3 ms·

There is a lot of FUD around passkeys. Think about all the regular (read: non-Hacker News) users out there who fall for a phishing email/SMS, or who re-use pas

by eddyg 2y ago

There is a lot of FUD around passkeys. Think about all the regular (read: non-Hacker News) users out there who fall for a phishing email/SMS, or who re-use passwords and get popped by a credential stuffing attack. Passkeys provide not only massively-improved security (they can’t be keylogged; they are linked to a specific domain so can’t be spoofed by look-alike fake login pages; they’re protected from replay attacks even if the transport mechanism is compromised), but a much nicer login flow as a bonus. Many people also don’t understand how easy it is to login from a different device: say an Android user created a passkey for a site with Chrome. Now that user needs to sign in to the same site on a Mac running Safari (where there is no passkey for the user). They can still use their Android device to login from the Mac by selecting “use a passkey from another device”. Safari will show a QR code that they scan using the Android phone, and verify with their screen lock. A one-time passkey signature is transferred to the Mac, which the website uses to authenticate the user. The two devices verify that they are in proximity with each other using Bluetooth. This cross-device, cross-operating-system mechanism of passkey authentication is standardized under FIDO; no additional work is needed by the website to enable this login flow. If you are “anti-Apple” or “anti-Google” and have strong aversions to them securely backing up things like passkeys (again, think of all the non-Hacker News readers where this is not the case), then go ahead and continue to use passwords. But we should be encouraging our parents, grandparents, siblings, friends, etc. to embrace passkeys to make all of their accounts more secure and phishing-resistant. The more passkey FUD they see, the longer people will have to deal with annoying (and still insecure) SMS codes, the longer passwords will be stolen/re-used, etc.

threatofrain 2y ago
Why not encourage friends and family to use password managers instead?
- lolinder 2y ago
  Why not encourage them to use password managers with passkeys? All the major players offer them.
  - ndriscoll 2y ago
    Because a standard with device attestation should be rejected outright, real world implementations use it as a form of lock-in, and password managers are more ubiquitously available anyway (e.g. I can't use passkeys on my primary computer, which doesn't have the necessary hardware). This would be different if browsers added software implementations with easy export first and removed the attestation part of the standard, but they didn't.
    - TheNewsIsHere 2y ago
      I see device attestation is a different issue. Passkeys don't have to have device attestation. FIDO2 has long-supported this already in the form of AAGUIDs [1] which do address a valid use case of wanting to restrict the kinds of authenticators that can be used. For example if you have FIPS requirements. I do agree that passkeys, implemented in software, should categorically prohibit attestation. I think the cost of needing attestation should be that you have to require/invest in the actual hardware tokens. [1] https://support.yubico.com/hc/en-us/articles/360016648959-YubiKey-Hardware-FIDO2-AAGUIDs https://support.yubico.com/hc/en-us/articles/360016648959-Yu...
      - hedora 2y ago
        Attestation is going to be abused. The only thing it is useful for is establishing centralized control over client software. That'll eventually imply that all clients are user hostile, probably both from a surveillance capitalism perspective, and from a government surveillance perspective. This isn't a theoretical concerns. All of the groundwork (except device attestation at login) has already been laid: - The US CLOUD act already says that service providers have to provide the government with access to all information they're technically capable of accessing. - Microsoft's existing client debugging mechanisms allow them to pull files from windows machines with management approval. Once there's a de facto ban on running web browser binaries that aren't produced by a FAANG (established by the passkey standard), all the vendors have to do is add MS-style telemetry / debugging, and it's game over. In all likelihood, there will be legislation in a few years that forces any holdouts to implement that sort of a mechanism.

by eddyg 2y ago

threatofrain 2y ago

Why not encourage friends and family to use password managers instead?

lolinder 2y ago
Why not encourage them to use password managers with passkeys? All the major players offer them.
- ndriscoll 2y ago
  Because a standard with device attestation should be rejected outright, real world implementations use it as a form of lock-in, and password managers are more ubiquitously available anyway (e.g. I can't use passkeys on my primary computer, which doesn't have the necessary hardware). This would be different if browsers added software implementations with easy export first and removed the attestation part of the standard, but they didn't.
  - TheNewsIsHere 2y ago
    I see device attestation is a different issue. Passkeys don't have to have device attestation. FIDO2 has long-supported this already in the form of AAGUIDs [1] which do address a valid use case of wanting to restrict the kinds of authenticators that can be used. For example if you have FIPS requirements. I do agree that passkeys, implemented in software, should categorically prohibit attestation. I think the cost of needing attestation should be that you have to require/invest in the actual hardware tokens. [1] https://support.yubico.com/hc/en-us/articles/360016648959-YubiKey-Hardware-FIDO2-AAGUIDs https://support.yubico.com/hc/en-us/articles/360016648959-Yu...
    - hedora 2y ago
      Attestation is going to be abused. The only thing it is useful for is establishing centralized control over client software. That'll eventually imply that all clients are user hostile, probably both from a surveillance capitalism perspective, and from a government surveillance perspective. This isn't a theoretical concerns. All of the groundwork (except device attestation at login) has already been laid: - The US CLOUD act already says that service providers have to provide the government with access to all information they're technically capable of accessing. - Microsoft's existing client debugging mechanisms allow them to pull files from windows machines with management approval. Once there's a de facto ban on running web browser binaries that aren't produced by a FAANG (established by the passkey standard), all the vendors have to do is add MS-style telemetry / debugging, and it's game over. In all likelihood, there will be legislation in a few years that forces any holdouts to implement that sort of a mechanism.