3 ms·

There is only this blurb to go on at the moment: "Passkeys can now be synced using external providers..." so it's hard to say exactly what it will mean for us

by miles 3y ago

There is only this blurb to go on at the moment: "Passkeys can now be synced using external providers..." so it's hard to say exactly what it will mean for user control and choice. Which external providers? Will users be able to access and store their own private keys in compatible apps of their choosing? If so, aren't we largely back to passwords?

tehbeard 3y ago
> aren't we largely back to passwords? A password is a shared secret. Even if it's hashed on the server side, one could brute force it if a weak algorithm is used, or MiTM the service to get the plaintext when the user logs in. Passkeys / webauthn utilizes public key cryptography. I'm only ever giving them a (by the spec, unique to the combo of me and the site in question) public key to which I hold the private key pair. Authentication doesn't involve transmission of these, it's challenge based where you prove you have access to the corresponding private key.
danShumway 3y ago
> aren't we largely back to passwords? Key based authentication is a huge security improvement over passwords (especially for reducing phishing risks) even without the device-bound restrictions. I'm strongly opposed to hardware-bound keys as a mass standard for most users, but key based authentication is great. One big advantage is that during the login process, sites "prove" their identity to you. This is a security improvement that you could previously only really get with browser extensions and password managers, and even there it wasn't great because those extensions didn't work consistently across all sites and often failed at autofill, so a website failing to pull up your password manager might not actually be interpreted as a red flag. And there are other advantages too around account security for service providers, etc... none of which require attestation or hardware-bound keys.
patmorgan23 3y ago
Passkeys still involve storing a secret, which I think is fundamentally what all security/authentication is built around. Passkey eliminates a lot of the issues with passwords (transmitting the plain text to the app, password reuse, simple passwords). If you've been using a password manager with randomly generated passwords you've already addressed some of these issues so the benefits of using passkeys over passwords is reduced.

by miles 3y ago

tehbeard 3y ago

> aren't we largely back to passwords? A password is a shared secret. Even if it's hashed on the server side, one could brute force it if a weak algorithm is used, or MiTM the service to get the plaintext when the user logs in. Passkeys / webauthn utilizes public key cryptography. I'm only ever giving them a (by the spec, unique to the combo of me and the site in question) public key to which I hold the private key pair. Authentication doesn't involve transmission of these, it's challenge based where you prove you have access to the corresponding private key.

danShumway 3y ago

> aren't we largely back to passwords? Key based authentication is a huge security improvement over passwords (especially for reducing phishing risks) even without the device-bound restrictions. I'm strongly opposed to hardware-bound keys as a mass standard for most users, but key based authentication is great. One big advantage is that during the login process, sites "prove" their identity to you. This is a security improvement that you could previously only really get with browser extensions and password managers, and even there it wasn't great because those extensions didn't work consistently across all sites and often failed at autofill, so a website failing to pull up your password manager might not actually be interpreted as a red flag. And there are other advantages too around account security for service providers, etc... none of which require attestation or hardware-bound keys.

patmorgan23 3y ago

Passkeys still involve storing a secret, which I think is fundamentally what all security/authentication is built around. Passkey eliminates a lot of the issues with passwords (transmitting the plain text to the app, password reuse, simple passwords). If you've been using a password manager with randomly generated passwords you've already addressed some of these issues so the benefits of using passkeys over passwords is reduced.