9 ms·

Say I initially created an account with my computer. If a passkey is tied to a device, what do I do when I want to login with my phone?

mooreds 3y ago
Disclosure, I work for FusionAuth. This is the primary issue with passkeys. When FusionAuth implemented WebAuthn/passkeys last year[0], we decided to have passkeys be a separate, additional login method, just like social sign-on or magic links, for this exact reason. My understanding is that there is some work in the next version of WebAuthn[1] to allow sharing of passkeys across devices, addressing this user experience issue. 0: https://fusionauth.io/docs/v1/tech/premium-features/webauthn/ https://fusionauth.io/docs/v1/tech/premium-features/webauthn... 1: https://www.w3.org/TR/webauthn-3/ https://www.w3.org/TR/webauthn-3/
- tehbeard 3y ago
  Does there need to be work on webauthn for it? (maybe some wording sugggestions around "resident keys" which I think are meant to be persistent and within a singleTPM or such, but no technical constraints beyond that afaik). My understanding was passkeys was just Apple Marketing(tm) around their implementation and integrating it with iCloud/keychain?
  - mooreds 3y ago
    Looks like they have had a section on key loss since at least webauthn 2[0], and explicitly rule out backing up keys. The suggested answer is "use multiple devices" which doesn't work great with platform authenticators (which are tied to a device). From the spec: > This specification defines no protocol for backing up credential private keys, or for sharing them between authenticators. In general, it is expected that a credential private key never leaves the authenticator that created it. Losing an authenticator therefore, in general, means losing all credentials bound to the lost authenticator, which could lock the user out of an account if the user has only one credential registered with the Relying Party. Instead of backing up or sharing private keys, the Web Authentication API allows registering multiple credentials for the same user. For example, a user might register platform credentials on frequently used client devices, and one or more roaming credentials for use as backup and with new or rarely used client devices. So I guess you are right, it is on the vendors to handle backing up the keys from devices. 0: https://www.w3.org/TR/webauthn-2/#sctn-credential-loss-key-mobility https://www.w3.org/TR/webauthn-2/#sctn-credential-loss-key-m...
paxys 3y ago
You create another passkey on your phone, and the site accepts both of them.
- recursive 3y ago
  But what if I want to be able to use the same account, but I don't want other people to be able to use my account?
  - paxys 3y ago
    That has nothing to do with anything. Think of this as a password, except the password is autogenerated and stored on the device itself. And you can have multiple passwords for the same account.
    - recursive 3y ago
      Who is allowed to add an additional password and how are they authenticated? The answer has to be simple enough for me to understand if I'm to consider using passkeys.
      - paxys 3y ago
        All that is up to the website to decide. This protocol is only for user authentication between the browser and a website.
        recursive 3y ago
        The authentication scheme it seeks to replace has an answer for this. Sounds like a drawback.
- drdaeman 3y ago
  TBH, I don't get how "normal" users without a roaming authenticator are going to do this. Let's say I'm a layman person, nothing fancy, my password is my cat's birthday and I have a home desktop PC for gaming and laptop for my work. My desktop Windows computer can authenticate to a website, and is currently have it open and me logged in as "Alice". Now, I want to access the site from my Mac laptop. I go to the website, but I assume that to add an additional passkey to account "Alice" I must somehow authenticate. I cannot do this on my laptop - only my desktop has a valid passkey so far. Let's assume it's not removable, and I don't have any fancy password manager that syncs across my computers - again, our Alice is completely non-technical. So we must either: a) somehow create a passkey on laptop, transfer its public key to desktop, register it there, then be able to log in from the laptop; or b) initialize login flow on laptop, but transfer the request to desktop, make it generate a valid authentication response, transfer it back to laptop, get logged in, then proceed with registering a new passkey. Are we going to have fun with waving laptop camera, or there's some BLE protocol, or we're ditching all our fancy cryptography-protected authenticators and going straight for access recovery aka "code over email/sms" lowest-common-denominator? (Which possibly implies spam^W contact methods are mandatory?) All the demos I've found online seem to completely disregard this aspect, they just show me "start over" after I log in with the first device, and I haven't found any showcase of how can I enroll a second device. Their FAQs sorta imply I'm either all-Apple or all-Google or all-Microsoft person because all they say is that software providers will sync keys across devices. Which - I hope to be wrong - but I find unlikely.
CharlesW 3y ago
> Say I initially created an account with my computer. If a passkey is tied to a device, what do I do when I want to login with my phone? You create an additional passkey for that device, or use a password/passkey manager that syncs your passkeys across devices. (Note: I've actually done the former with my Google account. I'm waiting for passkey support in 1Password to test the latter scenario, but believe this is how it'll work.)
- Zamicol 3y ago
  I do not believe this is true. Passkey is only a 1 user, 1 key system. This means that to login on a second device, the 1. key must be exported from the first device, 2. encrypted, and 3. transferred to the second device. Each device needs a copy of the private key.
  - kccqzy 3y ago
    You can add multiple passkeys on your Google account today. If a website is dumb enough that they only allow a single passkey per account, they have misunderstood passkeys profoundly.
    - Zamicol 3y ago
      Google != passkeys. Google may allow multiple keys, but that is outside of what FIDO specifies for passkeys. Here's a source saying that passkeys expect one and only one key: https://auth0.com/blog/our-take-on-passkeys/ https://auth0.com/blog/our-take-on-passkeys/ "Passkeys are designed to [...] allow the FIDO credential to roam across multiple devices. This [means that there's ] no need to repeat enrollment on each device [.]" > If a website is dumb enough that they only allow a single passkey per account And that's exactly my point.

mooreds 3y ago

Disclosure, I work for FusionAuth. This is the primary issue with passkeys. When FusionAuth implemented WebAuthn/passkeys last year[0], we decided to have passkeys be a separate, additional login method, just like social sign-on or magic links, for this exact reason. My understanding is that there is some work in the next version of WebAuthn[1] to allow sharing of passkeys across devices, addressing this user experience issue. 0: https://fusionauth.io/docs/v1/tech/premium-features/webauthn/ https://fusionauth.io/docs/v1/tech/premium-features/webauthn... 1: https://www.w3.org/TR/webauthn-3/ https://www.w3.org/TR/webauthn-3/

tehbeard 3y ago
Does there need to be work on webauthn for it? (maybe some wording sugggestions around "resident keys" which I think are meant to be persistent and within a singleTPM or such, but no technical constraints beyond that afaik). My understanding was passkeys was just Apple Marketing(tm) around their implementation and integrating it with iCloud/keychain?
- mooreds 3y ago
  Looks like they have had a section on key loss since at least webauthn 2[0], and explicitly rule out backing up keys. The suggested answer is "use multiple devices" which doesn't work great with platform authenticators (which are tied to a device). From the spec: > This specification defines no protocol for backing up credential private keys, or for sharing them between authenticators. In general, it is expected that a credential private key never leaves the authenticator that created it. Losing an authenticator therefore, in general, means losing all credentials bound to the lost authenticator, which could lock the user out of an account if the user has only one credential registered with the Relying Party. Instead of backing up or sharing private keys, the Web Authentication API allows registering multiple credentials for the same user. For example, a user might register platform credentials on frequently used client devices, and one or more roaming credentials for use as backup and with new or rarely used client devices. So I guess you are right, it is on the vendors to handle backing up the keys from devices. 0: https://www.w3.org/TR/webauthn-2/#sctn-credential-loss-key-mobility https://www.w3.org/TR/webauthn-2/#sctn-credential-loss-key-m...

paxys 3y ago

You create another passkey on your phone, and the site accepts both of them.

recursive 3y ago
But what if I want to be able to use the same account, but I don't want other people to be able to use my account?
- paxys 3y ago
  That has nothing to do with anything. Think of this as a password, except the password is autogenerated and stored on the device itself. And you can have multiple passwords for the same account.
  - recursive 3y ago
    Who is allowed to add an additional password and how are they authenticated? The answer has to be simple enough for me to understand if I'm to consider using passkeys.
    - paxys 3y ago
      All that is up to the website to decide. This protocol is only for user authentication between the browser and a website.
      - recursive 3y ago
        The authentication scheme it seeks to replace has an answer for this. Sounds like a drawback.
drdaeman 3y ago
TBH, I don't get how "normal" users without a roaming authenticator are going to do this. Let's say I'm a layman person, nothing fancy, my password is my cat's birthday and I have a home desktop PC for gaming and laptop for my work. My desktop Windows computer can authenticate to a website, and is currently have it open and me logged in as "Alice". Now, I want to access the site from my Mac laptop. I go to the website, but I assume that to add an additional passkey to account "Alice" I must somehow authenticate. I cannot do this on my laptop - only my desktop has a valid passkey so far. Let's assume it's not removable, and I don't have any fancy password manager that syncs across my computers - again, our Alice is completely non-technical. So we must either: a) somehow create a passkey on laptop, transfer its public key to desktop, register it there, then be able to log in from the laptop; or b) initialize login flow on laptop, but transfer the request to desktop, make it generate a valid authentication response, transfer it back to laptop, get logged in, then proceed with registering a new passkey. Are we going to have fun with waving laptop camera, or there's some BLE protocol, or we're ditching all our fancy cryptography-protected authenticators and going straight for access recovery aka "code over email/sms" lowest-common-denominator? (Which possibly implies spam^W contact methods are mandatory?) All the demos I've found online seem to completely disregard this aspect, they just show me "start over" after I log in with the first device, and I haven't found any showcase of how can I enroll a second device. Their FAQs sorta imply I'm either all-Apple or all-Google or all-Microsoft person because all they say is that software providers will sync keys across devices. Which - I hope to be wrong - but I find unlikely.

CharlesW 3y ago

> Say I initially created an account with my computer. If a passkey is tied to a device, what do I do when I want to login with my phone? You create an additional passkey for that device, or use a password/passkey manager that syncs your passkeys across devices. (Note: I've actually done the former with my Google account. I'm waiting for passkey support in 1Password to test the latter scenario, but believe this is how it'll work.)

Zamicol 3y ago
I do not believe this is true. Passkey is only a 1 user, 1 key system. This means that to login on a second device, the 1. key must be exported from the first device, 2. encrypted, and 3. transferred to the second device. Each device needs a copy of the private key.
- kccqzy 3y ago
  You can add multiple passkeys on your Google account today. If a website is dumb enough that they only allow a single passkey per account, they have misunderstood passkeys profoundly.
  - Zamicol 3y ago
    Google != passkeys. Google may allow multiple keys, but that is outside of what FIDO specifies for passkeys. Here's a source saying that passkeys expect one and only one key: https://auth0.com/blog/our-take-on-passkeys/ https://auth0.com/blog/our-take-on-passkeys/ "Passkeys are designed to [...] allow the FIDO credential to roam across multiple devices. This [means that there's ] no need to repeat enrollment on each device [.]" > If a website is dumb enough that they only allow a single passkey per account And that's exactly my point.