7 ms·

Will passkeys ever replace passwords? Can they? Here's why they should

37 points by rntn 2y ago

Brandontheresa 2y ago
[flagged]
terrag344 2y ago
[dead]
deleted 2y ago
[deleted]
Beeky67 2y ago
I caught my husband so many times through his chats and all about cheating on me and when i told him he always claims that he has changed and all. right now he hides his phone from me and i still guess he is cheating cause i could not break into his phone any more so i was referred to a hacker named FRED who i ran to for help and this hacker was able to break into his phone and proved me with the access to my husband phone without my spouse knowing about the hack. Right in my phone I have all my husband's daily activities . I got to read all his chats, texts, calls, WhatsApp, Facebook, and many more. This hacker is really great, thank you. Did you find this review helpful? contact him via Gmail fredvalcyberghost@gmail.com and you can text,call him on +15177981808 or +19782951763
Beeky67 2y ago
I caught my husband so many times through his chats and all about cheating on me and when i told him he always claims that he has changed and all. right now he hides his phone from me and i still guess he is cheating cause i could not break into his phone any more so i was referred to a hacker named FRED who i ran to for help and this hacker was able to break into his phone and proved me with the access to my husband phone without my spouse knowing about the hack. Right in my phone I have all my husband's daily activities . I got to read all his chats, texts, calls, WhatsApp, Facebook, and many more. This hacker is really great, thank you. Did you find this review helpful? contact him via Gmail FREDVAL CYBERGHOST @ GMA IL . COM and you can text,call him on +..1..51..77..98..18..08 or +..1..97..82..95..17..63
Beeky67 2y ago
I needed a fast response, I read about Fred Hacker and I actually saw a testimony like this about him and I decided to try him out. His approach alone showed his seriousness and professionalism,this hacker is a genius and highly recommended by a lot of people,it was very easy for him to help me spy on my spouse remotely for some token….I was very happy with the service he rendered I came here to testify for what he did for me and I’ll always be grateful to him…the least I could offer is referring him to you guys contact him on fredvalcyberghost@gmail.com and you can text,call him on +15177981808 or +19782951763
akimbostrawman 2y ago
U2F > passkey
- tptacek 2y ago
  They're the same standards.
  - hbogert 2y ago
    no right? passkeys are discoverable CTAP2, as in, no primary login required. U2F is 2nd factor and you still have to do a primary login first.
    - tptacek 2y ago
      I may be too hung up on the FIDO2-ness of it all, and not paying enough attention to what they're trying to say about the particular configurations of the protocol are.
    - FreakLegion 2y ago
      Right, passkeys are basically 1) a superset (FIDO2) of U2F that includes a passwordless option, and 2) software or "platform" rather than hardware or "roaming". If akimbostrawman was knocking the passwordless part I agree. Partly for the obvious technical reasons, but also because in enterprise security 'passwordless' is being misused to market push-equivalent auth as 'phishing-resistant', and a lot of companies are falling for it. If akimbostrawman was knocking the software part I disagree, because outside of companies like Google or Palantir IT teams aren't stoked about managing hardware tokens for tens or hundreds of thousands of people. The best option is the one people will actually use, and that's going to be passkeys.
      - akimbostrawman 2y ago
        >knocking the passwordless part yes that's what I meant. The gain in convinence does not outweigh the disadvantage in security for me.
      - 2y ago
Animats 2y ago
Any "password manager" system from a service which disclaims responsibility for security or which can cancel the account is worse than useless. It's dangerous. A password manager run by a bank, with the bank standing behind it, might be worth something.
- skybrian 2y ago
  Yes, a password manager is a single point of failure, but I don’t see it as particularly dangerous, provided you have more than one. For any locked door, you need more than one key and they should be independent. If you have independence, they serve as backups for each other.
  - NoMoreNicksLeft 2y ago
    How is a password manager a single point of failure? Mine syncs between multiple devices. I've had the same primary password for a decade now, and I've already forgotten it... I can't reproduce it without putting fingers to keyboard. It's the one human-chosen password that I ever made strong... 30-some characters, pretty fucking random. My wife knows it too. But now you'll tell me that Google is more trustworthy than her.
    - skybrian 2y ago
      It depends on the password manager you use. If you’re using Google or Apple’s password manager, you’re probably okay if you lose a device, but the one risk you can’t fix without having another password manager is if they cancel your account. If you use both of them, though, that covers it. Passkey syncing across password managers isn’t implemented yet, so it means manually adding an account in both places if you go that route. Hopefully that will be fixed by a new standard.
      - NoMoreNicksLeft 2y ago
        > It depends on the password manager you use. If you’re using Google or Apple’s password manager, Are those even really password managers? I used to use 1Password, but got tired of only being able to sync through iCloud. About a year in, I switched to Enpass since it did webdav. Biggest gripe is that there is no native Xbox app with it, make it a pain to track some of the kid's game passwords.
slimsag 2y ago
The article seems to focus on YubiKeys (even despite using a mac device), but at least in the Apple ecosystem the state of the art is far ahead of plugging in a thumb drive style device IMO. When I navigate to various websites that support Passkeys these days - Lowes, Home Depot, and handfuls of others - on iPhone (firefox) I am prompted with 'Do you want to use Face ID to sign in?' If I do the same on macOS (firefox or safari, I'm sure Chrome does it too.), I am similarly prompted 'Do you want to sign in using a passkey?' and it gives me steps to use my mac's fingerprint reader or delegate to the iPhone Face ID to sign in on my Mac. Combine that with Apple offering to use a private/hidden email address for signing up to the service in the first place and forward mail to your real email, plus the auto-generated secure passwords stored in the new Apple password manager.. and it's a pretty magical and secure experience as a user.
- cyanydeez 2y ago
  So, anyone who can get your face on camera can access faceId?
  - maliker 2y ago
    It does a 3d scan of the face, so you can't crack it with an image or video.
    - beeflet 2y ago
      it seems kind of bogus to me. You're going from using a cryptographicially secure device to using biometric data. Biometric data can be copied and faked.
      - AnotherGoodName 2y ago
        Phones have a TPM just like a USB security key. The face id on a phone based passkey is just the equivalent of pushing the button on the yubikeys. So they need the physical device. You cannot clone the TPM parts that are in newer phones. The faceID just unlocks that hardware on your phone in the same way pushing the button on a yubikey sends the key up.
Spivak 2y ago
Passkeys are great, the implementation where they're intentionally kept from the user and managed by a 3rd party OS vendor is disappointing. Going from "it's an okay supplementary auth mechanism" to "password manager for the masses" would be so easy for Apple and Google, just let the users access and export them dammit! People would call a password manager that considered its user to be an adversary and refused to show the owner their own passwords mad but that's what we have. Passkeys in my Bitwarden strike the right balance for me— I can use them everywhere, they can be backed up, they're vendor agnostic.
hooverd 2y ago
No, until the Passkeys people figure out cross-platform exports! I love Passkeys but hate that part of the spec.
- microtonal 2y ago
  1Password supports passkeys + sync on all supported platforms (macOS, Windows, Linux, iOS, Android). (I'm still using Apple's implementation, because I trust them more to get the security right.) Edit: I realize now you perhaps mean exporting to other apps.
  - SpanishBrowne 2y ago
    run into issues very quickly once you get outside of "computers" how do i log into passkey protected Paypal on my nintendo switch? how do i log into my Sony PlayStation account on my PS5?
- deleted 2y ago
  [deleted]
- socratics 2y ago
  This is being worked on: https://fidoalliance.org/fido-alliance-publishes-new-specifications-to-promote-user-choice-and-enhanced-ux-for-passkeys/ https://fidoalliance.org/fido-alliance-publishes-new-specifi...
jvanderbot 2y ago
Passkeys won't fully replace passwords. There's one glaring reason why: theft or seizure. You do not currently need to unlock your phone, computer, or internet accounts for law enforcement though the legality is fluid. But with a passkey I cannot imagine law enforcement exercising any restraint. The same goes for any one else seeking access to your accounts or computer. Sure, there are other ways to get that information but I'd imagine it's better to let them use those.
- microtonal 2y ago
  I am not sure what you are saying. If you use Apple's passkey implementation, you need to unlock your computer and when using a passkey confirm with Touch ID (or Face ID on iPhone). So, if you don't need to unlock your phone, computer, or internet accounts for law enforcement, they also can't get your passkeys. Using a USB stick as a passkey without authentication is just a bad idea. Ps. passkeys are end-to-end encrypted on Apple devices using iCloud keychain. Sure, Apple could push a software update that exfiltrates your passkeys, but in the end you need a trust anchor somewhere in the chain.
  - TeMPOraL 2y ago
    I think what they're saying is that when someone wants to use your password-locked device, they can threaten you with jail/obstruction of justice/beating/bullet, depending on where on the Law vs Chaos axis of the alignment chart they fall; you will then give them your password, and escape the extremely dangerous situation you found yourself in. With passkeys, unfortunately, they'll have to keep you around for all their exploits, and may need to regularly re-threaten/beat you into submission. In certain scenarios, there's such thing as too much security.
  - NewJazz 2y ago
    Legally, you may not be compelled to provide a password. But the same is not quite as true for biometric attestations. First, a cop can physically use your face or finger to unlock your device without your consent. Second, legally they are allowed to compel you to unlock devices with these measures. https://reason.com/2024/04/19/appeals-court-rules-that-cops-can-physically-make-you-unlock-your-phone/ https://reason.com/2024/04/19/appeals-court-rules-that-cops-... https://www.eff.org/press/releases/eff-supreme-court-fifth-amendment-protects-people-being-forced-enter-or-hand-over https://www.eff.org/press/releases/eff-supreme-court-fifth-a...
bradley13 2y ago
This. I figured passkeys had had enough time to mature, so I would look at starting the transition. Nope. Support is very uneven and - as the article says - needlessly confusing. I'll wait another year. And I certainly would not inflict the current mess on a nontechnical person.
ianburrell 2y ago
Unfortunately, the design of passkeys push them to password managers instead of physical tokens. Physical passkeys are dangerous because you can lose them. The solution would be to add multiple keys, but that is hard to do. It would be nice to be able to add multiple keys at once. Or add a key that isn't present to have off-site backup. The result is that need a password manager to store the passkeys. Then passkeys turn into better, more annoying, non-phishable passwords.
- jauntywundrkind 2y ago
  The general un-user-manageability of keys makes passkeys such a failure to start. Ideally I'd want to be able to sign up and add three keys right away, backed by different devices stored in different places. At the moment though I'd need to relay around one key & go through each websites custom flow to add the next key. This isn't going to work. This isn't viable. It's not enough. If users could manage/export their own keys maybe they can send newly provisioned keys to off-site backups. But we still have to go navigate and provision extra keys on your website. There needs to be a way to present/enroll multiple keys all at once. And ideally standard endpoints for further management of passkeys on sites. We are already seeing some very minimal client/website management-ish coordinations forming. WebAuthn is adding signals, so the client will know it can de-list some Passkeys that go inactive. https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAB0jio%3DK91NiFqx%3DO1uCtCHRKdfuqc%3Dp2HOmEg_eQ7xXFfm9Xg%40mail.gmail.com https://groups.google.com/a/chromium.org/d/msgid/blink-dev/C...
GauntletWizard 2y ago
Pass keys are a solution that will probably win, because it's very attractive to the device developers. They're portable, from one device to another, but only using the developer's private apis. U2F is better cryptography - the device key never leaves, but this is precisely what makes it hard for users. Losing a U2F key is risky, yet you have to carry it around with you. You can do what I do - Have a second U2F device registered everywhere, so that if the travel one is lost, But I just experienced the second pain- I had a phone die on me. This seriously messed up my life for a week - every provider that used phone verification or text verification was inaccessible. As developers, I beg you not to go to exclusive Passkey support. Keep UN/PW/U2F support around, and support multiple second factors. Really, the problem is as simple as this: there's way too many bad actors, they have knowledge of tech, and little risk.
sedatk 2y ago
So far, my experience with passkeys has been disappointing: - Many major websites implement passkeys in a hybrid way that you can keep logging in using your password (Amazon comes to mind). That actually kills the greatest security feature of passkeys: resistance against phishing. As a counterexample, Microsoft has implemented it as "passwordless", and kills password login fully when you opt-in, but that seems to be the minority of the platforms right now. - UX is worse. On almost all login forms, you have to click on "Sign in with a passkey" button to go through an extra step in the authentication flow, making passkey signing option more work than a password login with a password manager. That also means you must know if you had enabled passkeys on that website. There is no familiar UI design for that either, you have to explore every login form to find out its passkey mode. Password managers like 1Password can detect passkey sign-in options and show up a popup to log you in, but that's mostly a case-by-case hack, as I understand. - Despite that the authentication mechanism is very well-defined, the account recovery flow isn't. I don't know how much risk I'm putting myself into by signing into passkey flow. If I login to everything using a passkey, including my email, how much risk am I getting myself into if I lose my passkey provider account? How do I recover my account then? Is that flow also phishing/scam resistant? - The story of 2FA is bleak. Now that I have a strong authentication scheme, can I safely do away with 2FA? I can't really tell anymore because the risk model has more dependencies now. If 2FA isn't eliminated, and password login is still allowed, what do passkeys gain us by any metric?
deleted 2y ago
[deleted]
discardedrefuse 2y ago
This article makes a good point about sites using passkeys alongside passwords, which basically renders them useless. But after that, it starts to read like AI slop. The article also doesn't discuss how Google and Apple have decided to weaponize passkeys for their vendor lock-in wars. Google and Apple can fuck right off. How many stories have been posted here on HN about someone getting locked out of all their Google services for some stupid reason with zero recourse? Never put any of your eggs in that kind of basket. (And yes, I know there are alternatives. But normal users will never know about those.)
ninalanyon 2y ago
According to the definition linked to by the Register article the passkey for a site is stored on my device. How do I log in to the site from a different device? I have a Linux laptop, a Chromebook, and Android tablet, and two Android mobile. How does storing the passkey on one of these devices work?
- socratics 2y ago
  Using a cross-platform password manager, like Bitwarden or 1Password, would work in your case.
  - SpanishBrowne 2y ago
    how do i log into passkey protected Paypal on my nintendo switch? how do i log into my Sony PlayStation account on my PS5?
tonymet 2y ago
Please take the added complexity and combinations seriously. App developers need to update their testing procedures to test all the combinations of login approaches over many different implementations (browsers, operating systems, hardware tokens, local vs remote, etc). The traditional username, password flow could be tested once and work nearly everywhere. As an example, I’ve been helping QA a webauthn issue on Wikipedia, that leads to potential account lock-out, due to passkeys not getting published to the various wiki sites completely. encountered <https://phabricator.wikimedia.org/T358771 https://phabricator.wikimedia.org/T358771> Fewer than 100 Wikipedia editors use webauthn , so the issue doesn’t receive much attention. When implementing webauthn, QA testing , customer telemetry, customer onboarding & customer support all need much more investment to provide the same level of service.
miles 2y ago
The Problem with Passkeys https://bulwark.id/blog/problem-with-passkeys https://bulwark.id/blog/problem-with-passkeys https://news.ycombinator.com/item?id=35496213 https://news.ycombinator.com/item?id=35496213 There’s a big problem with Apple and Google’s plans to nix passwords https://www.fastcompany.com/90755838/theres-a-big-problem-with-apple-and-googles-plans-to-nix-passwords https://www.fastcompany.com/90755838/theres-a-big-problem-wi... Passkeys: A Shattered Dream https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/ https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt... https://news.ycombinator.com/item?id=40165998 https://news.ycombinator.com/item?id=40165998
Elizabeth0147 2y ago
[dead]
Elizabeth0147 2y ago
[dead]
Lutherevelyn 2y ago
You can track your husband’s phone without knowing it effectively through TOMCYBERGHOST@GMAIL.COM. It’s fast, safe and easy. You get frequent updates about fits various activities and movements. If he really cheated, you will need quick proof
Larrygregory 2y ago
[dead]
dejongd421 2y ago
[dead]
hudsonpeter0147 2y ago
I’m writing this review to sincerely thank Galaxy ethical tech Recovery Services for their exceptional work in assisting me in getting my lost Bitcoin investment back. I lost $250,000 in cryptocurrencies as a result of falling victim to an online hoax, which was a severe emotional and financial blow. Fortunately, when looking through my options online, I found Galaxy ethical tech Recovery Services. I made the decision to get in touch, and after our initial conversation, I knew I was in good hands. In addition to being competent, the staff at Galaxy ethical tech Recovery Services was sympathetic and recognized the pain I was experiencing. They guided me through every stage of the procedure, outlining their plans and the actions they would take to get my money back. I valued their openness and commitment, which increased my confidence in the healing process. I was astounded by how hard the staff worked to find my investment in such a short amount of time. I was informed on a regular basis, and I could see they were dedicated to their goal. I was shocked to learn that Galaxy ethical tech had successfully retrieved my $250,000 Bitcoin investment from the swindle artist! The relief and joy I experienced upon getting my money back are beyond words. Galaxy ethical tech Recovery In addition to helping me recover my financial loss, gave me hope that justice would be served in the face of deceit. Throughout the entire process, their professionalism, knowledge, and sincere concern for their clients were clear to see. Contact them today via email: (galaxyethicaltech@mail.com). what app; +15072712442
wolfclara 2y ago
[dead]
Ellabecker5 2y ago
[dead]
frankroselyn 2y ago
[dead]
ellenmoore 2y ago
[dead]
phylliswayne 2y ago
[dead]
Kurtcheng 2y ago
[dead]
terrymcghee010 2y ago
[flagged]

37 points by rntn 2y ago

Brandontheresa 2y ago

[flagged]

terrag344 2y ago

[dead]

deleted 2y ago

[deleted]

Beeky67 2y ago

I caught my husband so many times through his chats and all about cheating on me and when i told him he always claims that he has changed and all. right now he hides his phone from me and i still guess he is cheating cause i could not break into his phone any more so i was referred to a hacker named FRED who i ran to for help and this hacker was able to break into his phone and proved me with the access to my husband phone without my spouse knowing about the hack. Right in my phone I have all my husband's daily activities . I got to read all his chats, texts, calls, WhatsApp, Facebook, and many more. This hacker is really great, thank you. Did you find this review helpful? contact him via Gmail fredvalcyberghost@gmail.com and you can text,call him on +15177981808 or +19782951763

Beeky67 2y ago

I caught my husband so many times through his chats and all about cheating on me and when i told him he always claims that he has changed and all. right now he hides his phone from me and i still guess he is cheating cause i could not break into his phone any more so i was referred to a hacker named FRED who i ran to for help and this hacker was able to break into his phone and proved me with the access to my husband phone without my spouse knowing about the hack. Right in my phone I have all my husband's daily activities . I got to read all his chats, texts, calls, WhatsApp, Facebook, and many more. This hacker is really great, thank you. Did you find this review helpful? contact him via Gmail FREDVAL CYBERGHOST @ GMA IL . COM and you can text,call him on +..1..51..77..98..18..08 or +..1..97..82..95..17..63

Beeky67 2y ago

I needed a fast response, I read about Fred Hacker and I actually saw a testimony like this about him and I decided to try him out. His approach alone showed his seriousness and professionalism,this hacker is a genius and highly recommended by a lot of people,it was very easy for him to help me spy on my spouse remotely for some token….I was very happy with the service he rendered I came here to testify for what he did for me and I’ll always be grateful to him…the least I could offer is referring him to you guys contact him on fredvalcyberghost@gmail.com and you can text,call him on +15177981808 or +19782951763

akimbostrawman 2y ago

U2F > passkey

tptacek 2y ago
They're the same standards.
- hbogert 2y ago
  no right? passkeys are discoverable CTAP2, as in, no primary login required. U2F is 2nd factor and you still have to do a primary login first.
  - tptacek 2y ago
    I may be too hung up on the FIDO2-ness of it all, and not paying enough attention to what they're trying to say about the particular configurations of the protocol are.
  - FreakLegion 2y ago
    Right, passkeys are basically 1) a superset (FIDO2) of U2F that includes a passwordless option, and 2) software or "platform" rather than hardware or "roaming". If akimbostrawman was knocking the passwordless part I agree. Partly for the obvious technical reasons, but also because in enterprise security 'passwordless' is being misused to market push-equivalent auth as 'phishing-resistant', and a lot of companies are falling for it. If akimbostrawman was knocking the software part I disagree, because outside of companies like Google or Palantir IT teams aren't stoked about managing hardware tokens for tens or hundreds of thousands of people. The best option is the one people will actually use, and that's going to be passkeys.
    - akimbostrawman 2y ago
      >knocking the passwordless part yes that's what I meant. The gain in convinence does not outweigh the disadvantage in security for me.
    - 2y ago

Animats 2y ago

Any "password manager" system from a service which disclaims responsibility for security or which can cancel the account is worse than useless. It's dangerous. A password manager run by a bank, with the bank standing behind it, might be worth something.

skybrian 2y ago
Yes, a password manager is a single point of failure, but I don’t see it as particularly dangerous, provided you have more than one. For any locked door, you need more than one key and they should be independent. If you have independence, they serve as backups for each other.
- NoMoreNicksLeft 2y ago
  How is a password manager a single point of failure? Mine syncs between multiple devices. I've had the same primary password for a decade now, and I've already forgotten it... I can't reproduce it without putting fingers to keyboard. It's the one human-chosen password that I ever made strong... 30-some characters, pretty fucking random. My wife knows it too. But now you'll tell me that Google is more trustworthy than her.
  - skybrian 2y ago
    It depends on the password manager you use. If you’re using Google or Apple’s password manager, you’re probably okay if you lose a device, but the one risk you can’t fix without having another password manager is if they cancel your account. If you use both of them, though, that covers it. Passkey syncing across password managers isn’t implemented yet, so it means manually adding an account in both places if you go that route. Hopefully that will be fixed by a new standard.
    - NoMoreNicksLeft 2y ago
      > It depends on the password manager you use. If you’re using Google or Apple’s password manager, Are those even really password managers? I used to use 1Password, but got tired of only being able to sync through iCloud. About a year in, I switched to Enpass since it did webdav. Biggest gripe is that there is no native Xbox app with it, make it a pain to track some of the kid's game passwords.

slimsag 2y ago

The article seems to focus on YubiKeys (even despite using a mac device), but at least in the Apple ecosystem the state of the art is far ahead of plugging in a thumb drive style device IMO. When I navigate to various websites that support Passkeys these days - Lowes, Home Depot, and handfuls of others - on iPhone (firefox) I am prompted with 'Do you want to use Face ID to sign in?' If I do the same on macOS (firefox or safari, I'm sure Chrome does it too.), I am similarly prompted 'Do you want to sign in using a passkey?' and it gives me steps to use my mac's fingerprint reader or delegate to the iPhone Face ID to sign in on my Mac. Combine that with Apple offering to use a private/hidden email address for signing up to the service in the first place and forward mail to your real email, plus the auto-generated secure passwords stored in the new Apple password manager.. and it's a pretty magical and secure experience as a user.

cyanydeez 2y ago
So, anyone who can get your face on camera can access faceId?
- maliker 2y ago
  It does a 3d scan of the face, so you can't crack it with an image or video.
  - beeflet 2y ago
    it seems kind of bogus to me. You're going from using a cryptographicially secure device to using biometric data. Biometric data can be copied and faked.
    - AnotherGoodName 2y ago
      Phones have a TPM just like a USB security key. The face id on a phone based passkey is just the equivalent of pushing the button on the yubikeys. So they need the physical device. You cannot clone the TPM parts that are in newer phones. The faceID just unlocks that hardware on your phone in the same way pushing the button on a yubikey sends the key up.

Spivak 2y ago

Passkeys are great, the implementation where they're intentionally kept from the user and managed by a 3rd party OS vendor is disappointing. Going from "it's an okay supplementary auth mechanism" to "password manager for the masses" would be so easy for Apple and Google, just let the users access and export them dammit! People would call a password manager that considered its user to be an adversary and refused to show the owner their own passwords mad but that's what we have. Passkeys in my Bitwarden strike the right balance for me— I can use them everywhere, they can be backed up, they're vendor agnostic.

hooverd 2y ago

No, until the Passkeys people figure out cross-platform exports! I love Passkeys but hate that part of the spec.

microtonal 2y ago
1Password supports passkeys + sync on all supported platforms (macOS, Windows, Linux, iOS, Android). (I'm still using Apple's implementation, because I trust them more to get the security right.) Edit: I realize now you perhaps mean exporting to other apps.
- SpanishBrowne 2y ago
  run into issues very quickly once you get outside of "computers" how do i log into passkey protected Paypal on my nintendo switch? how do i log into my Sony PlayStation account on my PS5?
deleted 2y ago
[deleted]
socratics 2y ago
This is being worked on: https://fidoalliance.org/fido-alliance-publishes-new-specifications-to-promote-user-choice-and-enhanced-ux-for-passkeys/ https://fidoalliance.org/fido-alliance-publishes-new-specifi...

jvanderbot 2y ago

Passkeys won't fully replace passwords. There's one glaring reason why: theft or seizure. You do not currently need to unlock your phone, computer, or internet accounts for law enforcement though the legality is fluid. But with a passkey I cannot imagine law enforcement exercising any restraint. The same goes for any one else seeking access to your accounts or computer. Sure, there are other ways to get that information but I'd imagine it's better to let them use those.

microtonal 2y ago
I am not sure what you are saying. If you use Apple's passkey implementation, you need to unlock your computer and when using a passkey confirm with Touch ID (or Face ID on iPhone). So, if you don't need to unlock your phone, computer, or internet accounts for law enforcement, they also can't get your passkeys. Using a USB stick as a passkey without authentication is just a bad idea. Ps. passkeys are end-to-end encrypted on Apple devices using iCloud keychain. Sure, Apple could push a software update that exfiltrates your passkeys, but in the end you need a trust anchor somewhere in the chain.
- TeMPOraL 2y ago
  I think what they're saying is that when someone wants to use your password-locked device, they can threaten you with jail/obstruction of justice/beating/bullet, depending on where on the Law vs Chaos axis of the alignment chart they fall; you will then give them your password, and escape the extremely dangerous situation you found yourself in. With passkeys, unfortunately, they'll have to keep you around for all their exploits, and may need to regularly re-threaten/beat you into submission. In certain scenarios, there's such thing as too much security.
- NewJazz 2y ago
  Legally, you may not be compelled to provide a password. But the same is not quite as true for biometric attestations. First, a cop can physically use your face or finger to unlock your device without your consent. Second, legally they are allowed to compel you to unlock devices with these measures. https://reason.com/2024/04/19/appeals-court-rules-that-cops-can-physically-make-you-unlock-your-phone/ https://reason.com/2024/04/19/appeals-court-rules-that-cops-... https://www.eff.org/press/releases/eff-supreme-court-fifth-amendment-protects-people-being-forced-enter-or-hand-over https://www.eff.org/press/releases/eff-supreme-court-fifth-a...

bradley13 2y ago

This. I figured passkeys had had enough time to mature, so I would look at starting the transition. Nope. Support is very uneven and - as the article says - needlessly confusing. I'll wait another year. And I certainly would not inflict the current mess on a nontechnical person.

ianburrell 2y ago

Unfortunately, the design of passkeys push them to password managers instead of physical tokens. Physical passkeys are dangerous because you can lose them. The solution would be to add multiple keys, but that is hard to do. It would be nice to be able to add multiple keys at once. Or add a key that isn't present to have off-site backup. The result is that need a password manager to store the passkeys. Then passkeys turn into better, more annoying, non-phishable passwords.

jauntywundrkind 2y ago
The general un-user-manageability of keys makes passkeys such a failure to start. Ideally I'd want to be able to sign up and add three keys right away, backed by different devices stored in different places. At the moment though I'd need to relay around one key & go through each websites custom flow to add the next key. This isn't going to work. This isn't viable. It's not enough. If users could manage/export their own keys maybe they can send newly provisioned keys to off-site backups. But we still have to go navigate and provision extra keys on your website. There needs to be a way to present/enroll multiple keys all at once. And ideally standard endpoints for further management of passkeys on sites. We are already seeing some very minimal client/website management-ish coordinations forming. WebAuthn is adding signals, so the client will know it can de-list some Passkeys that go inactive. https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAB0jio%3DK91NiFqx%3DO1uCtCHRKdfuqc%3Dp2HOmEg_eQ7xXFfm9Xg%40mail.gmail.com https://groups.google.com/a/chromium.org/d/msgid/blink-dev/C...

GauntletWizard 2y ago

Pass keys are a solution that will probably win, because it's very attractive to the device developers. They're portable, from one device to another, but only using the developer's private apis. U2F is better cryptography - the device key never leaves, but this is precisely what makes it hard for users. Losing a U2F key is risky, yet you have to carry it around with you. You can do what I do - Have a second U2F device registered everywhere, so that if the travel one is lost, But I just experienced the second pain- I had a phone die on me. This seriously messed up my life for a week - every provider that used phone verification or text verification was inaccessible. As developers, I beg you not to go to exclusive Passkey support. Keep UN/PW/U2F support around, and support multiple second factors. Really, the problem is as simple as this: there's way too many bad actors, they have knowledge of tech, and little risk.

sedatk 2y ago

So far, my experience with passkeys has been disappointing: - Many major websites implement passkeys in a hybrid way that you can keep logging in using your password (Amazon comes to mind). That actually kills the greatest security feature of passkeys: resistance against phishing. As a counterexample, Microsoft has implemented it as "passwordless", and kills password login fully when you opt-in, but that seems to be the minority of the platforms right now. - UX is worse. On almost all login forms, you have to click on "Sign in with a passkey" button to go through an extra step in the authentication flow, making passkey signing option more work than a password login with a password manager. That also means you must know if you had enabled passkeys on that website. There is no familiar UI design for that either, you have to explore every login form to find out its passkey mode. Password managers like 1Password can detect passkey sign-in options and show up a popup to log you in, but that's mostly a case-by-case hack, as I understand. - Despite that the authentication mechanism is very well-defined, the account recovery flow isn't. I don't know how much risk I'm putting myself into by signing into passkey flow. If I login to everything using a passkey, including my email, how much risk am I getting myself into if I lose my passkey provider account? How do I recover my account then? Is that flow also phishing/scam resistant? - The story of 2FA is bleak. Now that I have a strong authentication scheme, can I safely do away with 2FA? I can't really tell anymore because the risk model has more dependencies now. If 2FA isn't eliminated, and password login is still allowed, what do passkeys gain us by any metric?

deleted 2y ago

[deleted]

discardedrefuse 2y ago

This article makes a good point about sites using passkeys alongside passwords, which basically renders them useless. But after that, it starts to read like AI slop. The article also doesn't discuss how Google and Apple have decided to weaponize passkeys for their vendor lock-in wars. Google and Apple can fuck right off. How many stories have been posted here on HN about someone getting locked out of all their Google services for some stupid reason with zero recourse? Never put any of your eggs in that kind of basket. (And yes, I know there are alternatives. But normal users will never know about those.)

ninalanyon 2y ago

According to the definition linked to by the Register article the passkey for a site is stored on my device. How do I log in to the site from a different device? I have a Linux laptop, a Chromebook, and Android tablet, and two Android mobile. How does storing the passkey on one of these devices work?

socratics 2y ago
Using a cross-platform password manager, like Bitwarden or 1Password, would work in your case.
- SpanishBrowne 2y ago
  how do i log into passkey protected Paypal on my nintendo switch? how do i log into my Sony PlayStation account on my PS5?

tonymet 2y ago

Please take the added complexity and combinations seriously. App developers need to update their testing procedures to test all the combinations of login approaches over many different implementations (browsers, operating systems, hardware tokens, local vs remote, etc). The traditional username, password flow could be tested once and work nearly everywhere. As an example, I’ve been helping QA a webauthn issue on Wikipedia, that leads to potential account lock-out, due to passkeys not getting published to the various wiki sites completely. encountered <https://phabricator.wikimedia.org/T358771 https://phabricator.wikimedia.org/T358771> Fewer than 100 Wikipedia editors use webauthn , so the issue doesn’t receive much attention. When implementing webauthn, QA testing , customer telemetry, customer onboarding & customer support all need much more investment to provide the same level of service.

miles 2y ago

The Problem with Passkeys https://bulwark.id/blog/problem-with-passkeys https://bulwark.id/blog/problem-with-passkeys https://news.ycombinator.com/item?id=35496213 https://news.ycombinator.com/item?id=35496213 There’s a big problem with Apple and Google’s plans to nix passwords https://www.fastcompany.com/90755838/theres-a-big-problem-with-apple-and-googles-plans-to-nix-passwords https://www.fastcompany.com/90755838/theres-a-big-problem-wi... Passkeys: A Shattered Dream https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/ https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt... https://news.ycombinator.com/item?id=40165998 https://news.ycombinator.com/item?id=40165998

Elizabeth0147 2y ago

[dead]

Elizabeth0147 2y ago

[dead]

Lutherevelyn 2y ago

You can track your husband’s phone without knowing it effectively through TOMCYBERGHOST@GMAIL.COM. It’s fast, safe and easy. You get frequent updates about fits various activities and movements. If he really cheated, you will need quick proof

Larrygregory 2y ago

[dead]

dejongd421 2y ago

[dead]

hudsonpeter0147 2y ago

I’m writing this review to sincerely thank Galaxy ethical tech Recovery Services for their exceptional work in assisting me in getting my lost Bitcoin investment back. I lost $250,000 in cryptocurrencies as a result of falling victim to an online hoax, which was a severe emotional and financial blow. Fortunately, when looking through my options online, I found Galaxy ethical tech Recovery Services. I made the decision to get in touch, and after our initial conversation, I knew I was in good hands. In addition to being competent, the staff at Galaxy ethical tech Recovery Services was sympathetic and recognized the pain I was experiencing. They guided me through every stage of the procedure, outlining their plans and the actions they would take to get my money back. I valued their openness and commitment, which increased my confidence in the healing process. I was astounded by how hard the staff worked to find my investment in such a short amount of time. I was informed on a regular basis, and I could see they were dedicated to their goal. I was shocked to learn that Galaxy ethical tech had successfully retrieved my $250,000 Bitcoin investment from the swindle artist! The relief and joy I experienced upon getting my money back are beyond words. Galaxy ethical tech Recovery In addition to helping me recover my financial loss, gave me hope that justice would be served in the face of deceit. Throughout the entire process, their professionalism, knowledge, and sincere concern for their clients were clear to see. Contact them today via email: (galaxyethicaltech@mail.com). what app; +15072712442

wolfclara 2y ago

[dead]

Ellabecker5 2y ago

[dead]

frankroselyn 2y ago

[dead]

ellenmoore 2y ago

[dead]

phylliswayne 2y ago

[dead]

Kurtcheng 2y ago

[dead]

terrymcghee010 2y ago

[flagged]