing we would want to build on, rather than paying 1Password?
- micah-1password 3y ago
  Hey there, WebAuthn is an open standard that anyone can use to implement support for passkeys. That said, there is significant complexity around building a solution that can handle edge cases (devices that don't support passkeys), account recovery, etc. Not to mention the need to build out UI elements and back-end infrastructure. Passage is a solution that handles all of this for developers, so they can implement with just a few lines of code instead of building from scratch.
Zamicol 3y ago
I think a per-user blockchain with many user keys and a Merkle root representing current account state, synced individually to websites, would be a superior option to "passkeys". Websites would have to track a Merkle root on a per user basis. User A: Merkle root AA User B: Merkle root BB Edit: A problem with passkeys is a one (key) to one (user) relationship, which means device keys must be retrievable and transferred to other devices via encryption. It also means that if any device has weak security, your whole account is vulnerable. A multikey system would allow each device to have their own key, and an audit trail of what devices are logged into what services.
- rootusrootus 3y ago
  > A problem with passkeys is a one (key) to one (user) relationship That is untrue. It is a many-to-one relationship.
  - Zamicol 3y ago
    I do not believe that is the case. Do you have a source showing that multiple keys for a single user on per a single service basis is supported?
    - ewoodrich 3y ago
      I currently have 5 passkeys linked to my Google account for 5 separate devices allowing me to login to Google on any of them with the passkey created for that device. Edit: Google also shows when each passkey was last used for each device in an audit trail as you describe.
      - deleted 3y ago
        [deleted]
      - Zamicol 3y ago
        Google != passkeys. Google may allow multiple keys, but that is outside of what FIDO specifies for passkeys. Here's a source saying that passkeys expect one and only one key: https://auth0.com/blog/our-take-on-passkeys/ https://auth0.com/blog/our-take-on-passkeys/ "Passkeys are designed to [...] allow the FIDO credential to roam across multiple devices. This [means that there's] no need to repeat enrollment on each device [.]"
open-paren 3y ago
Bitwarden also just launched a similar offering: https://passwordless.dev https://passwordless.dev
sgjohnson 3y ago
Wouldn't it make more sense if they allowed us to store WebAuthn private keys in 1password, and then have a browser plugin that'd implement that?
- micah-1password 3y ago
  Hello there! 1Password will soon support saving and using passkeys from the 1Password app. Keep an eye out for an announcement in the coming weeks. That said, Passage is a completely different product-line that helps developers support passkeys in their own apps and websites.
  - sgjohnson 3y ago
    That's great to hear! Looking forward to it.
artdigital 3y ago
Passkey folks - can someone explain to me how this makes things more secure? For example, let’s take Apple. Apple Passkey support is great - I can store a passkey and it syncs through iCloud to all my devices. So my phone can login, my macbook can login. Neat. But thinking about this a little more, Passkeys on iPhones are secured with FaceID, so to login I have to use FaceID or other biometrics. But on iPhone you can skip the FaceID check if you know the device passcode as fallback. So now, if someone has access to my iPhone and knows my passcode, they have access to ALL my accounts that have Passkeys stored on my iCloud. Previously, even if an attacker had access to my iPhone, they still wouldn’t be able to login because they don’t know my password. And 1Password itself uses a separate unique password and can’t be skipped with device passphrase. I’m honestly surprised that we can’t lockdown passkeys on iOS with a separate password/key that’s used to encrypt those. It just seems like I’m giving up on security by switching to passkeys, away from randomly generated passwords. IMHO it should be: FaceID, and if you can’t use biometrics, you HAVE to specify that unique passkey-only encryption phrase to unlock it. Not device passcode. If not that, then I would have expected passkeys to be factor 1 authentication to directly replace passwords, and then have something else as second factor, such as TOTP/yubikey/SMS auth. But current implementations on any website I’ve seen so far treat Passkey as “ok you’re in”, while going the password route usually triggers a second-factor check.
- bgentry 3y ago
  Your iOS device passcode also gives root access to your entire iCloud account, including the ability to reset your account password. This was highlighted a couple months ago by the Wall Street Journal in relation to a recent wave of thefts & account takeovers which were exploiting this: https://www.wsj.com/articles/apple-iphone-security-theft-passcode-data-privacya-basic-iphone-feature-helps-criminals-steal-your-digital-life-cbf14b1a https://www.wsj.com/articles/apple-iphone-security-theft-pas... It seems we all need to treat our iOS device passcodes with as much importance & sensitivity as the password to our password manager—essentially root on your digital life.
  - AwaAwa 3y ago
    So we're back to using old fashioned keys to unlock our residential/digital space. The more things change.....
shmerl 3y ago
So passkeys are just private / public key authentication, right? So can it work with keepassxc for example?
- mdaniel 3y ago
  https://github.com/keepassxreboot/keepassxc/pull/8825 https://github.com/keepassxreboot/keepassxc/pull/8825 (https://news.ycombinator.com/item?id=35859877 https://news.ycombinator.com/item?id=35859877) may interest you, although the PR is still open, so likely not something someone could use right now
  - shmerl 3y ago
    Good to know, thanks. From looking around, current options are all tied to some proprietary tools, so not something interesting on Linux I suppose. Keepassxc implementing it would be nice.
ed 3y ago
This isn’t free?! Feels like 1Password is the main beneficiary in this relationship. Consider: 1pass owns the auth, and who knows how they’ll wield that power (need to deliver a return on their massive $920m VC round!), the burden to educate users about “passkeys” is on web developers, not 1pass, and guess who gets stuck providing customer support when a passkey doesn’t work? I’m a 1Password user and constantly run into edge-case bugs (for example there’s a UI flow that suggests a new password to use during google’s password reset, then doesn’t save the password - really!). I get that they don’t have the full support of OS developers, so there will be edge cases. But these problems keep e.g. my parents from sticking with password managers. It’s just easier for them to keep a password journal. At least they don’t reuse passwords in the event of a leak.
- kjreact 3y ago
  After 1Password moved to subscription only, I’m never recommending them to anyone. How does it make sense to surrender your authentication credentials to a subscription service?
  - LeoPanthera 3y ago
    > How does it make sense to surrender your authentication credentials to a subscription service? You're paying for cloud sync. 1Password don't get your credentials, they're encrypted client-side, and 1Password doesn't see your master password. If you don't want to pay for the service, that's fine, there are plenty of local-only alternatives for which you can presumably build your own syncing solution, but it's disingenuous to say that it doesn't "make sense" when you misrepresent a product which a lot of people obviously feel is worth the price - including me.
    - kjreact 3y ago
      Looking at the site, I may have worded my reply too strongly since you can still export your passwords even if your subscription ends. But nonetheless, 1Password used to make a great product where I could choose to sync my password to any cloud service of my choice without subscription. They discontinued their standalone product because they knew they could make a lot more money by selling subscriptions. That’s their prerogative, but it’s also mine to point potential customers to Bitwarden, which can be used free of charge, can be self-hosted, and is open source.
account-5 3y ago
My personal preference is for it not to be tied to a device that can be lost, stolen, broken. That way I don't need multiple backup devices to login to one service or multiple passkeys for the same service. My password manager generates unique strong passwords, is offline and no big multinational advertising company controls it. The only thing I need to worry about is individual company's security practices. Passkeys offer me nothing of an improvement over this and only more obstacles and hoops to jump through. Until I can use passkeys like I can my open source offline password manager I'm not using them.
ochoseis 3y ago
How do you prevent someone from squatting on an account with your email address, and an initial passkey they control?
landmass 3y ago
Curious about how Passkeys work at the website level. Passkeys strikes me as essentially an authentication method. 1. Signing up or logging in to a website today you'd expect your password to be hashed, stored, and protected. (I understand some are stored in plain text, but that isn't part of this question.) Assuming you want to change over, or create a new account, to passkeys, how do they store and protect that account? 2. Assuming you're still using a password manager for the foreseeable future, does it make sense to use passkeys to access that? IIRC, most password managers will use your password/passphrase (plus a lot of processing) to encrypt your vault. Even if you authenticate with passkeys and gain access, how do you decrypt your vault without your password/passphrase? It's clear that authentication does no good if your vault is already sitting on the black hat's desktop, as LastPass discovered, so a basis for encryption is still required. It appears to me that anything that requires an encrypted holding will still require passwords/passphrases.
LeoPanthera 3y ago
It's weird that they would launch this before the 1Password password manager actually supports PassKey.
five82 3y ago
So am I the only one who's noticed that average non-tech users are absolutely horrible with managing passwords and passkeys would be a huge improvement over reusing "ddccbbaa!" across every login they have?
- jeroenhd 3y ago
  Everyone I know about 40 years old use <name><year in range 1960-2000><special character to pass check, usually exclamation point> as the formula for their passwords. Capital letters are the first letter of the name, of course. The only exceptions are passwords generated for them with change password pages that are more than two clicks away. I applaud passkeys, despite their obvious problems surrounding their centralisation in Apple's or Google's account. The probability of your account being banned is much lower than the probability of Steven1971! getting guessed (or leaked in any hack).
AwaAwa 3y ago
Passkeys require the cloud to be ever present. Maybe on Venus where the clouds never go away, but on Earth all it takes is some rain, and suddenly you have clear skies. I'll stick with keepassxc on my personal laptop, rather than put it in the hands of Google et al. and their sunset happy ways. Atleast there's no segue into the blockchain and/or crypto as a 'benefit'. Small mercies and all that.
- kccqzy 3y ago
  Passkeys do not require the cloud. They require a local device such as a phone that has the passkey.
  - CSSer 3y ago
    I believe you two may be discussing theory vs practice. Users want the convenience of keys being synced across devices.
    - arianvanp 3y ago
      Both can be true at the same time.
pseudosavant 3y ago
I went to check it out for interest in a personal project, and potentially even for my company's identity stack. Lack of pricing makes building on it uncomfortable though. <1000 MAUs: free. 1000+ MAUs: contact us. Enterprise: contact us for bulk pricing. I need to know what kind of pricing ballpark we are talking about, and I'm not going to deal with some lame sales engagement to find out.

135 points by donutshop 3y ago

Say I initially created an account with my computer. If a passkey is tied to a device, what do I do when I want to login with my phone?

mooreds 3y ago
Disclosure, I work for FusionAuth. This is the primary issue with passkeys. When FusionAuth implemented WebAuthn/passkeys last year[0], we decided to have passkeys be a separate, additional login method, just like social sign-on or magic links, for this exact reason. My understanding is that there is some work in the next version of WebAuthn[1] to allow sharing of passkeys across devices, addressing this user experience issue. 0: https://fusionauth.io/docs/v1/tech/premium-features/webauthn/ https://fusionauth.io/docs/v1/tech/premium-features/webauthn... 1: https://www.w3.org/TR/webauthn-3/ https://www.w3.org/TR/webauthn-3/
- tehbeard 3y ago
  Does there need to be work on webauthn for it? (maybe some wording sugggestions around "resident keys" which I think are meant to be persistent and within a singleTPM or such, but no technical constraints beyond that afaik). My understanding was passkeys was just Apple Marketing(tm) around their implementation and integrating it with iCloud/keychain?
  - mooreds 3y ago
    Looks like they have had a section on key loss since at least webauthn 2[0], and explicitly rule out backing up keys. The suggested answer is "use multiple devices" which doesn't work great with platform authenticators (which are tied to a device). From the spec: > This specification defines no protocol for backing up credential private keys, or for sharing them between authenticators. In general, it is expected that a credential private key never leaves the authenticator that created it. Losing an authenticator therefore, in general, means losing all credentials bound to the lost authenticator, which could lock the user out of an account if the user has only one credential registered with the Relying Party. Instead of backing up or sharing private keys, the Web Authentication API allows registering multiple credentials for the same user. For example, a user might register platform credentials on frequently used client devices, and one or more roaming credentials for use as backup and with new or rarely used client devices. So I guess you are right, it is on the vendors to handle backing up the keys from devices. 0: https://www.w3.org/TR/webauthn-2/#sctn-credential-loss-key-mobility https://www.w3.org/TR/webauthn-2/#sctn-credential-loss-key-m...
paxys 3y ago
You create another passkey on your phone, and the site accepts both of them.
- recursive 3y ago
  But what if I want to be able to use the same account, but I don't want other people to be able to use my account?
  - paxys 3y ago
    That has nothing to do with anything. Think of this as a password, except the password is autogenerated and stored on the device itself. And you can have multiple passwords for the same account.
    - recursive 3y ago
      Who is allowed to add an additional password and how are they authenticated? The answer has to be simple enough for me to understand if I'm to consider using passkeys.
      - paxys 3y ago
        All that is up to the website to decide. This protocol is only for user authentication between the browser and a website.
        recursive 3y ago
        The authentication scheme it seeks to replace has an answer for this. Sounds like a drawback.
- drdaeman 3y ago
  TBH, I don't get how "normal" users without a roaming authenticator are going to do this. Let's say I'm a layman person, nothing fancy, my password is my cat's birthday and I have a home desktop PC for gaming and laptop for my work. My desktop Windows computer can authenticate to a website, and is currently have it open and me logged in as "Alice". Now, I want to access the site from my Mac laptop. I go to the website, but I assume that to add an additional passkey to account "Alice" I must somehow authenticate. I cannot do this on my laptop - only my desktop has a valid passkey so far. Let's assume it's not removable, and I don't have any fancy password manager that syncs across my computers - again, our Alice is completely non-technical. So we must either: a) somehow create a passkey on laptop, transfer its public key to desktop, register it there, then be able to log in from the laptop; or b) initialize login flow on laptop, but transfer the request to desktop, make it generate a valid authentication response, transfer it back to laptop, get logged in, then proceed with registering a new passkey. Are we going to have fun with waving laptop camera, or there's some BLE protocol, or we're ditching all our fancy cryptography-protected authenticators and going straight for access recovery aka "code over email/sms" lowest-common-denominator? (Which possibly implies spam^W contact methods are mandatory?) All the demos I've found online seem to completely disregard this aspect, they just show me "start over" after I log in with the first device, and I haven't found any showcase of how can I enroll a second device. Their FAQs sorta imply I'm either all-Apple or all-Google or all-Microsoft person because all they say is that software providers will sync keys across devices. Which - I hope to be wrong - but I find unlikely.
CharlesW 3y ago
> Say I initially created an account with my computer. If a passkey is tied to a device, what do I do when I want to login with my phone? You create an additional passkey for that device, or use a password/passkey manager that syncs your passkeys across devices. (Note: I've actually done the former with my Google account. I'm waiting for passkey support in 1Password to test the latter scenario, but believe this is how it'll work.)
- Zamicol 3y ago
  I do not believe this is true. Passkey is only a 1 user, 1 key system. This means that to login on a second device, the 1. key must be exported from the first device, 2. encrypted, and 3. transferred to the second device. Each device needs a copy of the private key.
  - kccqzy 3y ago
    You can add multiple passkeys on your Google account today. If a website is dumb enough that they only allow a single passkey per account, they have misunderstood passkeys profoundly.
    - Zamicol 3y ago
      Google != passkeys. Google may allow multiple keys, but that is outside of what FIDO specifies for passkeys. Here's a source saying that passkeys expect one and only one key: https://auth0.com/blog/our-take-on-passkeys/ https://auth0.com/blog/our-take-on-passkeys/ "Passkeys are designed to [...] allow the FIDO credential to roam across multiple devices. This [means that there's ] no need to repeat enrollment on each device [.]" > If a website is dumb enough that they only allow a single passkey per account And that's exactly my point.

tootie 3y ago

Interesting but I dislike the opaque pricing. Free for 1000 MAUs, beyond that it's "contact sales"

micah-1password 3y ago
Hey there. Passage products are in early beta, so some of the details are being worked out. We expect more specifics to be added to the pricing page in the coming weeks. Stay tuned!

obituary_latte 3y ago

Interesting concept. I like the idea of being able to easily leverage Biometrics for auth, but am reluctant to be tied to a third-party to support authentication. I'm sure it could be switched out quickly for something else, but that could be a shock to less tech savvy etc. users.

mooreds 3y ago
Disclosure, I work for FusionAuth, an auth provider. There are other options out there that let you self host WebAuthn. I was on a python podcast[0] and found some python libraries. It's public key management and a JS API that you need to carefully implement, not rocket science. I've written elsewhere about the tradeoffs of using an in-house auth solution vs an outsource auth provider[1], so I won't say more about that here. 0: https://realpython.com/podcasts/rpp/133/ https://realpython.com/podcasts/rpp/133/ 1: https://news.ycombinator.com/item?id=35814332 https://news.ycombinator.com/item?id=35814332

colinclerk 3y ago

Does the crowd on HN expect passkey support to become more ubiquitous in the future, similar to Google OAuth today? I’ve been surprised at how few sites seem to be adopting rapidly since there are UX gains, but I suppose Google had a fairly slow trajectory as well.

timeimp 3y ago
Once Apple and Google have pushed it out with their mobile devices, things will move along fast. I'd argue within 5-ish years you'll start encountering people who have never used a username + password combo at all. Passkeys are the future - but how they will work across ecosystems remains to be seen (without a subscription)
- barkerja 3y ago
  Passkey support has been on iOS since the release of iOS 16 -- so more than a half-year! Google has actually had support for passkey for many many months now, but for whatever reason, waited to formally announce it until just recently. Cross-platform is also already solved. See the FAQ directly from the FIDO Alliance: https://fidoalliance.org/passkeys/#faq https://fidoalliance.org/passkeys/#faq
  - howinteresting 3y ago
    > If the user does not have their old device or a security key, then the RP can treat sign-in from the new device (which might be from a different vendor) as a normal account recovery situation and take appropriate steps to get the user signed in. LOL. This is not a serious answer.
- vbezhenar 3y ago
  > I'd argue within 5-ish years you'll start encountering people who have never used a username + password combo at all. But can one register apple/google account without password with fresh phone on setup screen? What would happen if that phone would die? Apple often asks for icloud password in various places (which really surprises me, I mean it's Apple app on Apple device which logged in, why ask me about it). It still looks to me like master password (which is google/icloud password) and other accounts are accessible with this master password. Just less friction: no need to copy random passwords around.

WA 3y ago

Interesting, but weird pricing. "Contact us" for 1,000+ MAU, which is every useful app out there. Compare this with Supabase, which is $25 for 100,000 MAUs.

edsimpson 3y ago
Or Bitwarden's Passwordless.dev which is free for 10,000 users. The pro plan is $0.05 per user/month for the first 10,000 users and $0.01/user for users above 10,000.
deleted 3y ago
[deleted]
iancarroll 3y ago
Yeah, this "contact sales" threshold is pretty absurd. Presumably this is targeting B2C apps but who is going to bother with such a low number?
- micah-1password 3y ago
  Hey there! We expect to add more pricing details to the page in the coming weeks. The ambiguity is just because the products are currently in early beta.
micah-1password 3y ago
Hey there. The Passage products are in early beta, so some of the details are being worked out. We expect to be able to add more specific pricing info in the coming weeks. Stay tuned!

noodlesUK 3y ago

The question I have with something like this is essentially “does it support SSO”? If I’m building software for end users, at least some subset of those users will want SSO.

madeofpalk 3y ago
I think you can think about passkeys as an equivalent to username + password. Supporting usernames + passwords on your site does not prevent you from also supporting SSO - it's just a auth mechanism you might use to grant access to an account, on top of SSO, Passkeys, email sign-up link, etc
- toomuchtodo 3y ago
  Correct! Your IdP would be where the passkeys would be supported. From there, auth is federated to other systems.
mooreds 3y ago
Disclosure, I work at an auth provider. I haven't looked deeply at what 1password offers, but I know that "does it support SSO" is a question other providers that started with passkeys only had to answer "yes" to relatively quickly. (Stytch comes to mind.) The honest truth is that auth is the front door to your application. For most applications, you want a secure door, but also one that lets in as many people as possible. So social sign-on, federation/SSO, passkeys, magic links, and even username/passwords are all methods you want to support asap.
paxys 3y ago
Passkeys are just the authentication mechanism. They have nothing to do with SSO. You can use a passkey to log in to randomsite.com, OR you can use a passkey to log in to okta.com which then forwards your session to randomsite.com.

deleted 3y ago

[deleted]

nailer 3y ago

I do not understand how the demo is different from just using webauthn normally.

Hackbraten 3y ago
The difference is 1Password not pocketing their share in the latter case.

drcongo 3y ago

As a CTO / dev, I'm sure I'm 1Password's target market for this. As a 1Password customer though, I'm painfully aware of how they treat their customers, so I'd rather use almost any other provider than 1Password.

regnerba 3y ago
Can you expand on that? We are 1Password customers and have one had good experience.
- drcongo 3y ago
  I've been a 1Password customer for as long as they've existed - every major version release is worse than the last with features we rely on removed. I haven't dared try the latest electron version, but 1P7 managed to even kill keyboard navigation (try editing a login and see if you can generate a new password without moving your hands from the keyboard, or tab between fields to enter new information).
kstrauser 3y ago
That's not been my experience. I work for a small company and we have less than 100 1Password licenses, but I still have an account rep emailing me to set up a quarterly check-in. They've escalated technical questions to engineers for us and everything. That's not to disclaim any problems you've had with them. Just saying, they've been solid for us.

appleaday1 3y ago

[flagged]

PKop 3y ago
What the hell are you talking about?
- appleaday1 3y ago
  There is an entire housing or real estate crisis in many parts of the world, for some people seeing a real estate search site could be triggering.
  - PKop 3y ago
    There is always a housing or real estate crisis in many parts of the world. So what? And yet, people still need tools and services to purchase real estate, so it is good that they are built and promoted so people find them and can use them. How does hiding the existence of these tools help anyone? I'm not sure why a tech service company should concern themselves with catering to the emotional whims of people "triggered" after seeing software tools that enable real estate deals. These people don't sound like a valuable market segment. And these people should follow the advice of Tyler the creator [0] [0] https://twitter.com/tylerthecreator/status/285670822264307712 https://twitter.com/tylerthecreator/status/28567082226430771...
    - appleaday1 3y ago
      Except what you might think is not a valuable market segment is growing steadily every year. Newer generations of consumers are increasingly becoming hyper aware of the situations around them. It's not necessarily a good idea to poke the bear if you can avoid it in the first place. I know all this sounds absurd and this is coming from a developer myself. The companies that are just developing tooling or protocols should not have to worry about silly things like this and focus on improving their platform or the quality of it. I am personally aware of what people are facing as I moderate one of the biggest housing activist forums out there and even highly paid software engineers are suffering allegedly according to a very popular post. This is why I think companies like 1passwd should be wary with what kind of content they are promoting as it might come back to bite them in the future. As I am writing this, there is a petition that was started by a 13 year old girl to stop our housing minister from profiting off the real estate market as many people think it's a conflict of interest. But yes mistakes do happen and sometimes you wonder how something could get passed or if something had any oversight at all. Take a look at with what's going on with the .zip domain that was released by Google domains, a portion of the infosec community is furious because their work got doubled this week, there are blocklists such as blocklist.zip passing around so that people can remediate actions that is happening in that space with the ongoing phishing campaigns or the potentials of it. Part of this is letting go of your ego and realizing that you might have made a mistake and owning upto it and taking the action. In this case its a non-issue from 1passwd, because they are providing a tool to make authentication easier, but if companies keep promoting real estate content excessively in the future or a pattern forms it might become an issue to the point of losing subscribers. However, I think this is an opportunity for companies like 1passwd to be involved in the future by appealing to the newer generations as it might net them subscribers in the long term as well as positive mindshare from the community.

nerdjon 3y ago

I really don't know how I feel about this shift in passwords. I have long preferred the use of a password manager knowing that if they do something shady I don't like (like when I moved from lastpass to 1password) I could just pick up and move and I was not locked into that platform. That doesn't mean I have not used SSO before with my Apple ID, but it was not my preferred way to log in. My primary worry is being locked into a specific provider of login (like 1password) and not able to ever leave them. I ditched google long ago but I still have some accounts I have to log in with Google. Is there a part of Passkey that makes this a non issue that I am unaware of or are we kinda just doing another version of SSO with a biometric component? Also related, what about devices without biometrics? Does it fall back to your phone or something? I also don't love the idea of the provider of the passkey authentication having data about where I go, where I login and when.

ecesena 3y ago
At the end of the day passkeys are a public/private key pair. While now they're new and it seems everybody's doing some sort of lock in, I would expect standards to emerge soon to export the private keys and reimport them in a different apps. Unlike passwords, passkeys protect against phishing and are not shared with the server (the server knows the public key, not the private one). Biometrics on phone are used to unlock password manager/passkeys, but they're not sent to the server (thanks god!) for verification. So they can't really be used for remote authentication.
- nerdjon 3y ago
  So this really isn't just an updated SSO implementation its an entirely different mechanism. I did not realize that. I am a bit worried that the standards and ability to move around is not just part of the implantation right out the gate. I do worry what this will mean for the more average user, this is a major shift in how things work.
  - AviationAtom 3y ago
    Correct. Nothing is centralized about Passkey (other than where you may choose to store your authenticators). Each site gets a unique keypair. If your keypair is compromised you can delete it on that given site. Passkeys is more or less just a more convenient implementation of FIDO2 or the like, as you'd traditionally have with a Yubikey token. Instead you move it to a supported password manager or mobile device. If you want to try it out go to https://passkeys.io https://passkeys.io on your Android or iOS device. I do believe Passage is more or less what Passkeys is/already was.

NelsonMinar 3y ago

Is this 1Password's first server-side product? I think of them only as having the consumer password agent (and related IT management stuff)

noahmasur 3y ago
They also have 1Password Connect, which allows you to bridge an API into your data for automation workflows, Terraform, syncing with Kubernetes, HashiCorp Vault, etc.

sega_sai 3y ago

I am personally not switching to passkeys unless I see a clear description of all possible failure modes. I.e. Google blocks you, you loose your phone, you want to migrate from one provider to another, when passkeys offer more security and when less. I feel with authentication, it's always those special cases that determine the usefulness and security, but when passkeys are discussed I never have seen a proper discussion a pros and cons and special cases. At least with regular passwords + 1password I kind'a understand what i am protected against and how to restore from disasters.

drdaeman 3y ago
Here's what I care about: 1. If I can fully physically own some of my authenticators. Aka if Yubikeys or similar hardware tokens are supported, so I don't have to long-term trust any corporation to correctly and securely store my credentials - with Yubikeys the only trust is that hardware is free of vulnerabilities or backdoors. 2. If I'm guaranteed to be not bound to any single specific authenticator. Aka if I'm safe if I lose a Yubikey, assuming that I've prepared ahead of time (also see the next point). 3. If I can enroll an authenticator without having it physically present. Aka if I can sign up with one Yubikey and then tell the website "here is my phone, here's the public key of the Yubikey I keep in a safe, and here's a public key of a keypair I've generated on an airgapped machine, etched onto a titanium plate and buried in a secret stash, accept those for me as my alternative authenticators even though I don't have my private keys present". Aka if I don't have to run around the house (or worse) to just sign up for a website. 4. If I'm guaranteed to be able to use a software authenticator of my own development, shall I want it (despite whatever site owners may think of it). Aka if there are no attestation requirements that force me to use authenticators I don't trust. If it's "yes" to all four, then I'm in and advertising this to everyone I know about, because this is much better than a password manager. If 1, 2 and 4 are "yes" then I'm probably in with a mix of one HSM and one software authenticator with exportable private keys (so I have a guaranteed way out), but voicing my displeasure wherever I can as the system is inconvenient. If not, then I'm probably sticking with passwords for the time being.
- saool 3y ago
  1, 2, and 4) Yes, that's already possible. Look into Solo Keys for open source hardware and firmware. The standard allows for key manufacturer attestation but seems like the way it is going (especially with the proliferation of software authenticators) it likely won't be relevant in practice. You can also enroll many authenticators to the same account (provided the service allows it, which most do). 3) This is pretty hard/impossible, I think. The authenticators don't use the same key-pair for all websites (a la SSH through Yubikey), but rather create a per-service, per-credential key-pair, and encrypt it with the main key-pair. The encrypted credential key-pair is then handed off to the server for storage, and the service sends it back for the authenticator to decrypt and use during a challenge. Clever trick to not depend on local hardware memory and be able to have unlimited per-credential key-pairs, but afaik prevents you from just "adding lists of public keys". I'm also not mentioning the resident keys aspect of the standard but that won't fix it as they're still service and credential based.

cmsj 3y ago

Surely passkey support is an open source kinda thing we would want to build on, rather than paying 1Password?

micah-1password 3y ago
Hey there, WebAuthn is an open standard that anyone can use to implement support for passkeys. That said, there is significant complexity around building a solution that can handle edge cases (devices that don't support passkeys), account recovery, etc. Not to mention the need to build out UI elements and back-end infrastructure. Passage is a solution that handles all of this for developers, so they can implement with just a few lines of code instead of building from scratch.

Zamicol 3y ago

I think a per-user blockchain with many user keys and a Merkle root representing current account state, synced individually to websites, would be a superior option to "passkeys". Websites would have to track a Merkle root on a per user basis. User A: Merkle root AA User B: Merkle root BB Edit: A problem with passkeys is a one (key) to one (user) relationship, which means device keys must be retrievable and transferred to other devices via encryption. It also means that if any device has weak security, your whole account is vulnerable. A multikey system would allow each device to have their own key, and an audit trail of what devices are logged into what services.

rootusrootus 3y ago
> A problem with passkeys is a one (key) to one (user) relationship That is untrue. It is a many-to-one relationship.
- Zamicol 3y ago
  I do not believe that is the case. Do you have a source showing that multiple keys for a single user on per a single service basis is supported?
  - ewoodrich 3y ago
    I currently have 5 passkeys linked to my Google account for 5 separate devices allowing me to login to Google on any of them with the passkey created for that device. Edit: Google also shows when each passkey was last used for each device in an audit trail as you describe.
    - deleted 3y ago
      [deleted]
    - Zamicol 3y ago
      Google != passkeys. Google may allow multiple keys, but that is outside of what FIDO specifies for passkeys. Here's a source saying that passkeys expect one and only one key: https://auth0.com/blog/our-take-on-passkeys/ https://auth0.com/blog/our-take-on-passkeys/ "Passkeys are designed to [...] allow the FIDO credential to roam across multiple devices. This [means that there's] no need to repeat enrollment on each device [.]"

open-paren 3y ago

Bitwarden also just launched a similar offering: https://passwordless.dev https://passwordless.dev

sgjohnson 3y ago

Wouldn't it make more sense if they allowed us to store WebAuthn private keys in 1password, and then have a browser plugin that'd implement that?

micah-1password 3y ago
Hello there! 1Password will soon support saving and using passkeys from the 1Password app. Keep an eye out for an announcement in the coming weeks. That said, Passage is a completely different product-line that helps developers support passkeys in their own apps and websites.
- sgjohnson 3y ago
  That's great to hear! Looking forward to it.

artdigital 3y ago

Passkey folks - can someone explain to me how this makes things more secure? For example, let’s take Apple. Apple Passkey support is great - I can store a passkey and it syncs through iCloud to all my devices. So my phone can login, my macbook can login. Neat. But thinking about this a little more, Passkeys on iPhones are secured with FaceID, so to login I have to use FaceID or other biometrics. But on iPhone you can skip the FaceID check if you know the device passcode as fallback. So now, if someone has access to my iPhone and knows my passcode, they have access to ALL my accounts that have Passkeys stored on my iCloud. Previously, even if an attacker had access to my iPhone, they still wouldn’t be able to login because they don’t know my password. And 1Password itself uses a separate unique password and can’t be skipped with device passphrase. I’m honestly surprised that we can’t lockdown passkeys on iOS with a separate password/key that’s used to encrypt those. It just seems like I’m giving up on security by switching to passkeys, away from randomly generated passwords. IMHO it should be: FaceID, and if you can’t use biometrics, you HAVE to specify that unique passkey-only encryption phrase to unlock it. Not device passcode. If not that, then I would have expected passkeys to be factor 1 authentication to directly replace passwords, and then have something else as second factor, such as TOTP/yubikey/SMS auth. But current implementations on any website I’ve seen so far treat Passkey as “ok you’re in”, while going the password route usually triggers a second-factor check.

bgentry 3y ago
Your iOS device passcode also gives root access to your entire iCloud account, including the ability to reset your account password. This was highlighted a couple months ago by the Wall Street Journal in relation to a recent wave of thefts & account takeovers which were exploiting this: https://www.wsj.com/articles/apple-iphone-security-theft-passcode-data-privacya-basic-iphone-feature-helps-criminals-steal-your-digital-life-cbf14b1a https://www.wsj.com/articles/apple-iphone-security-theft-pas... It seems we all need to treat our iOS device passcodes with as much importance & sensitivity as the password to our password manager—essentially root on your digital life.
- AwaAwa 3y ago
  So we're back to using old fashioned keys to unlock our residential/digital space. The more things change.....

shmerl 3y ago

So passkeys are just private / public key authentication, right? So can it work with keepassxc for example?

mdaniel 3y ago
https://github.com/keepassxreboot/keepassxc/pull/8825 https://github.com/keepassxreboot/keepassxc/pull/8825 (https://news.ycombinator.com/item?id=35859877 https://news.ycombinator.com/item?id=35859877) may interest you, although the PR is still open, so likely not something someone could use right now
- shmerl 3y ago
  Good to know, thanks. From looking around, current options are all tied to some proprietary tools, so not something interesting on Linux I suppose. Keepassxc implementing it would be nice.

ed 3y ago

This isn’t free?! Feels like 1Password is the main beneficiary in this relationship. Consider: 1pass owns the auth, and who knows how they’ll wield that power (need to deliver a return on their massive $920m VC round!), the burden to educate users about “passkeys” is on web developers, not 1pass, and guess who gets stuck providing customer support when a passkey doesn’t work? I’m a 1Password user and constantly run into edge-case bugs (for example there’s a UI flow that suggests a new password to use during google’s password reset, then doesn’t save the password - really!). I get that they don’t have the full support of OS developers, so there will be edge cases. But these problems keep e.g. my parents from sticking with password managers. It’s just easier for them to keep a password journal. At least they don’t reuse passwords in the event of a leak.

kjreact 3y ago
After 1Password moved to subscription only, I’m never recommending them to anyone. How does it make sense to surrender your authentication credentials to a subscription service?
- LeoPanthera 3y ago
  > How does it make sense to surrender your authentication credentials to a subscription service? You're paying for cloud sync. 1Password don't get your credentials, they're encrypted client-side, and 1Password doesn't see your master password. If you don't want to pay for the service, that's fine, there are plenty of local-only alternatives for which you can presumably build your own syncing solution, but it's disingenuous to say that it doesn't "make sense" when you misrepresent a product which a lot of people obviously feel is worth the price - including me.
  - kjreact 3y ago
    Looking at the site, I may have worded my reply too strongly since you can still export your passwords even if your subscription ends. But nonetheless, 1Password used to make a great product where I could choose to sync my password to any cloud service of my choice without subscription. They discontinued their standalone product because they knew they could make a lot more money by selling subscriptions. That’s their prerogative, but it’s also mine to point potential customers to Bitwarden, which can be used free of charge, can be self-hosted, and is open source.

account-5 3y ago

My personal preference is for it not to be tied to a device that can be lost, stolen, broken. That way I don't need multiple backup devices to login to one service or multiple passkeys for the same service. My password manager generates unique strong passwords, is offline and no big multinational advertising company controls it. The only thing I need to worry about is individual company's security practices. Passkeys offer me nothing of an improvement over this and only more obstacles and hoops to jump through. Until I can use passkeys like I can my open source offline password manager I'm not using them.

ochoseis 3y ago

How do you prevent someone from squatting on an account with your email address, and an initial passkey they control?

landmass 3y ago

Curious about how Passkeys work at the website level. Passkeys strikes me as essentially an authentication method. 1. Signing up or logging in to a website today you'd expect your password to be hashed, stored, and protected. (I understand some are stored in plain text, but that isn't part of this question.) Assuming you want to change over, or create a new account, to passkeys, how do they store and protect that account? 2. Assuming you're still using a password manager for the foreseeable future, does it make sense to use passkeys to access that? IIRC, most password managers will use your password/passphrase (plus a lot of processing) to encrypt your vault. Even if you authenticate with passkeys and gain access, how do you decrypt your vault without your password/passphrase? It's clear that authentication does no good if your vault is already sitting on the black hat's desktop, as LastPass discovered, so a basis for encryption is still required. It appears to me that anything that requires an encrypted holding will still require passwords/passphrases.

LeoPanthera 3y ago

It's weird that they would launch this before the 1Password password manager actually supports PassKey.

five82 3y ago

So am I the only one who's noticed that average non-tech users are absolutely horrible with managing passwords and passkeys would be a huge improvement over reusing "ddccbbaa!" across every login they have?

jeroenhd 3y ago
Everyone I know about 40 years old use <name><year in range 1960-2000><special character to pass check, usually exclamation point> as the formula for their passwords. Capital letters are the first letter of the name, of course. The only exceptions are passwords generated for them with change password pages that are more than two clicks away. I applaud passkeys, despite their obvious problems surrounding their centralisation in Apple's or Google's account. The probability of your account being banned is much lower than the probability of Steven1971! getting guessed (or leaked in any hack).

AwaAwa 3y ago

Passkeys require the cloud to be ever present. Maybe on Venus where the clouds never go away, but on Earth all it takes is some rain, and suddenly you have clear skies. I'll stick with keepassxc on my personal laptop, rather than put it in the hands of Google et al. and their sunset happy ways. Atleast there's no segue into the blockchain and/or crypto as a 'benefit'. Small mercies and all that.

kccqzy 3y ago
Passkeys do not require the cloud. They require a local device such as a phone that has the passkey.
- CSSer 3y ago
  I believe you two may be discussing theory vs practice. Users want the convenience of keys being synced across devices.
  - arianvanp 3y ago
    Both can be true at the same time.

pseudosavant 3y ago

I went to check it out for interest in a personal project, and potentially even for my company's identity stack. Lack of pricing makes building on it uncomfortable though. <1000 MAUs: free. 1000+ MAUs: contact us. Enterprise: contact us for bulk pricing. I need to know what kind of pricing ballpark we are talking about, and I'm not going to deal with some lame sales engagement to find out.