18 ms·

Tailscale doesn't want your password

270 points by arkadiyt 3y ago

bartkappenburg 3y ago
Offtopic: which software do they use to create those great webbrowsing explainers?
e12e 3y ago
No way to change an existing user to use/enable passkey? I suppose for an org using Microsoft AzureAD via OIDIc - passkey auth would be on the Microsoft side of the fence?
eadmund 3y ago
> Passkeys are synchronized across devices using services you already use and trust, like iCloud Keychain from Apple, Google Password Manager, and 1Password. I don’t trust any of those, and it’s weird that anyone does.
- darknavi 3y ago
  Why?
AmenBreak 3y ago
I'm just opting out of passkeys and companies that require them. Sorry!
jillesvangurp 3y ago
Probably a bit early to rely on this exclusively; for example Firefox support is not there yet (only works if you have ubikey). Apparently they are planning something there. Bitwarden recenly announced that they are implementing support; and there are probably a few others that are going to do stuff in this space. I do see the appeal for passkeys but I think short term it's probably going to be a support nightmare. The messaging around this is also quite confusing for example. Way too technical to explain to normal users what this even is or how it works and what they need to do. Also, as others have pointed out, while this is more secure than relying on passwords (given users can't be relied upon to follow most of the sane recommendations for these), it doesn't remove the need for multi factor authentication. A lot of passkey implementations basically rely on some variation of biometrics. Those aren't exactly hacker proof. And of course phones get stolen and lost all the time. Which creates the need for some recovery mechanism as well as a way to revoke passkeys.
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
fps 3y ago
Modern password managers run into issues regularly that still require a user to copy/paste a password out of a secure location. I don't know what the solution is for these situations with passkeys, but I know I don't trust password managers to do it right. I've used iCloud, Google Chrome, Lastpass, and 1password, and they all break consistently in a few scenarios. Three that come to mind are: - SSO or other systems where multiple logins are linked to the same account on different host names. The password manager will require you to essentially create a separate entry for the new site that becomes disconnected from the original. - Having multiple logins for the same site. This breaks especially with services that use a multi-stage login, but in general it breaks frequently. If you have kids or parents whose accounts you manage, password managers will invariably ask to update the wrong password, or attempt to auto-fill the wrong password regularly. - Sites that request you enter the old password at the same time as you enter your new password for verification when changing a password. Password managers can't figure this out, and as a result whenever I have a password manager generate a new credential, I also make sure to copy it to a temporary location until I've verified that it was saved. Typically, because you entered the old password on the password change page, that save doesn't go through. In the end, all these security features just boil down to how secure your password reset/customer support function is. If you're going to require people to reset their passkey every time they log into your site, why not just use a "magic link" email session initiator and be done with it?
- piloto_ciego 3y ago
  I don’t know, I’ve found quite a few work arounds for stuff like this with BitWarden where the experience is pretty seamless and I routinely deal with all of these issues except SSO. BitWarden has its problems but generally I find the experience pretty good - indeed far superior to the other services you mentioned. The ability to use “secure notes” and the convenient way that has been implemented in BW has allowed me to be fine in all the scenarios you’re mentioning. Of course, you’re right, you still have to copy the password in somewhere, but ultimately I feel like that’s a lower threat if properly handled than what I used to do (shitty insecure passwords). The other thing is I barely ever use the browser extension for the password manager. All of the browser extensions I’ve tried other than BitWarden have been janky and even that’s only ok. Still, try BW I like it way better than lastpass and 1password.
marcrosoft 3y ago
I don’t understand why someone would want to store all their credentials with one of the large tech companies. It seems like this makes it really easy for law enforcement to grab access to all accounts easily.
- kccqzy 3y ago
  When you use passkeys with either Apple's iCloud Keychain or Google Password Manager, the key material is end-to-end encrypted. Law enforcement cannot get your passkeys through these two big tech companies.
  - marcrosoft 3y ago
    So your keychain is symmetrically encrypted with a password and they don’t store that?
    - woodruffw 3y ago
      Among other things, yes[1]. [1]: https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/web https://support.apple.com/guide/security/escrow-security-for...
  - QhwyF3AxE 3y ago
    This is a great point. And to respond to the other part of the parent comment about storing "all their credentials with one of the large tech companies" — you don’t even need to do that, if you don’t want to. Apple just extended their Credential Provider API such that passkeys can now be synced using external providers, meaning password manager apps can save and offer passkeys on iOS, iPadOS, and macOS. So you can choose to sync your passkeys with whatever your favorite password manager is. See this page: https://developer.apple.com/passkeys/ https://developer.apple.com/passkeys/ And Google announced a similar API a month or two ago. See the section titled "Passkey support for Android apps" on this page: https://developers.google.com/identity/passkeys/supported-environments#android-passkey-support https://developers.google.com/identity/passkeys/supported-en...
dhosek 3y ago
Is there a good plug-and-play Java framework for supporting logins via identity providers like this (including passkeys) for web apps? As I build out a web application, I would like to avoid having to do all the hard work of implementing this if I can just grab a jar and have it done for me.
- shmde 3y ago
  Have you tried keycloak ?
malux85 3y ago
I just want to say that Tailscale ROCKS. It installed flawlessly on all of my machines (Linux and Mac), and now I can route to all of them wherever I am. It configures DNS correctly, it routes traffic correctly, and all of my internal machines at my house are routable when I'm out in a coffee shop or library or hotels. It's been more than a year and it's operated flawlessly, never needing maintenance or restarting, it survives connection resets and is completly robust. I just love it. Disclaimer: No affiliation other than being a happy customer.
- sanitycheck 3y ago
  I wanted this to be true for me, but on Android it sometimes kills my internet connection (even when turned off) until I force-close it, on Windows it'll hang and consume lots of CPU every few days and on Linux (Ubuntu/Pop) the service sometimes stops and I don't know why. I just have bad luck, I guess. (On-topic, I would prefer them to to take my damn password please.)
- thrixton 3y ago
  I totally agree, and with their recent relaxation of the license tiers, they really seem like a consumer friendly company. I wish them well.
samcat116 3y ago
Love to see Passkeys supported in more places.
yawnxyz 3y ago
That's so cool, I didn't even know Passkeys were available to use already. Does anyone know of a good resource / tutorial / example / best practices on building login/signup systems in web apps with Passkeys? Also, what's browser support like? I'd love for some simple system to just replace PassportJS and all those confusing systems.
- r2b2 3y ago
  https://passkeys.dev/device-support/#matrix https://passkeys.dev/device-support/#matrix
wly_cdgr 3y ago
Sounds like a surveillance corpostate control mechanism but ok
systemvoltage 3y ago
Like many round trips we have made, I suspect in the year 2035, we’ll look back and say to ourselves: “Yeah, password was super based. Just copy paste it in the box and you’re logged in. Can store it anywhere, even in a notebook. Safekeep it by printing them. No need for HyperBigTechCorp. Portable. Those gray beards had it right the whole time.” Can we please stop the bandwagon for a moment and inquire about the downsides of Passkey?
- fragmede 3y ago
  How do you bootstrap it? You get robbed at gunpoint by some ruffians and they take your wallet, cellphone, keys, and laptop. Hopefully they can't get into your accounts, but never mind that, how do you get back in to everything?
  - hooverd 3y ago
    You don't.
  - jabbany 3y ago
    Recovery code system? Like 2FA today, generate a special bootstrap key you can print and save. This isn't that uncommon. Things like disk encryption also do this (e.g. bitlocker)
    - recursive_loops 3y ago
      > generate a special bootstrap key you can print and save So ... a password? Also in this scenario you've been robbed. It's quite possible that either they took your printed out passkey also since it was in your wallet, or you're not at home where you can get the pass key from your file cabinet or safe.
      - jabbany 3y ago
        Not really. A password is meant to be memorized and reproduced correctly regularlt, whereas a recovery key doesn't need that and can be very long and complicated since it is rarely used.
YPPH 3y ago
My work uses Microsoft SSO for everything. Passkeys aren't enabled though. And management won't enable them on Azure AD. Instead, they enable the tried and tested and ultra secure method of SMS based 2FA with a password. (This is sarcasm.) The alternative is the Microsoft authenticator app with its associated risk of approval fatigue. I have already had several malicious login attempts. Fortunately I'm attuned enough to decline them. The only way I'll get passkey logins for my work account is if Microsoft force it as a 2FA method for enterprise. I won't hold my breath.
- ziml77 3y ago
  Authenticator has options that avoid approval fatigue. There's a setting that causes it to show a number on screen, and then an option between providing a list of 3 numbers you have to pick from or showing a textbox that you have to type the displayed number into. If it's set up for textbox entry it's unlikely that someone is going to approve a random request.
- belltaco 3y ago
  > I have already had several malicious login attempts Doesn't that mean they know your username and password? How does that happen so easily.
  - brenns10 3y ago
    They said login attempt, not successful login. So no.
    - throwawaysleep 3y ago
      But to get to the auth request, do you not need to pass the password stage first? I get these pretty frequently on my work machines as I reuse my passwords and they have already leaked. At least that was my assumption.
      - amanzi 3y ago
        I assume this is referring to the passwordless logon feature, which most enterprises disable. But with this feature, you just need to enter the username (email address) and choose the option to log in with authenticator.
andrewmcwatters 3y ago
[flagged]
- deleted 3y ago
  [deleted]
- jabbany 3y ago
  I'm pretty sure passkeys are just a rebranded version of virtual WebauthN tokens. So while passkey secrets can be synced (unlike U2F physical tokens) they can also be implemented as being backed by a physical token (think Yubikey) that never goes om the cloud.
  - d0mine 3y ago
    There is theory and there is practice. What grandparent comment says is the likely outcome in practice
    - mynameisvlad 3y ago
      ... Unless you care about that and use a Yubikey or other physical security key. There is absolutely nothing stopping you from doing so as long as your Yubikey supports WebAuthN (the latest do). You are prompted to use another phone or physical security key if a resident key isn't found on your device, and even if it is, you are given the option of doing so instead of using the one found. This is not a hypothetical feature or theory or something, it's part of the spec and is implemented. It's as practical as it gets.
      - hooverd 3y ago
        Unless the website decides to enforce attestation and not allow that.
awayto 3y ago
I haven't yet looked into the inner mechanics of passkeys, and the link only talks about the first login. What is the experience like when a user wants to log in from a different system? They press the "Login with Passkey" button on Device 2, and then...?
- iknowstuff 3y ago
  It presents a qr code you can scan with the other device. You can try it on https://passkeys.io https://passkeys.io
  - JohnFen 3y ago
    > It presents a qr code you can scan with the other device. What about devices that have no camera?
    - iknowstuff 3y ago
      SOL
  - awayto 3y ago
    Very cool. Thanks.
  - jorams 3y ago
    Note that this requires a "nearby device", which is determined via Bluetooth. There are lots of desktop PCs without Bluetooth, so this requirement is kind of a serious problem.
hsn915 3y ago
This sounds counter productive. Third party authentication providers are a single point of failure, and usually they themselves require a password to authenticate you anyway. If your gmail password is hacked, then effectively all your accounts on websites that use Google auth are also hacked. Passkeys appear to also be handled by central services? At least that appears to be the case with Apple, according to the link in the post: https://developer.apple.com/passkeys/ https://developer.apple.com/passkeys/ I personally think having a browser-managed "private key" (the same kind used for ssh auth) would be better, but now as a user you have to manage the multiple private keys you have associated with an account; a totally confusing concept for the average user.
- endorphine 3y ago
  > Passkeys appear to also be handled by central services? I don't think it is true that passkeys require a third party, but can someone else confirm?
  - Aaron2222 3y ago
    They're just FIDO, and can absolutely be implemented in an offline password manager.
nhumrich 3y ago
Auto-generated password via a password manager are more secure, convenient, and portable then passkeys and oidc.
- jabbany 3y ago
  Not really, the technology behind passkeys behave kind of like managed ssh keypairs. While they can be designed to have the secrets cloud synced (just lile how you can sync your ssh private keys), there's nothing preventing them from being implemented in other ways, like having them backed by a third party password manager or even a pyhsical token like a yubikey. Of course, this depends on the software (OS, browsers) actually respecting and supporting that interoperability. But that's not really a limitation of the underlying tech.
  - _delirium 3y ago
    Is there a way to store the ultimate root of trust somewhere non-digital? I currently have my most important root-of-trust passwords printed out on paper stored in places I consider long-term secure. At least in my personal physical and social context, I don't trust any cloud account or dongle to a similar extent.
tiffanyh 3y ago
Apple Slightly off topic: did Apple just make it super easy for law enforcement to unlock your phone & passkeys as part of iOS 17? > ”Apple ID. Securely sign in to your iPhone using a nearby device or any email address or phone number listed in your account.” https://www.apple.com/ios/ios-17-preview/ https://www.apple.com/ios/ios-17-preview/
- shortcake27 3y ago
  What the heck? SMS as a second factor was considered bad practice ten years ago. Allowing it to be used as the only factor to access your entire Apple ID is absolute negligence as SIM-swapping is still and forever will be trivial. I'm genuinely shocked. Engineers at Apple must have been screaming into their pillows at night as they watched some incompetent BA ignore all advice and force this through.
  - ec109685 3y ago
    My guess is that they aren’t making things less secure. There are flows that let you reset your password but don’t let you login today, so letting you login via those flows would be a step up in usability. If you don’t have your phone as your second factor or can’t use phone today to reset password, then I don’t expect you’ll be able to login via that mechanism.
    - shortcake27 3y ago
      Ah yeah that’s true, it’s no less secure than recovery via phone number. Not entirely sure how to prevent recovery using a phone number. I wonder if this means setting up a recovery key instead? Been considering doing this anyway. https://support.apple.com/en-us/HT208072 https://support.apple.com/en-us/HT208072
  - amanzi 3y ago
    It's true - I have to use SMS as second factor to log into iCloud. Apple don't let you use a generic OTP as MFA - the only other option is to get a notification on your iPhone or iPad. I don't have an iPhone and I rarely have my iPad with me, so SMS is the only way I can log in to icloud.com.
User23 3y ago
It's slightly annoying that the "What are passkeys?" section doesn't actually tell you what a passkey is. Hey it's asymmetric crypto that generates a key/cert pair for every site you register at. Neat. Why not just say so? I'm getting shades of "passwords are so insecure, passphrases are secure" here.
benatkin 3y ago
TL;DR Google, Microsoft, GitHub, Apple, Apple’s macOS and iOS, Google Chrome and Android, as well as 1Password, Yubikey Yay. https://indieweb.org/NASCAR_problem https://indieweb.org/NASCAR_problem
- Aaron2222 3y ago
  Passkeys are just a standard protocol, i.e. there'd just be a single "Use Passkey" button.
  - megous 3y ago
    There's no "passkeys" protocol. If there is, it's well hidden behind marketing bullshit. :) > In marketing material, the terms passkey or Passkeys are preferred over related terms such as FIDO or WebAuthn, because they are less likely to cause confusion. Yeah. Nowhere does it say what it actually is or how it's related to the other standards. Not confusing at all.
  - benatkin 3y ago
    Yeah it seems sort of like web notifications and I find it quite centralized, favoring the browser vendor. So I'll have to see what it's like in practice. But I hope it doesn't take off.
    - Aaron2222 3y ago
      How so? Apple's already announced support for 3rd party passkey stores to integrate into the OS (to allow passkey authentication in apps), and the 1Password extension supports passkeys across the major browsers (though support's in beta).
LeoPanthera 3y ago
> "as well as 1Password" 1Password does not support PassKeys. They have announced the intention to, but outside of beta releases it's not there yet.
croes 3y ago
>which means we now need software to manage our passwords. So now we need hardware and software to generate passwords we don't even know.
zoomTo125 3y ago
There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to manually make a copy of every keys? How do you know if the copy is synced with the main one?
- Wool2662 3y ago
  Recovery is the same as with passwords. Depends on the services policies. Passkeys and YubiKeys are different things. But generally it is recommemded to have a second YubiKey in a safe place and to register at least two keys on every service. Unfortunatly the implementations for using hardware keys are often pretty bad and require to activate alternate MFA which defeats the purpore of having a hardware token in the first place. For backing up a yubikey. If you manage it you get a massive bugbounty. The whole purpose of a yubikey is to not be able to read the embedded key. Yubikey guarantees physical posession of the key itself if you can prove knowledge of the key within. For passkeys: Only the authentication/creation process is specified. How passkeys are stored, shared, backedup etc is totally up to the implementing party. So Google and Apple will synchronize the keys using their existing password infrastructure. In the end the only difference to passwords is: - It is always randomly generated - You can have multiple passkeys per service - The application managing passkey is required to verify that passkeys are only transmitted to the service they were created for (making them phishing resistant) Passkeys are basically the point between passwords and hardware tokems like the yubikey. Safer than passwords and less safe than a yubikey but easily usabale by everyone.
- snagg 3y ago
  The short answer is that it's non standard and it depends on where the passkeys are stored. To be precise, the original WebAuthn standard did not account for a recovery mechanism at all and instead recommended adding multiple credentials to an account. Practically if the passkeys are stored in your iCloud Keychain, they are automatically synced across your Apple devices and the recovery mechanism is the recovery mechanism for iCloud. Similar consideration for Google/Chrome and other password managers. We wrote a relatively long blogpost about this + implementation and threat modeling considerations in case it's interesting: https://www.slashid.dev/blog/passkeys-security-implementation/#how-are-credentials-shared-and-stored https://www.slashid.dev/blog/passkeys-security-implementatio...
adityapatadia 3y ago
What I don’t get is why Tailscale is on top news for adding extra auth mechanism.
- afiori 3y ago
  Because people care
_8j50 3y ago
Ok Tailscale. You like to get on the latest security buzzword bandwagon, very nice but this makes me trust you less. Passwords are outdated in the same way key locks ok doors are outdated and all they did is have someone else manage federated authentication. I am so exhausted at screaming into the void over this topic. You all do whatever crap you want just know that whatever you do, if it isn't at least 2FA it is as shitty as passwords. New and secure just means threar actors haven't adopted to it yet. You know the nice thing about old shitty security? There is decades of work and lessons learned on how to make it work nice. Keep your silverbulletd and reinvented wheels and give me knowledge based factor (password,passphrase,pattern,etc...) and a completley separate NGC like FIDO2 and credential recovery options that don't involve email or yet another set of credentials. Now, that hard security implementation will actually keep me secure but these lazy bullshit security anti-patterns force me to depend on some bullshit 3rd party vendor, compromise on my privacy and still have me be one step away from total pwnage. All tailscale has convinced me is that they think passing the buck to someone else or getting in on a hype is in the best interest of their users as opposed to investing in layered and reliable security.
SamvitJ 3y ago
"Passkeys allow you to go passwordless — rather than a password that can still be phished — you get strong credential that syncs securely across your devices, using your chosen password/passkey manager." This sentence doesn't quite make grammatical sense to me. Is there a typo or two here, or am I missing something?
- scottgg 3y ago
  you get _a_ strong credential, or you get _strong credentials_ , probably There's a lot going on in there!
  - jjgreen 3y ago
    I don't think that I've ever seen credential in the singular (though the dictionary says that it is a thing)
  - SamvitJ 3y ago
    Ah, thanks, I think it makes sense now. The use of hyphens is confusing too. I would have preferred either: > Passkeys allow you to go passwordless: rather than a password that can still be phished, you get a strong credential that syncs securely across your devices, using your chosen password/passkey manager. OR > Passkeys allow you to go passwordless — rather than a password that can still be phished, you get a strong credential that syncs securely across your devices, using your chosen password/passkey manager.
- deleted 3y ago
  [deleted]
- deleted 3y ago
  [deleted]
liverpoolandy 3y ago
I’m a bit conflicted by this - I still need to sign up using providers and I would rather do using a disposable email address.
DCKing 3y ago
Good. I get they don't want to be responsible for keeping user credentials. But requiring permission from a big tech company to manage or access your own networks boggles my mind and made me not use it. Now if only they supported this for setting up the entire account too, as opposed to additional users only. I hope that's coming.
- devsda 3y ago
  I'm guessing you are talking about signing up with them? If I understood the docs correctly, it looks like they allow signing up with custom oidc provider. May be worth looking into it if your only concern with their service is delegating access via big tech.
  - DCKing 3y ago
    Yeah absolutely - I think this is a relatively recent change for them. The only thing stopping me from doing that is that 1) setting up an OIDC server for personal use is a lot of work I don't necessarily want to do, especially if it's just for Tailscale 2) this announcement suggests they may be working a full passkey setup, which would make that work useless.
kune 3y ago
The comments are full of statements regarding security capabilities for passkeys. But there is no public specification that even defines requirements for the exchange of passkeys between devices. Google and Apple make statements on their websites regarding the security, but all of it is practically unverifiable. Please note that end-to-end encryption is useless, if you are not controlling all the endpoints. Sites of course could use the device public key extension of the WebAuthn protocol, to rely on more than a private key copied intransparently between devices, but I wonder, who will even know about it and actually use it. Google has stated they support the extension, but I cannot find a statement by Apple. A question whether DevPubKey is supported by Apple is unanswered on the Apple Developer Forums.
- yomlica8 3y ago
  It is telling to me that the passkey spec has provisions for attestation which will allow lock-in by providers and lock-out by websites based on your provider, but questions of backup, account restore and interoperability between providers receive some hand-wavy "the market will figure it out" response.
gigatexal 3y ago
Are people still happy about Tailscale being a user land version of wireguard? The last benchmarks I saw showed an ~ 50% performance penalty over the native kernel level implementation.
- crote 3y ago
  Sure, why not? Plenty of use cases where performance doesn't really matter, and getting it working is orders of magnitude easier than wireguard. I've been using it for about a year now, and I rarely notice it even exists.
pabs3 3y ago
For those of us wanting non-big-tech implementations of WebAuthn/passkeys, there are options for storing passkeys in software, and for storing passkeys in TPMs. https://github.com/bulwarkid/virtual-fido/ https://github.com/bulwarkid/virtual-fido/ https://github.com/keepassxreboot/keepassxc/pull/8825 https://github.com/keepassxreboot/keepassxc/pull/8825 https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido https://git.kernel.org/pub/scm/linux/kernel/git/jejb/fido2-ctap-gadget.git/ https://git.kernel.org/pub/scm/linux/kernel/git/jejb/fido2-c...
thangngoc89 3y ago
Google is trying to tie the Google account to a single device at the moment. Just yesterday, signing to a work account requires 2FA (enforced by the organization) and then click a number on Gmail app.
ksajadi 3y ago
I have an honest question, but am afraid that I get downvoted for reasons that perhaps relate to my question: Why is this on top of HN? Is it a novel invention by Tailscale? Are they the first company who’ve done it? Are they used by so many people (like GitHub) that this will have other implications? Does the article go to technical details of their implementation that relates to the dev crowd? Please, educate me, those who upvoted it.
- the_gipsy 3y ago
  There is obviously a big marketing effort from Tailscale going on. It doesn't bother me too much, it's not like they are raw astroturfing and drowning HN, a lot of people are happy and engage with the posts. Personally I don't like it and won't use their products, but it's easy to ignore here.
- n42 3y ago
  personally, I've been wanting to try passkeys and this is the first provider I'm aware of that will let me, so that is newsworthy to me
- AmenBreak 3y ago
  [flagged]
- borski 3y ago
  People love Tailscale, and passkeys are relatively new, so a major authentication improvement for a well-loved service that is based on a new authentication mechanism not lots of companies support yet is … interesting. I think it’s as simple as that.
  - silisili 3y ago
    I think it's 99% just the former. I've seen a blog post describing a very elementary better way of storing IP addresses upvoted and praised. I've seen people agree and fawn over the idea they were using a flat JSON file everywhere initially. Then they somehow discovered a 20 year old DB, and some people treat it like the second coming of Christ. None of this is to insult Tailscale, or their works, or their blogs. People love it and it's obviously a nice product. The fandom here around them and what gets upvoted and praised just seems cultlike at times.
deleted 3y ago
[deleted]
mr-pink 3y ago
why not skip this shit and go straight to biometric data? we all know it's coming.
- archargelod 3y ago
  Use of biometry as any type of authentication is not the brightest idea. You can't change it when it inevitably gets stolen.
Double_a_92 3y ago
I'm still sceptical of passkeys. Either there needs to be an easy way to generate multiple ones, e.g. having multiple devices that can login. Or it should be easy to export and import them. I don't want to my account to be bound to exactly one specific device of mine... or to need to rely on some cloud sync provider (like Apple or so).

270 points by arkadiyt 3y ago

Offtopic: which software do they use to create those great webbrowsing explainers?

e12e 3y ago

No way to change an existing user to use/enable passkey? I suppose for an org using Microsoft AzureAD via OIDIc - passkey auth would be on the Microsoft side of the fence?

eadmund 3y ago

> Passkeys are synchronized across devices using services you already use and trust, like iCloud Keychain from Apple, Google Password Manager, and 1Password. I don’t trust any of those, and it’s weird that anyone does.

darknavi 3y ago
Why?

AmenBreak 3y ago

I'm just opting out of passkeys and companies that require them. Sorry!

jillesvangurp 3y ago

Probably a bit early to rely on this exclusively; for example Firefox support is not there yet (only works if you have ubikey). Apparently they are planning something there. Bitwarden recenly announced that they are implementing support; and there are probably a few others that are going to do stuff in this space. I do see the appeal for passkeys but I think short term it's probably going to be a support nightmare. The messaging around this is also quite confusing for example. Way too technical to explain to normal users what this even is or how it works and what they need to do. Also, as others have pointed out, while this is more secure than relying on passwords (given users can't be relied upon to follow most of the sane recommendations for these), it doesn't remove the need for multi factor authentication. A lot of passkey implementations basically rely on some variation of biometrics. Those aren't exactly hacker proof. And of course phones get stolen and lost all the time. Which creates the need for some recovery mechanism as well as a way to revoke passkeys.

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

fps 3y ago

Modern password managers run into issues regularly that still require a user to copy/paste a password out of a secure location. I don't know what the solution is for these situations with passkeys, but I know I don't trust password managers to do it right. I've used iCloud, Google Chrome, Lastpass, and 1password, and they all break consistently in a few scenarios. Three that come to mind are: - SSO or other systems where multiple logins are linked to the same account on different host names. The password manager will require you to essentially create a separate entry for the new site that becomes disconnected from the original. - Having multiple logins for the same site. This breaks especially with services that use a multi-stage login, but in general it breaks frequently. If you have kids or parents whose accounts you manage, password managers will invariably ask to update the wrong password, or attempt to auto-fill the wrong password regularly. - Sites that request you enter the old password at the same time as you enter your new password for verification when changing a password. Password managers can't figure this out, and as a result whenever I have a password manager generate a new credential, I also make sure to copy it to a temporary location until I've verified that it was saved. Typically, because you entered the old password on the password change page, that save doesn't go through. In the end, all these security features just boil down to how secure your password reset/customer support function is. If you're going to require people to reset their passkey every time they log into your site, why not just use a "magic link" email session initiator and be done with it?

piloto_ciego 3y ago
I don’t know, I’ve found quite a few work arounds for stuff like this with BitWarden where the experience is pretty seamless and I routinely deal with all of these issues except SSO. BitWarden has its problems but generally I find the experience pretty good - indeed far superior to the other services you mentioned. The ability to use “secure notes” and the convenient way that has been implemented in BW has allowed me to be fine in all the scenarios you’re mentioning. Of course, you’re right, you still have to copy the password in somewhere, but ultimately I feel like that’s a lower threat if properly handled than what I used to do (shitty insecure passwords). The other thing is I barely ever use the browser extension for the password manager. All of the browser extensions I’ve tried other than BitWarden have been janky and even that’s only ok. Still, try BW I like it way better than lastpass and 1password.

marcrosoft 3y ago

I don’t understand why someone would want to store all their credentials with one of the large tech companies. It seems like this makes it really easy for law enforcement to grab access to all accounts easily.

kccqzy 3y ago
When you use passkeys with either Apple's iCloud Keychain or Google Password Manager, the key material is end-to-end encrypted. Law enforcement cannot get your passkeys through these two big tech companies.
- marcrosoft 3y ago
  So your keychain is symmetrically encrypted with a password and they don’t store that?
  - woodruffw 3y ago
    Among other things, yes[1]. [1]: https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/web https://support.apple.com/guide/security/escrow-security-for...
- QhwyF3AxE 3y ago
  This is a great point. And to respond to the other part of the parent comment about storing "all their credentials with one of the large tech companies" — you don’t even need to do that, if you don’t want to. Apple just extended their Credential Provider API such that passkeys can now be synced using external providers, meaning password manager apps can save and offer passkeys on iOS, iPadOS, and macOS. So you can choose to sync your passkeys with whatever your favorite password manager is. See this page: https://developer.apple.com/passkeys/ https://developer.apple.com/passkeys/ And Google announced a similar API a month or two ago. See the section titled "Passkey support for Android apps" on this page: https://developers.google.com/identity/passkeys/supported-environments#android-passkey-support https://developers.google.com/identity/passkeys/supported-en...

dhosek 3y ago

Is there a good plug-and-play Java framework for supporting logins via identity providers like this (including passkeys) for web apps? As I build out a web application, I would like to avoid having to do all the hard work of implementing this if I can just grab a jar and have it done for me.

shmde 3y ago
Have you tried keycloak ?

malux85 3y ago

I just want to say that Tailscale ROCKS. It installed flawlessly on all of my machines (Linux and Mac), and now I can route to all of them wherever I am. It configures DNS correctly, it routes traffic correctly, and all of my internal machines at my house are routable when I'm out in a coffee shop or library or hotels. It's been more than a year and it's operated flawlessly, never needing maintenance or restarting, it survives connection resets and is completly robust. I just love it. Disclaimer: No affiliation other than being a happy customer.

sanitycheck 3y ago
I wanted this to be true for me, but on Android it sometimes kills my internet connection (even when turned off) until I force-close it, on Windows it'll hang and consume lots of CPU every few days and on Linux (Ubuntu/Pop) the service sometimes stops and I don't know why. I just have bad luck, I guess. (On-topic, I would prefer them to to take my damn password please.)
thrixton 3y ago
I totally agree, and with their recent relaxation of the license tiers, they really seem like a consumer friendly company. I wish them well.

samcat116 3y ago

Love to see Passkeys supported in more places.

yawnxyz 3y ago

That's so cool, I didn't even know Passkeys were available to use already. Does anyone know of a good resource / tutorial / example / best practices on building login/signup systems in web apps with Passkeys? Also, what's browser support like? I'd love for some simple system to just replace PassportJS and all those confusing systems.

r2b2 3y ago
https://passkeys.dev/device-support/#matrix https://passkeys.dev/device-support/#matrix

wly_cdgr 3y ago

Sounds like a surveillance corpostate control mechanism but ok

systemvoltage 3y ago

Like many round trips we have made, I suspect in the year 2035, we’ll look back and say to ourselves: “Yeah, password was super based. Just copy paste it in the box and you’re logged in. Can store it anywhere, even in a notebook. Safekeep it by printing them. No need for HyperBigTechCorp. Portable. Those gray beards had it right the whole time.” Can we please stop the bandwagon for a moment and inquire about the downsides of Passkey?

fragmede 3y ago
How do you bootstrap it? You get robbed at gunpoint by some ruffians and they take your wallet, cellphone, keys, and laptop. Hopefully they can't get into your accounts, but never mind that, how do you get back in to everything?
- hooverd 3y ago
  You don't.
- jabbany 3y ago
  Recovery code system? Like 2FA today, generate a special bootstrap key you can print and save. This isn't that uncommon. Things like disk encryption also do this (e.g. bitlocker)
  - recursive_loops 3y ago
    > generate a special bootstrap key you can print and save So ... a password? Also in this scenario you've been robbed. It's quite possible that either they took your printed out passkey also since it was in your wallet, or you're not at home where you can get the pass key from your file cabinet or safe.
    - jabbany 3y ago
      Not really. A password is meant to be memorized and reproduced correctly regularlt, whereas a recovery key doesn't need that and can be very long and complicated since it is rarely used.

YPPH 3y ago

My work uses Microsoft SSO for everything. Passkeys aren't enabled though. And management won't enable them on Azure AD. Instead, they enable the tried and tested and ultra secure method of SMS based 2FA with a password. (This is sarcasm.) The alternative is the Microsoft authenticator app with its associated risk of approval fatigue. I have already had several malicious login attempts. Fortunately I'm attuned enough to decline them. The only way I'll get passkey logins for my work account is if Microsoft force it as a 2FA method for enterprise. I won't hold my breath.

ziml77 3y ago
Authenticator has options that avoid approval fatigue. There's a setting that causes it to show a number on screen, and then an option between providing a list of 3 numbers you have to pick from or showing a textbox that you have to type the displayed number into. If it's set up for textbox entry it's unlikely that someone is going to approve a random request.
belltaco 3y ago
> I have already had several malicious login attempts Doesn't that mean they know your username and password? How does that happen so easily.
- brenns10 3y ago
  They said login attempt, not successful login. So no.
  - throwawaysleep 3y ago
    But to get to the auth request, do you not need to pass the password stage first? I get these pretty frequently on my work machines as I reuse my passwords and they have already leaked. At least that was my assumption.
    - amanzi 3y ago
      I assume this is referring to the passwordless logon feature, which most enterprises disable. But with this feature, you just need to enter the username (email address) and choose the option to log in with authenticator.

andrewmcwatters 3y ago

[flagged]

deleted 3y ago
[deleted]
jabbany 3y ago
I'm pretty sure passkeys are just a rebranded version of virtual WebauthN tokens. So while passkey secrets can be synced (unlike U2F physical tokens) they can also be implemented as being backed by a physical token (think Yubikey) that never goes om the cloud.
- d0mine 3y ago
  There is theory and there is practice. What grandparent comment says is the likely outcome in practice
  - mynameisvlad 3y ago
    ... Unless you care about that and use a Yubikey or other physical security key. There is absolutely nothing stopping you from doing so as long as your Yubikey supports WebAuthN (the latest do). You are prompted to use another phone or physical security key if a resident key isn't found on your device, and even if it is, you are given the option of doing so instead of using the one found. This is not a hypothetical feature or theory or something, it's part of the spec and is implemented. It's as practical as it gets.
    - hooverd 3y ago
      Unless the website decides to enforce attestation and not allow that.

awayto 3y ago

I haven't yet looked into the inner mechanics of passkeys, and the link only talks about the first login. What is the experience like when a user wants to log in from a different system? They press the "Login with Passkey" button on Device 2, and then...?

iknowstuff 3y ago
It presents a qr code you can scan with the other device. You can try it on https://passkeys.io https://passkeys.io
- JohnFen 3y ago
  > It presents a qr code you can scan with the other device. What about devices that have no camera?
  - iknowstuff 3y ago
    SOL
- awayto 3y ago
  Very cool. Thanks.
- jorams 3y ago
  Note that this requires a "nearby device", which is determined via Bluetooth. There are lots of desktop PCs without Bluetooth, so this requirement is kind of a serious problem.

hsn915 3y ago

This sounds counter productive. Third party authentication providers are a single point of failure, and usually they themselves require a password to authenticate you anyway. If your gmail password is hacked, then effectively all your accounts on websites that use Google auth are also hacked. Passkeys appear to also be handled by central services? At least that appears to be the case with Apple, according to the link in the post: https://developer.apple.com/passkeys/ https://developer.apple.com/passkeys/ I personally think having a browser-managed "private key" (the same kind used for ssh auth) would be better, but now as a user you have to manage the multiple private keys you have associated with an account; a totally confusing concept for the average user.

endorphine 3y ago
> Passkeys appear to also be handled by central services? I don't think it is true that passkeys require a third party, but can someone else confirm?
- Aaron2222 3y ago
  They're just FIDO, and can absolutely be implemented in an offline password manager.

nhumrich 3y ago

Auto-generated password via a password manager are more secure, convenient, and portable then passkeys and oidc.

jabbany 3y ago
Not really, the technology behind passkeys behave kind of like managed ssh keypairs. While they can be designed to have the secrets cloud synced (just lile how you can sync your ssh private keys), there's nothing preventing them from being implemented in other ways, like having them backed by a third party password manager or even a pyhsical token like a yubikey. Of course, this depends on the software (OS, browsers) actually respecting and supporting that interoperability. But that's not really a limitation of the underlying tech.
- _delirium 3y ago
  Is there a way to store the ultimate root of trust somewhere non-digital? I currently have my most important root-of-trust passwords printed out on paper stored in places I consider long-term secure. At least in my personal physical and social context, I don't trust any cloud account or dongle to a similar extent.

tiffanyh 3y ago

Apple Slightly off topic: did Apple just make it super easy for law enforcement to unlock your phone & passkeys as part of iOS 17? > ”Apple ID. Securely sign in to your iPhone using a nearby device or any email address or phone number listed in your account.” https://www.apple.com/ios/ios-17-preview/ https://www.apple.com/ios/ios-17-preview/

shortcake27 3y ago
What the heck? SMS as a second factor was considered bad practice ten years ago. Allowing it to be used as the only factor to access your entire Apple ID is absolute negligence as SIM-swapping is still and forever will be trivial. I'm genuinely shocked. Engineers at Apple must have been screaming into their pillows at night as they watched some incompetent BA ignore all advice and force this through.
- ec109685 3y ago
  My guess is that they aren’t making things less secure. There are flows that let you reset your password but don’t let you login today, so letting you login via those flows would be a step up in usability. If you don’t have your phone as your second factor or can’t use phone today to reset password, then I don’t expect you’ll be able to login via that mechanism.
  - shortcake27 3y ago
    Ah yeah that’s true, it’s no less secure than recovery via phone number. Not entirely sure how to prevent recovery using a phone number. I wonder if this means setting up a recovery key instead? Been considering doing this anyway. https://support.apple.com/en-us/HT208072 https://support.apple.com/en-us/HT208072
- amanzi 3y ago
  It's true - I have to use SMS as second factor to log into iCloud. Apple don't let you use a generic OTP as MFA - the only other option is to get a notification on your iPhone or iPad. I don't have an iPhone and I rarely have my iPad with me, so SMS is the only way I can log in to icloud.com.

User23 3y ago

It's slightly annoying that the "What are passkeys?" section doesn't actually tell you what a passkey is. Hey it's asymmetric crypto that generates a key/cert pair for every site you register at. Neat. Why not just say so? I'm getting shades of "passwords are so insecure, passphrases are secure" here.

benatkin 3y ago

TL;DR Google, Microsoft, GitHub, Apple, Apple’s macOS and iOS, Google Chrome and Android, as well as 1Password, Yubikey Yay. https://indieweb.org/NASCAR_problem https://indieweb.org/NASCAR_problem

Aaron2222 3y ago
Passkeys are just a standard protocol, i.e. there'd just be a single "Use Passkey" button.
- megous 3y ago
  There's no "passkeys" protocol. If there is, it's well hidden behind marketing bullshit. :) > In marketing material, the terms passkey or Passkeys are preferred over related terms such as FIDO or WebAuthn, because they are less likely to cause confusion. Yeah. Nowhere does it say what it actually is or how it's related to the other standards. Not confusing at all.
- benatkin 3y ago
  Yeah it seems sort of like web notifications and I find it quite centralized, favoring the browser vendor. So I'll have to see what it's like in practice. But I hope it doesn't take off.
  - Aaron2222 3y ago
    How so? Apple's already announced support for 3rd party passkey stores to integrate into the OS (to allow passkey authentication in apps), and the 1Password extension supports passkeys across the major browsers (though support's in beta).

LeoPanthera 3y ago

> "as well as 1Password" 1Password does not support PassKeys. They have announced the intention to, but outside of beta releases it's not there yet.

croes 3y ago

>which means we now need software to manage our passwords. So now we need hardware and software to generate passwords we don't even know.

zoomTo125 3y ago

There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to manually make a copy of every keys? How do you know if the copy is synced with the main one?

Wool2662 3y ago
Recovery is the same as with passwords. Depends on the services policies. Passkeys and YubiKeys are different things. But generally it is recommemded to have a second YubiKey in a safe place and to register at least two keys on every service. Unfortunatly the implementations for using hardware keys are often pretty bad and require to activate alternate MFA which defeats the purpore of having a hardware token in the first place. For backing up a yubikey. If you manage it you get a massive bugbounty. The whole purpose of a yubikey is to not be able to read the embedded key. Yubikey guarantees physical posession of the key itself if you can prove knowledge of the key within. For passkeys: Only the authentication/creation process is specified. How passkeys are stored, shared, backedup etc is totally up to the implementing party. So Google and Apple will synchronize the keys using their existing password infrastructure. In the end the only difference to passwords is: - It is always randomly generated - You can have multiple passkeys per service - The application managing passkey is required to verify that passkeys are only transmitted to the service they were created for (making them phishing resistant) Passkeys are basically the point between passwords and hardware tokems like the yubikey. Safer than passwords and less safe than a yubikey but easily usabale by everyone.
snagg 3y ago
The short answer is that it's non standard and it depends on where the passkeys are stored. To be precise, the original WebAuthn standard did not account for a recovery mechanism at all and instead recommended adding multiple credentials to an account. Practically if the passkeys are stored in your iCloud Keychain, they are automatically synced across your Apple devices and the recovery mechanism is the recovery mechanism for iCloud. Similar consideration for Google/Chrome and other password managers. We wrote a relatively long blogpost about this + implementation and threat modeling considerations in case it's interesting: https://www.slashid.dev/blog/passkeys-security-implementation/#how-are-credentials-shared-and-stored https://www.slashid.dev/blog/passkeys-security-implementatio...

adityapatadia 3y ago

What I don’t get is why Tailscale is on top news for adding extra auth mechanism.

afiori 3y ago
Because people care

_8j50 3y ago

Ok Tailscale. You like to get on the latest security buzzword bandwagon, very nice but this makes me trust you less. Passwords are outdated in the same way key locks ok doors are outdated and all they did is have someone else manage federated authentication. I am so exhausted at screaming into the void over this topic. You all do whatever crap you want just know that whatever you do, if it isn't at least 2FA it is as shitty as passwords. New and secure just means threar actors haven't adopted to it yet. You know the nice thing about old shitty security? There is decades of work and lessons learned on how to make it work nice. Keep your silverbulletd and reinvented wheels and give me knowledge based factor (password,passphrase,pattern,etc...) and a completley separate NGC like FIDO2 and credential recovery options that don't involve email or yet another set of credentials. Now, that hard security implementation will actually keep me secure but these lazy bullshit security anti-patterns force me to depend on some bullshit 3rd party vendor, compromise on my privacy and still have me be one step away from total pwnage. All tailscale has convinced me is that they think passing the buck to someone else or getting in on a hype is in the best interest of their users as opposed to investing in layered and reliable security.

SamvitJ 3y ago

"Passkeys allow you to go passwordless — rather than a password that can still be phished — you get strong credential that syncs securely across your devices, using your chosen password/passkey manager." This sentence doesn't quite make grammatical sense to me. Is there a typo or two here, or am I missing something?

scottgg 3y ago
you get _a_ strong credential, or you get _strong credentials_ , probably There's a lot going on in there!
- jjgreen 3y ago
  I don't think that I've ever seen credential in the singular (though the dictionary says that it is a thing)
- SamvitJ 3y ago
  Ah, thanks, I think it makes sense now. The use of hyphens is confusing too. I would have preferred either: > Passkeys allow you to go passwordless: rather than a password that can still be phished, you get a strong credential that syncs securely across your devices, using your chosen password/passkey manager. OR > Passkeys allow you to go passwordless — rather than a password that can still be phished, you get a strong credential that syncs securely across your devices, using your chosen password/passkey manager.
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]

liverpoolandy 3y ago

I’m a bit conflicted by this - I still need to sign up using providers and I would rather do using a disposable email address.

DCKing 3y ago

Good. I get they don't want to be responsible for keeping user credentials. But requiring permission from a big tech company to manage or access your own networks boggles my mind and made me not use it. Now if only they supported this for setting up the entire account too, as opposed to additional users only. I hope that's coming.

devsda 3y ago
I'm guessing you are talking about signing up with them? If I understood the docs correctly, it looks like they allow signing up with custom oidc provider. May be worth looking into it if your only concern with their service is delegating access via big tech.
- DCKing 3y ago
  Yeah absolutely - I think this is a relatively recent change for them. The only thing stopping me from doing that is that 1) setting up an OIDC server for personal use is a lot of work I don't necessarily want to do, especially if it's just for Tailscale 2) this announcement suggests they may be working a full passkey setup, which would make that work useless.

kune 3y ago

The comments are full of statements regarding security capabilities for passkeys. But there is no public specification that even defines requirements for the exchange of passkeys between devices. Google and Apple make statements on their websites regarding the security, but all of it is practically unverifiable. Please note that end-to-end encryption is useless, if you are not controlling all the endpoints. Sites of course could use the device public key extension of the WebAuthn protocol, to rely on more than a private key copied intransparently between devices, but I wonder, who will even know about it and actually use it. Google has stated they support the extension, but I cannot find a statement by Apple. A question whether DevPubKey is supported by Apple is unanswered on the Apple Developer Forums.

yomlica8 3y ago
It is telling to me that the passkey spec has provisions for attestation which will allow lock-in by providers and lock-out by websites based on your provider, but questions of backup, account restore and interoperability between providers receive some hand-wavy "the market will figure it out" response.

gigatexal 3y ago

Are people still happy about Tailscale being a user land version of wireguard? The last benchmarks I saw showed an ~ 50% performance penalty over the native kernel level implementation.

crote 3y ago
Sure, why not? Plenty of use cases where performance doesn't really matter, and getting it working is orders of magnitude easier than wireguard. I've been using it for about a year now, and I rarely notice it even exists.

pabs3 3y ago

For those of us wanting non-big-tech implementations of WebAuthn/passkeys, there are options for storing passkeys in software, and for storing passkeys in TPMs. https://github.com/bulwarkid/virtual-fido/ https://github.com/bulwarkid/virtual-fido/ https://github.com/keepassxreboot/keepassxc/pull/8825 https://github.com/keepassxreboot/keepassxc/pull/8825 https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido https://git.kernel.org/pub/scm/linux/kernel/git/jejb/fido2-ctap-gadget.git/ https://git.kernel.org/pub/scm/linux/kernel/git/jejb/fido2-c...

thangngoc89 3y ago

Google is trying to tie the Google account to a single device at the moment. Just yesterday, signing to a work account requires 2FA (enforced by the organization) and then click a number on Gmail app.

ksajadi 3y ago

I have an honest question, but am afraid that I get downvoted for reasons that perhaps relate to my question: Why is this on top of HN? Is it a novel invention by Tailscale? Are they the first company who’ve done it? Are they used by so many people (like GitHub) that this will have other implications? Does the article go to technical details of their implementation that relates to the dev crowd? Please, educate me, those who upvoted it.

the_gipsy 3y ago
There is obviously a big marketing effort from Tailscale going on. It doesn't bother me too much, it's not like they are raw astroturfing and drowning HN, a lot of people are happy and engage with the posts. Personally I don't like it and won't use their products, but it's easy to ignore here.
n42 3y ago
personally, I've been wanting to try passkeys and this is the first provider I'm aware of that will let me, so that is newsworthy to me
AmenBreak 3y ago
[flagged]
borski 3y ago
People love Tailscale, and passkeys are relatively new, so a major authentication improvement for a well-loved service that is based on a new authentication mechanism not lots of companies support yet is … interesting. I think it’s as simple as that.
- silisili 3y ago
  I think it's 99% just the former. I've seen a blog post describing a very elementary better way of storing IP addresses upvoted and praised. I've seen people agree and fawn over the idea they were using a flat JSON file everywhere initially. Then they somehow discovered a 20 year old DB, and some people treat it like the second coming of Christ. None of this is to insult Tailscale, or their works, or their blogs. People love it and it's obviously a nice product. The fandom here around them and what gets upvoted and praised just seems cultlike at times.

deleted 3y ago

[deleted]

mr-pink 3y ago

why not skip this shit and go straight to biometric data? we all know it's coming.

archargelod 3y ago
Use of biometry as any type of authentication is not the brightest idea. You can't change it when it inevitably gets stolen.

Double_a_92 3y ago

I'm still sceptical of passkeys. Either there needs to be an easy way to generate multiple ones, e.g. having multiple devices that can login. Or it should be easy to export and import them. I don't want to my account to be bound to exactly one specific device of mine... or to need to rely on some cloud sync provider (like Apple or so).