8 ms·
That's a rather uncharitable take on the situation. I'll propose an alternative: If you want to take advantage of the new auth standard that will eliminate weak
by saulrh 3y ago
That's a rather uncharitable take on the situation. I'll propose an alternative: If you want to take advantage of the new auth standard that will eliminate weak passwords and password reuse (thereby preventing 99% of casual account break-ins), you'll have to spend $30 to upgrade off the legacy yubikey you've been coasting on since 2013.
- taeric 3y agoThis doesn't really change much, though? My keys can only have 25 resident keys on them, and I also have more than 25 passwords stored in my password manager.
- conradev 3y agoPassword managers can store passkeys. I plan on storing passkeys in a password manager for most accounts, and then moving the few that matter to be resident keys. The theoretical advantage here is twofold: - Passwords are not guessable any longer - Password managers don't expose secret material in normal operation, because they sign requests with keys stored in TEEs (i.e. most modern devices have an embedded security key)
- deleted 3y ago[deleted]
- taeric 3y agoIf passkeys become defined as resident keys, is this still true? And if this is acceptable, honestly, do we need a new standard? Password managers exist today. Such that I already do what you are suggesting here with passwords. Does it really become much more secure by the move to passkeys?
- deleted 3y ago[deleted]
- ericjmorey 3y agoPasskeys are for the people that don't even use password managers outside of what Apple or chrome provides by default if at all. Passkeys are trying to eliminate those ad hoc solutions by providing a different system. The transition will be slow and messy requiring most people to use passkeys and passwords (and maybe password managers) for a while.
- taeric 3y agoBut if the passkeys are copyable off of where you are storing them, then I'm not entirely clear on how they truly up the security? I mean, I get the obvious ways that a challenge system is better than a bearer token. But I feel a ton is lost as soon as you move to the exportable keys. Love to see an exploration on these topics. I confess I have not been following them much, lately.
- ericjmorey 3y agoI think the general idea is that the vast majority of people have a smart phone, so the security model is to let people use the phone as the "key" to access services and take advantage of the biometrics/pin security as the main component of security access. This means that there are a lot of security compromises that make sense in the name of ease of use. This model has been tested to some extent with Apple pay and Google wallet which people take relatively seriously since there's money involved. I think the model makes sense to improve security for the masses, but it's not good for people that want and demand more (like people that already bought YubiKey products).
- taeric 3y agoOddly, pay/wallet work for completely other reasons. Largely in the absurd amount of monitoring that the credit companies do to watch your transactions. That and the general legal framework around charges. Consider, that is largely replacing 20ish numbers with something else. Is slightly more convenient for folks, as you have your phone with you a lot. So, for the passkeys, I know that there is a secure enclave in phones. I was not aware that they could store resident keys. Know what the limits are, there?
- dathinab 3y agoand this is already messed up password managers are a security liability which only exists because of how flawed password are the original design of WebAuthn was all about taking both password and password manager out of the equation noticeable reducing the attack surface instead how it now looks they will make password managers mandatory until they make "blessed" storage mandatory basically now controlling the password manager and HSK industry (by deciding which ones work with their products) and then maybe kill the whole industry by only allowing the storage build into Android,iOs,Windows, etc. And while stuff like this sound like a crazy conspiracy theory in the past the more I look into how passkeys developed in recent years (especially how they where represented) the more stuff like this sound quite viable. I mean big coperations which frequently have been found to abuse their power and try to get vendor locking wherever they can afford to, pushing a technology which looks like an improvement but can easily be abused to facilitate vendor lock-in and control over parts of an industry with the goal to abuse that... that isn't anymore conspiracy territory, that is what Microsoft has been doing in the past non stop and only stopped doing because it was no longer monetary beneficial for them. But in this case it would be. For them and Apple and Google and a few other huge companies.
- recursive 3y agoIf you use good passwords, I don't think they're any more guessable than passkeys.
- taeric 3y agoI think the difference is that good passwords are still replayable. Such that moving away from bearer style tokens is a win. But if I have no way of controlling the use of individual passkeys, they lose a lot.
- vorpalhex 3y agoIs there a clear path to a yubikey device supporting 1000+ resident keys and doing so well in the near future? What does the cost look like? Are we talking $50 or $500?
- radicaldreamer 3y agoI'm not sure why current keys cost so much...
- RandomBK 3y agoMy hunch is low volume and an enterprise-leaning customer base. Engineers aren't cheap, and those who can build security-sensitive products even less so. When I bought a (single) Yubikey from their website late last year, it was Fedexed to me directly from their Palo Alto downtown office, not some distribution center in the middle of nowhere. That can't be cheap.
- darthwalsh 3y agoIf you order a key and it comes from an Amazon warehouse, are you going to be worried about a supply chain attack? Maybe that's a benefit of sending by direct FedEx?
- simooooo 3y agoWhen I bought mine they (current owners) were actively advising against buying from Amazon. But who knows. Probably very unlikely
- saulrh 3y agoPresumably Yubico's upgrade path is to tweak the form factor slightly so they can fit more than a few kb of memory into the thing. I know that it's possible, I can buy 50GB flash drives in the micro yubikey form factor, the ones that are just a rectangle of plastic that fits in under a USB-A port's tongue, and they only cost like $10. So it's probably just something that Yubikey needs to design into the next gen of keys, and I suspect it won't make them cost much more than $5 more than the last gen.
- kj4ips 3y agoI just looked a the technical manual for the 5 series, and it only supports 25. I only have two right now, but I have way more than 25 TOTPs. I don't know what the Bio FIDO ones have, but if it is similar, YubiCo may not have a product well placed for a large number of RKs. ~Edit: The Bio's have the same limit of 25
- mixmastamyk 3y agoI think the FLOSS keys can handle more than that. But, I'd probably separate work and personal accounts to different pairs of keys anyway.
- radicalbyte 3y agoAs matthewaveryusa says above, you can have the key on the Yubi generate then encrypt the private key; that encrypted private key is then stored on mass storage (synced to iCloud etc). Then to use it you supply the key + data to sign the auth challenge. My issue then is that these keys allow total tracking. We need hardware implementing more complex and privacy protecting schemes (BBS+ etc).
- gruez 3y agoWhy should I be forced to upgrade? Non-resident keys also eliminate weak passwords and password reuse. Using resident keys only add marginal improvement (ie. you can plug in a key and the service knows which account it belongs to), and that doesn't seem like a good justification to deprecate all the existing authenticators in use today.
- pornel 3y agoThe number of existing old yubikeys is absolutely miniscule compared to the number of people who aren't using any keys yet.
- joshgachnang 3y agoMaybe not for us, but for the vast majority of users, they'd pick not having to remember a username OR password for sure.
- Aeolun 3y agoIt’s also make pickpocketing a lot more lucrative if you can grab someone’s wallet and have immediate access to their bank account.
- DangitBobby 3y agoCan you give me a high level description of why passkeys won't work with my current hardware key, and then explain why they went with that implementation instead of one that works with my current hardware key?
- runiq 3y ago`rk=required` means your hardware is required to store each and every derived key, not just the master key, all in the service of you not needing to remember your username anymore. Current security keys can handle a couple dozen derived keys at most, _if_ they can handle any at all. This flies in the face of previous promises where 'every key can handle an unlimited amount of accounts'. In my eyes, this looks like a big push towards phones as passkeys, and nothing else. Would fit with the Bluetooth sync strategy as well.
- BillyTheMage 3y agoAs someone who doesn't and won't ever have a mobile phone, I can't comprehend why things are going in this direction.
- pulpfictional 3y agoBecause almost every human who has digital accounts does.
- delfinom 3y agoWell, 1984 and Fahrenheit 451 were warnings of the world we are slowly heading towards.
- DangitBobby 3y agoI guess that means passkeys are DoA for me.
- cuu508 3y agoMy worry is in the future there may sometimes be no other option than to take this "advantage". If a site implements the new auth standard, will it also keep the current username/password/2fa as an alternative option?
- JohnFen 3y agoI think that probably depends on popular adoption. If going passkey-only causes a significant reduction in users being able to access the service, then there will always be a non-passkey option. Personally, I think there is significant friction to adopting passkeys, so there is little risk of being forced into using them in the near future. Longer term, though, I have no idea.
- dathinab 3y agoI would go as far and say it's a too charitable take. Shared residual keys _should not exist_ (outside of short term temporary usage, e.g. not 2FA/FIDO). They are a liability, they are a security risk, they promote bad security practices. Best example TOTP (which from a security POV is quite flawed). You don't want to ever share the shared secret across devices (or back it up) but due to it being possible and flawed 2FA implementation being the norm not the expectation you are kinda forced into it. And as thinks look now passkeys will go into the same highly flawed user hostile direction.
- 0cf8612b2e1e 3y ago> You don't want to ever share the shared secret across devices (or back it up) Hard disagree there. I do not feel comfortable unless I can backup a key. Phones get lost/broken/stolen all the time. Is it less theoretically secure? Sure, whatever, but I am not James Bond.
- dathinab 3y agoyou don't need to backup a shared secret to gain exactly what you get from backing up a shared secret, except more secure you have a backup of a _different_ secret with a similar degree of "authority" (or if it's "copyable" with the only authority to be used for restoring 2FA once or similar) then if you backup gets stolen you can just go into you account management API and disable/delete/flag it, in that case even if encryption is broken as long as you act fast enough the damage is trivially and conveniently contained (e.g. some password managers had insecure backup/storage in the past) with the same key not only do you have to disable it, you first have to create a new key and then sync it to all your new devices and backups and then disable the old key, which isn't grate if you have more then one device or some of you devices are temporary out of reach (e.g. you one a business trip) it's like reintroducing the "physical" problem of having to replace all locks when you loose your house key in a situation where you could have all the benefits one key per lock and a different door for each person (i.e. device) without any of the overhead/drawbacks this would normally introduce
- 3y ago
- somehnguy 3y agoSomeone using easy to guess simple passwords probably isn’t using a Yubikey and also likely has no interest in getting one at all. Those 2 categories are very different people.
- simooooo 3y agoWell no, because a brand new yubikey 5 has the same limit