4 ms·

The biometrics don't leave your device. There is no harvesting of biometric data for other purposes happening. Passkeys can't be phished, it's literally imposs

by jsnell 3y ago

The biometrics don't leave your device. There is no harvesting of biometric data for other purposes happening. Passkeys can't be phished, it's literally impossible. It doesn't mean nobody's account will ever be stolen again, but it means attackers will have to switch to other mechanisms (most likely malware, whether it's stealing auth tokens or doing a man-in-the-browser attack). But that's already a win in the current situation, and will only become better over time as platforms become more malware-resistant. Passkeys aren't any different when it comes to losing your account, it's the same for all authentication factors. People forget their passwords, have their password manager database deleted, have their phones stolen, leave their job and lose their work email, etc. You always need to have a recovery path, the worst you can say about passkeys is that they don't obviate the need for account recovery.

nottorp 3y ago
> it's the same for all authentication factors. People forget their passwords, have their password manager database deleted, have their phones stolen Yes but you can at least remember the important passwords in your head. With passkeys, if you lose your devices you're dead. I don't want to rely on my devices that much. Hint: if you use passkeys for your personal Google account, do you actually think anyone at Google will be able to help you recover access when you lose them? If you're thinking of your work passwords yes, you can probably call or visit someone physically and they'll reset your access. Other than that, not bloody likely.
- jsnell 3y ago
  > Hint: if you use passkeys for your personal Google account, do you actually think anyone at Google will be able to help you recover access when you lose them? I mean, yes, but that's beside the point. What's more important is that I don't think anyone at Google would need to help me recover my account. - I have multiple trusted devices signed in already, in addition to my phone - I have a recovery phone number and recovery email set. In a situation where I lose my phone, I can get a new SIM card for the same phone number within hours. - I have my TOTP key saved on another device besides my primary phone. (Though I have to admit that I didn't turn the backup phone on last year; I used to do it twice per year, so it's possible this doesn't work any more.) - I have a set of 2FA recovery codes printed, and stored in a place where I'd know to look for them. Now, obviously basically nobody else has all of that set up. Just having printed and knowing where the recovery codes are is like 99.99th percentile level of preparedness. But most of it is also totally unnecessary. In the last 10 years I've had one phone stolen and one that stopped working suddenly and irrevocably. In both cases just the stuff that basically everyone would have (getting a new SIM in one case, an existing session from a trusted device) was enough to get the account back into a good state. Look, the people working on this stuff are neither idiots nor malicious. They understand that people lose stuff and forget stuff all the time, and they understand that the accounts can be very precious to the owners. So they try to make sure that as many people as possible have a way to recover their accounts. And as long as you haven't gone out of your way to make sure the account is unrecoverable, it'll work out fine.
  - nottorp 3y ago
    > Now, obviously basically nobody else has all of that set up. Yep, your average hooman only has the one smartphone these days and no access to a printer :)
    - jsnell 3y ago
      Well, it's a good thing that even those people will still be able to recover their account with just a new SIM or new phone. (Depending on whether they lost the phone completely, or if it just stopped working.)
      - nottorp 3y ago
        So those impenetrable keys can be reset with just a SIM clone? What's the point then?
        jsnell 3y ago
        Unlike what reading HN comments might lead you to believe, SIM swapping is neither easy nor common. It requires an insider accomplice with limited bandwidth and who is running a very real risk of getting caught. That's expensive. Just trading off the phishing risk against that would be an amazing deal for most people. (Of course not everyone, I know you'd never be fooled by a phishing attack.) But also, account recoveries are in principle rare events, as opposed to logging in which is common. So you can and should apply very different security policies to the two cases. A very simple solution to preventing SIM swapping attacks on account recovery is to just add a delay to the recovery, and notify the user about the attempt via other channels. That means that not only does the attacker need to hijack the phone number, they also need to keep control of it for days, prevent the real user from seeing the messages and blocking the recovery attempt, etc. (There's plenty one can do to decrease the friction and to increase the security on top of that, but even that simple solution gets you most of the way there.) That wouldn't be acceptable in a login scenario, you can't tell the user to wait for three days for the login to complete. But for a once per decade loss of all credentials? That's a lot more palatable.
namaria 3y ago
The thing about zero day exploits is, no one saw them coming. The whole notion of "this is perfectly secure trust us" should immediately raise warning flags.
- jsnell 3y ago
  The technology that passkeys are built on is well understood, and the deployments are building on a tech stack that's been getting deployed in browsers for well more than a decade. I don't remember hearing about any zero-day phishing vulnerabilities in FIDO or WebAuthn during all that time. But even if there had been any, zero-days have both a limited lifetime (these things get fixed quickly after being used in the wild) and a limited reach (only the most sophisticated attackers would have access to them). There are a small number of people in the world who might need to worry about being the target of a spearphishing campaign that a state-sponsored attacker is going to waste a once in a decade zero-day on. I'm fairly confident nobody in this thread, nor anyone I know in real life, is one of those people. Even taking hypothetical future zero-days into account, the reduction in specifically phishing risk is going to be absurdly large, the risk will be reduced at least by a factor of millions. That's very different from your original thinking that it was just some minor technical impediment that the attackers would automatically and irrevocably catch up to.
  - namaria 3y ago
    I might be wrong. But I think the position "this technology is unassailable" is much less tenable then "we might see future ways of breaching it and allowing for mass scale phishing that we are not anticipating". edit: as someone pointed out elsewhere in this thread, SIM swapping can defeat this, so much for security.
    - jsnell 3y ago
      Except that your initial claim was actually: > phisher can and absolutely will catch up to this technically That's not you saying that "there might be future ways of breaching it". That's you saying that it will absolutely and permanently be breached. And that's not a tenable statement at all. I already went into some detail on the probability and impact of a zero-day in the technical implementation, and you engaged with none of it, so I don't think there's much point in going to those details again.

by jsnell 3y ago

nottorp 3y ago

> it's the same for all authentication factors. People forget their passwords, have their password manager database deleted, have their phones stolen Yes but you can at least remember the important passwords in your head. With passkeys, if you lose your devices you're dead. I don't want to rely on my devices that much. Hint: if you use passkeys for your personal Google account, do you actually think anyone at Google will be able to help you recover access when you lose them? If you're thinking of your work passwords yes, you can probably call or visit someone physically and they'll reset your access. Other than that, not bloody likely.

jsnell 3y ago
> Hint: if you use passkeys for your personal Google account, do you actually think anyone at Google will be able to help you recover access when you lose them? I mean, yes, but that's beside the point. What's more important is that I don't think anyone at Google would need to help me recover my account. - I have multiple trusted devices signed in already, in addition to my phone - I have a recovery phone number and recovery email set. In a situation where I lose my phone, I can get a new SIM card for the same phone number within hours. - I have my TOTP key saved on another device besides my primary phone. (Though I have to admit that I didn't turn the backup phone on last year; I used to do it twice per year, so it's possible this doesn't work any more.) - I have a set of 2FA recovery codes printed, and stored in a place where I'd know to look for them. Now, obviously basically nobody else has all of that set up. Just having printed and knowing where the recovery codes are is like 99.99th percentile level of preparedness. But most of it is also totally unnecessary. In the last 10 years I've had one phone stolen and one that stopped working suddenly and irrevocably. In both cases just the stuff that basically everyone would have (getting a new SIM in one case, an existing session from a trusted device) was enough to get the account back into a good state. Look, the people working on this stuff are neither idiots nor malicious. They understand that people lose stuff and forget stuff all the time, and they understand that the accounts can be very precious to the owners. So they try to make sure that as many people as possible have a way to recover their accounts. And as long as you haven't gone out of your way to make sure the account is unrecoverable, it'll work out fine.
- nottorp 3y ago
  > Now, obviously basically nobody else has all of that set up. Yep, your average hooman only has the one smartphone these days and no access to a printer :)
  - jsnell 3y ago
    Well, it's a good thing that even those people will still be able to recover their account with just a new SIM or new phone. (Depending on whether they lost the phone completely, or if it just stopped working.)
    - nottorp 3y ago
      So those impenetrable keys can be reset with just a SIM clone? What's the point then?
      - jsnell 3y ago
        Unlike what reading HN comments might lead you to believe, SIM swapping is neither easy nor common. It requires an insider accomplice with limited bandwidth and who is running a very real risk of getting caught. That's expensive. Just trading off the phishing risk against that would be an amazing deal for most people. (Of course not everyone, I know you'd never be fooled by a phishing attack.) But also, account recoveries are in principle rare events, as opposed to logging in which is common. So you can and should apply very different security policies to the two cases. A very simple solution to preventing SIM swapping attacks on account recovery is to just add a delay to the recovery, and notify the user about the attempt via other channels. That means that not only does the attacker need to hijack the phone number, they also need to keep control of it for days, prevent the real user from seeing the messages and blocking the recovery attempt, etc. (There's plenty one can do to decrease the friction and to increase the security on top of that, but even that simple solution gets you most of the way there.) That wouldn't be acceptable in a login scenario, you can't tell the user to wait for three days for the login to complete. But for a once per decade loss of all credentials? That's a lot more palatable.

namaria 3y ago

The thing about zero day exploits is, no one saw them coming. The whole notion of "this is perfectly secure trust us" should immediately raise warning flags.

jsnell 3y ago
The technology that passkeys are built on is well understood, and the deployments are building on a tech stack that's been getting deployed in browsers for well more than a decade. I don't remember hearing about any zero-day phishing vulnerabilities in FIDO or WebAuthn during all that time. But even if there had been any, zero-days have both a limited lifetime (these things get fixed quickly after being used in the wild) and a limited reach (only the most sophisticated attackers would have access to them). There are a small number of people in the world who might need to worry about being the target of a spearphishing campaign that a state-sponsored attacker is going to waste a once in a decade zero-day on. I'm fairly confident nobody in this thread, nor anyone I know in real life, is one of those people. Even taking hypothetical future zero-days into account, the reduction in specifically phishing risk is going to be absurdly large, the risk will be reduced at least by a factor of millions. That's very different from your original thinking that it was just some minor technical impediment that the attackers would automatically and irrevocably catch up to.
- namaria 3y ago
  I might be wrong. But I think the position "this technology is unassailable" is much less tenable then "we might see future ways of breaching it and allowing for mass scale phishing that we are not anticipating". edit: as someone pointed out elsewhere in this thread, SIM swapping can defeat this, so much for security.
  - jsnell 3y ago
    Except that your initial claim was actually: > phisher can and absolutely will catch up to this technically That's not you saying that "there might be future ways of breaching it". That's you saying that it will absolutely and permanently be breached. And that's not a tenable statement at all. I already went into some detail on the probability and impact of a zero-day in the technical implementation, and you engaged with none of it, so I don't think there's much point in going to those details again.