4 ms·

The biometric capture angle is so blatant. Plus phisher can and absolutely will catch up to this technically. And the added bonus of lose your phone = you don't

The biometric capture angle is so blatant. Plus phisher can and absolutely will catch up to this technically. And the added bonus of lose your phone = you don't exist online. Sounds nightmarish.

jackson1442 3y ago
Biometric capture?
- namaria 3y ago
  The endgame here is big tech wants to own identity. Tying our online existence to biometrics managed by their devices is the path towards that future.
  - rrr_oh_man 3y ago
    This comment needs to be higher up.
ngrilly 3y ago
Two factors are needed: something you have (your device) + something you are (your biometric). If you're concerned about losing your phone (I am), then you can backup your passkeys to the cloud and/or sync them with other devices (with end-to-end encryption of course, so that the backup/sync service has zero knowledge of your passkeys).
- namaria 3y ago
  Agreed in principle but I'd rather use something I know than let some corporation manage my biometric data.
  - ngrilly 3y ago
    Your biometric data are only used locally to unlock the secure enclave on your devices. Your biometric data never leave your device and are never shared with "some corporation".
    - namaria 3y ago
      You think that there's data on a networked device that is absolutely safe? I very much doubt that. Besides, if I need a device from "some corporation" to manage my biometric data, I already depend on "some corporation" for my proving who I am online. I'd much rather stick to using a secret only I know and that I can manage with offline databases managed by open source software.
      - ngrilly 3y ago
        Do you use keep your secrets in an offline database that is on a non-networked/air-gapped device?
        deleted 3y ago
        [deleted]
        namaria 3y ago
        That's whataboutism. I'm not claiming my methods are unassailable. I'm disputing the notion that anyone can claim that about their methods. The key difference is, I know the weaknesses on my approach and I mitigate for them. I'm not reaching for whishful thinking. Anyone claiming security by "I don't see an attack vector" should be doubted.
        ngrilly 3y ago
        Agreed. But then what is the point you were trying to make when asking "You think that there's data on a networked device that is absolutely safe?"?
        namaria 3y ago
        Questioning your claim of > Your biometric data never leave your device and are never shared with "some corporation". Like I said, I never claimed my ways are 100% safe. I am questioning the claim that biometrics on phones is 100% safe. You realize you just whatabouted again?
- nonrandomstring 3y ago
  > Two factors are needed If two factors are needed. They are not always. Many (indeed most) security situations do not require two factors given the risk tradeoffs. Useful for your bank. Not so much for pizza.
  - ngrilly 3y ago
    The context was to unlock your passkeys stored on your local device.
jsnell 3y ago
The biometrics don't leave your device. There is no harvesting of biometric data for other purposes happening. Passkeys can't be phished, it's literally impossible. It doesn't mean nobody's account will ever be stolen again, but it means attackers will have to switch to other mechanisms (most likely malware, whether it's stealing auth tokens or doing a man-in-the-browser attack). But that's already a win in the current situation, and will only become better over time as platforms become more malware-resistant. Passkeys aren't any different when it comes to losing your account, it's the same for all authentication factors. People forget their passwords, have their password manager database deleted, have their phones stolen, leave their job and lose their work email, etc. You always need to have a recovery path, the worst you can say about passkeys is that they don't obviate the need for account recovery.
- nottorp 3y ago
  > it's the same for all authentication factors. People forget their passwords, have their password manager database deleted, have their phones stolen Yes but you can at least remember the important passwords in your head. With passkeys, if you lose your devices you're dead. I don't want to rely on my devices that much. Hint: if you use passkeys for your personal Google account, do you actually think anyone at Google will be able to help you recover access when you lose them? If you're thinking of your work passwords yes, you can probably call or visit someone physically and they'll reset your access. Other than that, not bloody likely.
  - jsnell 3y ago
    > Hint: if you use passkeys for your personal Google account, do you actually think anyone at Google will be able to help you recover access when you lose them? I mean, yes, but that's beside the point. What's more important is that I don't think anyone at Google would need to help me recover my account. - I have multiple trusted devices signed in already, in addition to my phone - I have a recovery phone number and recovery email set. In a situation where I lose my phone, I can get a new SIM card for the same phone number within hours. - I have my TOTP key saved on another device besides my primary phone. (Though I have to admit that I didn't turn the backup phone on last year; I used to do it twice per year, so it's possible this doesn't work any more.) - I have a set of 2FA recovery codes printed, and stored in a place where I'd know to look for them. Now, obviously basically nobody else has all of that set up. Just having printed and knowing where the recovery codes are is like 99.99th percentile level of preparedness. But most of it is also totally unnecessary. In the last 10 years I've had one phone stolen and one that stopped working suddenly and irrevocably. In both cases just the stuff that basically everyone would have (getting a new SIM in one case, an existing session from a trusted device) was enough to get the account back into a good state. Look, the people working on this stuff are neither idiots nor malicious. They understand that people lose stuff and forget stuff all the time, and they understand that the accounts can be very precious to the owners. So they try to make sure that as many people as possible have a way to recover their accounts. And as long as you haven't gone out of your way to make sure the account is unrecoverable, it'll work out fine.
sweetjuly 3y ago
How are you envisioning phishing working here? The credentials are bound to a set of origins. I don't know of any passkey managers that have an option to send a passkey to the wrong origin because it just doesn't make sense.
- namaria 3y ago
  I'm sorry but "I don't see it" is not a good argument in security. Hailing a technology as "exploit proof" should be considered a non-starter. Any security evaluation should be about thread models, attack surfaces, mitigation and trade-offs. Never "trust us". Not knowing how a technology could be exploited is not a feature, is a liability.
  - nonrandomstring 3y ago
    I think I am seeing a real clash of mind-sets in this thread. People from a security mindset like you and I meet a lot of friction with developers who are chirpy and optimistic (and also more generally with people who want technology to be fluffy and "just work") Not that chirpy optimism is a fault at all, we all need a little more of it, but when it crosses borders into strong beliefs that actually put others at risk I feel discomfort, and a need to challenge those ideas. Now, not understanding complex and subtle security issues is nothing to be ashamed of, and it's wrong (arrogant) if we decry that. What is unacceptable though, is "reckless and dismissive optimism", whether that's in systems, ostensible authorities, technologies or whatever.
    - namaria 3y ago
      Well put. I face a lot of emotional push back when people claim "this is perfectly safe because I don't see how it could be breached". There's probably a component of pride in that people assessed the situation and decided to put trust in what they believe to be sound reasoning. In adversarial dynamics, sound reasoning, as perfect as one can make it, is never enough. Defense takes trade-offs in convenience and imposes costs that people are more then willing to forego by depositing trust in an entity they can hold liable in court later.

The biometric capture angle is so blatant. Plus phisher can and absolutely will catch up to this technically. And the added bonus of lose your phone = you don't exist online. Sounds nightmarish.

jackson1442 3y ago

Biometric capture?

namaria 3y ago
The endgame here is big tech wants to own identity. Tying our online existence to biometrics managed by their devices is the path towards that future.
- rrr_oh_man 3y ago
  This comment needs to be higher up.

ngrilly 3y ago

Two factors are needed: something you have (your device) + something you are (your biometric). If you're concerned about losing your phone (I am), then you can backup your passkeys to the cloud and/or sync them with other devices (with end-to-end encryption of course, so that the backup/sync service has zero knowledge of your passkeys).

namaria 3y ago
Agreed in principle but I'd rather use something I know than let some corporation manage my biometric data.
- ngrilly 3y ago
  Your biometric data are only used locally to unlock the secure enclave on your devices. Your biometric data never leave your device and are never shared with "some corporation".
  - namaria 3y ago
    You think that there's data on a networked device that is absolutely safe? I very much doubt that. Besides, if I need a device from "some corporation" to manage my biometric data, I already depend on "some corporation" for my proving who I am online. I'd much rather stick to using a secret only I know and that I can manage with offline databases managed by open source software.
    - ngrilly 3y ago
      Do you use keep your secrets in an offline database that is on a non-networked/air-gapped device?
      - deleted 3y ago
        [deleted]
      - namaria 3y ago
        That's whataboutism. I'm not claiming my methods are unassailable. I'm disputing the notion that anyone can claim that about their methods. The key difference is, I know the weaknesses on my approach and I mitigate for them. I'm not reaching for whishful thinking. Anyone claiming security by "I don't see an attack vector" should be doubted.
        ngrilly 3y ago
        Agreed. But then what is the point you were trying to make when asking "You think that there's data on a networked device that is absolutely safe?"?
        namaria 3y ago
        Questioning your claim of > Your biometric data never leave your device and are never shared with "some corporation". Like I said, I never claimed my ways are 100% safe. I am questioning the claim that biometrics on phones is 100% safe. You realize you just whatabouted again?
nonrandomstring 3y ago
> Two factors are needed If two factors are needed. They are not always. Many (indeed most) security situations do not require two factors given the risk tradeoffs. Useful for your bank. Not so much for pizza.
- ngrilly 3y ago
  The context was to unlock your passkeys stored on your local device.

jsnell 3y ago

The biometrics don't leave your device. There is no harvesting of biometric data for other purposes happening. Passkeys can't be phished, it's literally impossible. It doesn't mean nobody's account will ever be stolen again, but it means attackers will have to switch to other mechanisms (most likely malware, whether it's stealing auth tokens or doing a man-in-the-browser attack). But that's already a win in the current situation, and will only become better over time as platforms become more malware-resistant. Passkeys aren't any different when it comes to losing your account, it's the same for all authentication factors. People forget their passwords, have their password manager database deleted, have their phones stolen, leave their job and lose their work email, etc. You always need to have a recovery path, the worst you can say about passkeys is that they don't obviate the need for account recovery.

nottorp 3y ago
> it's the same for all authentication factors. People forget their passwords, have their password manager database deleted, have their phones stolen Yes but you can at least remember the important passwords in your head. With passkeys, if you lose your devices you're dead. I don't want to rely on my devices that much. Hint: if you use passkeys for your personal Google account, do you actually think anyone at Google will be able to help you recover access when you lose them? If you're thinking of your work passwords yes, you can probably call or visit someone physically and they'll reset your access. Other than that, not bloody likely.
- jsnell 3y ago
  > Hint: if you use passkeys for your personal Google account, do you actually think anyone at Google will be able to help you recover access when you lose them? I mean, yes, but that's beside the point. What's more important is that I don't think anyone at Google would need to help me recover my account. - I have multiple trusted devices signed in already, in addition to my phone - I have a recovery phone number and recovery email set. In a situation where I lose my phone, I can get a new SIM card for the same phone number within hours. - I have my TOTP key saved on another device besides my primary phone. (Though I have to admit that I didn't turn the backup phone on last year; I used to do it twice per year, so it's possible this doesn't work any more.) - I have a set of 2FA recovery codes printed, and stored in a place where I'd know to look for them. Now, obviously basically nobody else has all of that set up. Just having printed and knowing where the recovery codes are is like 99.99th percentile level of preparedness. But most of it is also totally unnecessary. In the last 10 years I've had one phone stolen and one that stopped working suddenly and irrevocably. In both cases just the stuff that basically everyone would have (getting a new SIM in one case, an existing session from a trusted device) was enough to get the account back into a good state. Look, the people working on this stuff are neither idiots nor malicious. They understand that people lose stuff and forget stuff all the time, and they understand that the accounts can be very precious to the owners. So they try to make sure that as many people as possible have a way to recover their accounts. And as long as you haven't gone out of your way to make sure the account is unrecoverable, it'll work out fine.

sweetjuly 3y ago

How are you envisioning phishing working here? The credentials are bound to a set of origins. I don't know of any passkey managers that have an option to send a passkey to the wrong origin because it just doesn't make sense.

namaria 3y ago
I'm sorry but "I don't see it" is not a good argument in security. Hailing a technology as "exploit proof" should be considered a non-starter. Any security evaluation should be about thread models, attack surfaces, mitigation and trade-offs. Never "trust us". Not knowing how a technology could be exploited is not a feature, is a liability.
- nonrandomstring 3y ago
  I think I am seeing a real clash of mind-sets in this thread. People from a security mindset like you and I meet a lot of friction with developers who are chirpy and optimistic (and also more generally with people who want technology to be fluffy and "just work") Not that chirpy optimism is a fault at all, we all need a little more of it, but when it crosses borders into strong beliefs that actually put others at risk I feel discomfort, and a need to challenge those ideas. Now, not understanding complex and subtle security issues is nothing to be ashamed of, and it's wrong (arrogant) if we decry that. What is unacceptable though, is "reckless and dismissive optimism", whether that's in systems, ostensible authorities, technologies or whatever.
  - namaria 3y ago
    Well put. I face a lot of emotional push back when people claim "this is perfectly safe because I don't see how it could be breached". There's probably a component of pride in that people assessed the situation and decided to put trust in what they believe to be sound reasoning. In adversarial dynamics, sound reasoning, as perfect as one can make it, is never enough. Defense takes trade-offs in convenience and imposes costs that people are more then willing to forego by depositing trust in an entity they can hold liable in court later.