4 ms·

Can you illustrate how workarounds to passkeys are being actively implemented?

• fragmede 2y ago
  Password manager support. If my password manager running on my desktop can provision and access the passkey for use on another device like my phone, then so can malicious code running on my desktop, and exfiltrate it to hackers. The original design, where the private key only exists on a TPM and the private key never leaves the TPM doesn't have that flaw.
  • lxgr 2y ago
    Passkeys were always designed as being synchronizable and not necessarily be secure hardware backed. I think there’s a place for both of them in WebAuthN based on the security/availability/convenience tradeoff which will be different for every application. If you care about your users only using the trusted hardware, non-synchronizing kind, you have to use attestation anyway (or malware running on their device could create credentials that only appear to be backed by secure hardware). Unfortunately both Apple and Google seem to have unshipped their attestation support without replacement (they used to support hardware backed credentials in their devices too for a while) in the interest of not confusing users about what is and isn’t synchronized – now everything is.
    • wkat4242 2y ago
      Attestation would be terrible to have in passkeys because it will allow sites to block certain implementations. PayPal does this already by only allowing safari or chrome. With bitwarden on Firefox I'm locked out.
      • lxgr 2y ago
        Yeah, as a user, I'm mostly happy about the lack of attestation. In an ideal world, only relying parties that really need it would request it, but views on who really does might obviously differ a lot between users and service providers. > PayPal does this already by only allowing safari or chrome. With bitwarden on Firefox I'm locked out. It works for me! However I do vaguely remember having to set them up on Chrome initially, but after that, they now work well even in Firefox. (Only on my computer; on my phone, I get an absurd non sequitur of "security keys only work on desktops").
        • wkat4242 2y ago
          > It works for me! However I do vaguely remember having to set them up on Chrome initially, but after that, they now work well even in Firefox. (Only on my computer; on my phone, I get an absurd non sequitur of "security keys only work on desktops"). Oh ok, I haven't tried that. I don't even have Chrome installed anymore. And yeah I get that message too on my phone, even with standard FIDO2 MFA (not full passwordless Webauthn). Stupid because it does work just fine with other sites.
      • HeatrayEnjoyer 2y ago
        > Attestation would be terrible to have in passkeys because it will allow sites to block certain implementations. Attestation is already coming. Why do you think Microsoft is pushing TPM2.0 so hard?
        • lxgr 2y ago
          How so? Not the type of attestation we're talking about here (i.e. not the early 2000s trope of "zomg Microsoft is locking down our PCs", which ironically is what Apple is now doing instead, all without any evil TPMs). Apple and Google very intentionally threw FIDO attestation out of the windows without replacement, and Microsoft frankly doesn't matter enough for non-corporate contexts at this point. (Imagine your bank only allowing passkeys on Windows, but not iOS, Android, or macOS.)
          • wkat4242 2y ago
            I'm sure Microsoft would have done that in the 2000s if they could have gotten away with it. All the big players did exactly that when they got the chance with mobiles that didn't have any precedent. And no I don't think it's ok even there. But I'm aware I'm a minority. And yeah I moved away from Mac for this reason among others. My devices should answer to me and me alone. But I think the upheaval in the 2000s helped to make the TPM not the horror scenario it could have been. I don't think the ruckus was overblown at all. Don't forget Microsoft still wanted to kill Linux back then. And yes Apple has tpm. It's just built into the cpu and called differently.
            • lxgr 2y ago
              > And yes Apple has tpm. It's just built into the cpu and called differently. Yeah, so does Google. But as mentioned before, even though they were both using it for WebAuthN in the past, they both stopped doing so. What stronger proof for attestation being dead in the context of WebAuthN can you possibly get than the two largest implementers actively discontinuing it? There are many good reasons to be cautious of how attestation is used and critically examine who it serves – a company you're doing business with, you, or both – but in this specific context, it's arguably no longer relevant.
  • wglb 2y ago
    If you have malicious code running on your laptop, it is game over in any case.