6 ms·

The design of passkeys is pretty solidly based around the idea that users are the weakest link the system and need to be protected from themselves. Given how cr

The design of passkeys is pretty solidly based around the idea that users are the weakest link the system and need to be protected from themselves. Given how criminally insecure passwords and push/code based MFA are in the face of user incompetence I have a hard time believing that WebAuthn is some grand plot by Big Tech to lock people into their walled gardens. I think people on HN overestimate the security literacy of the average computer user in a personal/corporate setting. If a sophisticated attacker wanted to target an organiztion with passwords/push auth, it'd be trivial to get some subset of members to copy-paste passwords from managers and accept prompts. I think far more likely than lock-in is that FIDO members genuinely want to make their customers more secure, something that passkeys very much do accomplish for the average user. That being said, I'm not rushing to enable passkeys on every site. If you already use a good password that enforces origin binding (the key strength of WebAuthn) and you extend that security perimeter through good OpSec (i.e., being careful when copy-pasting passwords), you're not getting much benefit.

msgodel 1y ago
>I think people on HN overestimate the security literacy of the average computer user in a personal/corporate setting. Sure. Provide an escape hatch for the technically literate and let us use our ssh-agent then.
- ericpauley 1y ago
  Here's your escape hatch: https://bitwarden.com/help/export-your-data/ https://bitwarden.com/help/export-your-data/ Bitwarden even now supports passkeys on mobile browsers and apps. As a happy user for over 5 years it's been great being able to configure something less theatrical than push/codes without needing to plug in my YubiKey every time.
  - secabeen 1y ago
    Sadly, right now, bitwarden is the only provider that will dump your passkeys into a JSON. No one else offers it, and there is no functionality from any provider to import and adopt the JSON that bitwarden exports. Passwords have their faults, but they do have a zero-technology backup option that your heirs can execute. (A printed dump of the password vault in a locked fire safe.)
    - hakfoo 1y ago
      I'm surprised that especially financial service providers don't have a very clear "in the event of death/emergency" flow. I know you can sometimes label an account payable-on-death/joint-ownership/trust/other weird tax-dodge shaped things, but that doesn't solve the technical problem of "how do I log in and initiate my claim when Grandpa kicks the bucket." I prepared the fire-safe paper, but I can imagine my family getting stuck at the institutions who demand 2FA and probably won't have access to my phone or email at the time.
      - brewdad 1y ago
        The whole point is that you aren't supposed to be able to login and continue business as usual. You need to call or write to the financial institution and provide proper legal documentation (death certificate) before you can assume control of the account. This is a GOOD thing.
        secabeen 1y ago
        That's fine for financial accounts, but people have hundreds of accounts, and you don't know which ones are the ones that matter beforehand. Is it your family member's AO3 stories that you want? Or maybe the login to the web forum that was their primary social outlet in old age? This assumes that those non-financial sites even have a process to let you in.
    - RandomGerm4n 1y ago
      KeepassXC also has the option to export passkeys
  - pjjpo 1y ago
    Happy user of Bitwarden and use their passkey support when I can. But generally I've been underwhelmed with the passkey UX, likely no fault of Bitwarden or similar. With extensions installed, Android configured to use Bitwarden for passkeys, etc, it feels like a 10% chance or so Bitwarden will be checked for a passkey and otherwise it's randomly either the browser or phone. Without being able to reliably read a passkey, I always need to set up password + OTP as a backup. While there's some benefit to passkeys when available, having to set up multiple auths anyways just makes it feel like too much of a hassle...
  - reginald78 1y ago
    And how long until the attestation feature is used to ban their implementation? The threats have already been made to keepass.
Gigachad 1y ago
The main benefit you get is that you don't have to type in 2FA codes anymore since 2FA was built to solve credential stuffing / password reuse which isn't a problem on Passkeys. It is nice to just have a one click login for things.
- aaomidi 1y ago
  Yes but also depends on how the end system is configured. You can require Google IDP to still have 2FA with passkeys.
- Someone1234 1y ago
  First-generation 2FA solved basic credential compromise issues using code-based methods (e.g. TOTP/HOTP). Modern 2FA (e.g. push notifications) adds authentication integrity, phishing resistance, and user validation through real-time, context-aware approvals. Passkeys replace passwords and also render basic TOTP/HOTP-based 2FA unnecessary. However, they do not replace modern, push-based 2FA, which may still be needed in higher-assurance or enterprise scenarios. Regardless personally I am waiting for full FIDO Alliance interoperability/sync, so I'm not locked into a single password manager. I've already had to migrate password managers after my choice was taken over by Private Equity.
  - esseph 1y ago
    Pushed based is also insecure, why would you want that if you have a passkey unlocked by a pin+touch? That's context aware, requires something you have and something you know.
  - Almondsetat 1y ago
    Push notifications don't protect against realtime phishing attacks
  - crote 1y ago
    The main benefit of FIDO2 is origin verification: it is literally impossible to authenticate on a phishing website, as on a phishing website the browser won't send valid origin data to your token. Push notification based 2FA can never obtain that level of security.
1oooqooq 1y ago
it is a big tech plot to tie people verification to a device they control. there's no way you can sugar coat it.
- astrange 1y ago
  Get a Yubikey.
  - lukeschlather 1y ago
    Can I store a passkey on a YubiKey?
    - chipsrafferty 1y ago
      That's all it does.
      - 01HNNWZ0MV43FF 1y ago
        This "passkey" business has been so confusing. I have had an HSM for years. I thought "Passkey" was that stupid Windows thing where they want you to use a 4-digit or 5-digit PIN. If a "passkey" means an HSM, I'm already onboard. If it means PINs and TPMs, I'm not onboard
        esseph 1y ago
        HSM can store a passkey that you optionally can use a touch + pin/password to unlock.
        dingaling 1y ago
        Passkey is a catchy but vague name for ssh keys used for website auth. Everything else about them, such as HSM, is industry overlay motivated by their own motivations and aspirations.
        astrange 1y ago
        A TPM is an HSM.
montroser 1y ago
It's probably not a grand plot at this moment. But yeah, it seems like I'm going to eventually be forced to involve a third party in my login processes, and it will come with not much benefit to me, and will come with a bunch of risks and downsides. It might actually be net positive across the Internet, especially for the most vulnerable people. But at the same time, it could also easily become yet another source of sweet behavioral data ripe for abuse by big tech and government
rurp 1y ago
Big tech initiatives can, and often do, have more than one motivation. I'm sure many folks working on AMP only cared about serving web pages faster to users, just like I'm sure many other folks involved loved the lockin potential. I expect the same is happening with passkeys. Many are just trying to make their customers more secure, but I don't for a second think that companies who are constantly looking for more ways to lock in users don't see any potential for that here.
- conradev 1y ago
  They're working on a secure exchange format between managers: https://fidoalliance.org/specifications-credential-exchange-specifications/ https://fidoalliance.org/specifications-credential-exchange-...
  - marcosdumay 1y ago
    It has been on the HN frontpage before. By "secure" understand "from the user escaping big corpos", and one that the most used open source project was already rejected from because open source is just not compatible with it.
    - altairprime 1y ago
      Open source isn’t compatible if it isn’t running in a secure attestation environment, because 1) people will modify it to be more convenient and less secure; and then 2) they’ll transfer keys from their HSM into plaintext. I’ve watched extremely competent developers spend months figuring out how to bypass second-device factors in order to have a more convenient workflow with their auth key stored in cleartext in a dot file. I know without a shadow of a doubt that if unattested open source was allowed to interop with passkeys, they’d abuse that just as readily in order to be free of the restrictions that HSM-mandatory storage carries. Whatever the “most used open source project” you’re referring to is, all they need to do* is issue a 100%-reproducible binary that they then sign with their usual signing key. Once they submit that build for an independent audit and have it verified as not secretly backdoored, then the other password managers can trust it when secure boot attestation chains all the way down to their signature. This maintains the key benefits of open source — inspectability, pull requests, and so on — while adhering the specifications of PassKeys that protect them against expert users. The password manager, whoever they are, would have likely figured this opportunity out on their own and then rejected it. I can’t be sure, though. Perhaps they didn’t realize it was possible! Or perhaps they opted out of participating. Whatever the case, that’s not any fault of open source. It’s the fault of signatures: no binary is going to be permitted to exchange PassKeys unless it's signed by a trusted party adhering to the PassKeys ‘HSM only’ agreements. Whether their signed binary is reproducible open source or pure binary closed source is irrelevant in an attested environment. No user-modifiable solution will ever be acceptable? Unless reproducible builds and audited modifications. But that’s not an open source problem. I have extensive Ghidra experience and source code is certainly no significant obstacle to extracting passwords. Source code is irrelevant to the problem; signatures, attestation, and secure boot are the key. It would be perfectly reasonable for a consortium of no-cost, no-profit, open source password managers to jointly accept each other’s PassKeys for transfer under attested conditions — and if they did so genuinely without it being backdoored, then that would be a convincing argument both as an alternative to the ‘corporate’ passkeys system, as well as a convincing argument for W3C and the corporations to accept interop with their signed binaries under attested conditions rather than see the PassKeys ecosystem splinter. Certainly the W3C would pressure for their acceptance if their intentions were genuine :) A useful analogy is blackhat badges. Whether the badge is open source or not has no impact on that blackhat requires an attestation from someone other than you that you’re welcome at the conference. Having source code is like having a badge schematic in this analogy: there are lots of good outcomes from it, but gatecrashing without agreeing to their rules isn’t welcome. * Assuming that they want to pass at all, as opposed to taking some sort of hard stance against the core precept of PassKeys: i.e. “the user can’t be trusted, even if they’re an expert”. But, again, that’s nothing to do with open source.
zzo38computer 1y ago
> I have a hard time believing that WebAuthn is some grand plot by Big Tech to lock people into their walled gardens. I do not agree. I think it (and some related things) is a grand plot, and mostly seems to benefit Google and Cloudflare, for lock in. (They might also want to actually improve security in some ways, but that is minor, and there are better ways to do that anyways.) I think X.509 would be better (and does not require a web browser to use, nor does it hide stuff from the user, and also does not require a new different incompatible specification to be made for everything). (Unfortunately, the way X.509 is often used (for server authentication) is also in bad ways, but it can be used better, both for server side and client side.)
benreesman 1y ago
FIDO2 is already a mess: it takes an excellent model (U2F / physical custody) and makes it worse in ways ranging from annoying to dangerous: - in the typical mundane case, its prescriptive about a PIN with the well-known bad outcomes on that - in the limit case, a bad guy who has already demonstrated a willingness to steal your credential now needs to threaten harm to get what he wants There's a reason bank tellers can't open the vault and a reason everyone knows that. Physical custody (U2F) is intuitive, maps extremely well onto existing infrastructure (everyone has keys for their car and home), scalable in security (safes are common, well understood, and can be made arbitrarily secure). So by the time you're at FIDO2 / demand a pin? Already user hostile. Strictly lockout increasing, strictly violence incentivizing. Moving right along, Webauthn could mandate trivial portability as a QR code, TOTP style seed, a zillion ways. Nope: vendor lock in battle (FireFox overlays its password thing on the same pixrls that the Proton or BitWarden one does that I turned on!). None of this is about security, none of it is about safety, none of it is about welfare. It's about money.
seemaze 1y ago
how can I "use a good password that enforces origin binding"? Is this accomplished on the user side or by the provider?
zmgsabst 1y ago
Google banned ad blockers from Chrome by claiming it secured non-technical users.
- muppetman 1y ago
  No they didn't. Ublock Origin Lite works fine in Chrome. Certainly they took strong adblocking capabilities away, but I can still browse the web on Chrome fairly ad free.
  - zmgsabst 1y ago
    So… they took away Ublock Origin (and other “strong adblocking”) for the reason I said…?
    - Balinares 1y ago
      No they didn't. Adguard works fine. Ublock has been dragging its feet, but that's on Ublock. Yes, I know, there were all those clickbait headlines. I saw them too, and people got super upset when you pointed out the clickbait and that adblockers would in fact still work. Well here we are, and lo, adblockers still work. There's plenty enough of shitty things Google actually does and did, no point in inventing easily disprovable ones. Mind you, the fact Google could change APIs further to actually prevent adblocking is on its own a sufficient reason to foster competing browsers, so let's perhaps focus on that.
      - omnimus 1y ago
        The “strong capabilities” means tracking/fingerprinting prevention. So yeah you might not see ads but the ads see you. The fact they can do this without pushback is pretty clear sign this will only continue.
        tim333 1y ago
        I'm fine with ad people knowing that. I think people can overact a bit. I mean do you feel the need to wear a mask and disguise when going to shops and cafes in case the shops and cafes see where you go?
foxylad 1y ago
Yes - title should be "Passkeys are just passwords your granddad and the websites he visits can't stuff up". Passkeys will do for authentication what TLS did for transport.
- apple4ever 1y ago
  Until he messes something up and loses all his passkeys.
cookiengineer 1y ago
Remember when the internet of military contractors got exfiltrated because the CI/CD pipeline of a firewall vendor got breached? Guess what their password was: solarwinds123 So yes, I am in favor of passkeys everywhere because humans are bad at realizing their operational risks when they start creating an account and haven't even used it yet. Without password managers, humans tend to reuse their passwords, which makes one breach a breach of all accounts. Humans are also bad at remembering passwords, so time based recreation of passwords will always lead to the month or week or iteration as a suffix. And that's the actual problem that can be prevented with passkeys (or MFA that is not based on sending SMS or emails which are unencrypted as a transport channel). But I agree with the author's implied sentiment: export/import should work between password managers and be required by law, because currently Microsoft's authenticator workflow is pretty useless if you can reset the passkeys via email ownership anyways.
- sam_lowry_ 1y ago
  > when they start creating an account and haven't even used it yet. This is a niche case that is already handled more or less properly by the BigTech.
  - cookiengineer 1y ago
    Why is this a niche use case? Are you suggesting that people will change their passwords after they created an account and realize that it needs a better level of security? Because I would argue that Collection #1-#6 proved the exact opposite: Humans reuse passwords, and invent sequences or suffixes when forced to change it.
- JohnFen 1y ago
  > Remember when the internet of military contractors got exfiltrated because the CI/CD pipeline of a firewall vendor got breached? Guess what their password was: solarwinds123 So I get to be punished because of incompetent military contractors?
  - cookiengineer 1y ago
heavenlyblue 1y ago
Have you tried to log in AWS account using corporate identity? How many redirects it takes? Or Bing/Microsoft? Or the new trendy thing where you have to put in your email before password field is shown (because it may require 2-auth). All of these platforms made authentication less secure because a) due to so many differen domains handling authentication I no longer can know if I am at the one I should trust b) since there's often no password shown password mamagers no longer automatically fill in username fields These idiots broke the system that worked so well before with a password manager and it no longer works. For very little reason. Don't say it's users who are to blame, it is as much the big companies who are making it worse because they are dysfunctional.
xg15 1y ago
> The design of passkeys is pretty solidly based around the idea that users are the weakest link the system and need to be protected from themselves. What happened to actually educating users instead? (And not undermining your own security advices by making legitimate sites look like phishing sites)
- adiabatty 1y ago
  > What happened to actually educating users instead? I’m against passkeys for all the usual reasons, but people have been trying to educate end users for decades now. The lessons don’t always stick, and new users are being made every year.
hulitu 1y ago
> If a sophisticated attacker wanted to target an organiztion with passwords/push auth, ... it can target the Remote Code Executor: the web browser. /s

msgodel 1y ago

>I think people on HN overestimate the security literacy of the average computer user in a personal/corporate setting. Sure. Provide an escape hatch for the technically literate and let us use our ssh-agent then.

ericpauley 1y ago
Here's your escape hatch: https://bitwarden.com/help/export-your-data/ https://bitwarden.com/help/export-your-data/ Bitwarden even now supports passkeys on mobile browsers and apps. As a happy user for over 5 years it's been great being able to configure something less theatrical than push/codes without needing to plug in my YubiKey every time.
- secabeen 1y ago
  Sadly, right now, bitwarden is the only provider that will dump your passkeys into a JSON. No one else offers it, and there is no functionality from any provider to import and adopt the JSON that bitwarden exports. Passwords have their faults, but they do have a zero-technology backup option that your heirs can execute. (A printed dump of the password vault in a locked fire safe.)
  - hakfoo 1y ago
    I'm surprised that especially financial service providers don't have a very clear "in the event of death/emergency" flow. I know you can sometimes label an account payable-on-death/joint-ownership/trust/other weird tax-dodge shaped things, but that doesn't solve the technical problem of "how do I log in and initiate my claim when Grandpa kicks the bucket." I prepared the fire-safe paper, but I can imagine my family getting stuck at the institutions who demand 2FA and probably won't have access to my phone or email at the time.
    - brewdad 1y ago
      The whole point is that you aren't supposed to be able to login and continue business as usual. You need to call or write to the financial institution and provide proper legal documentation (death certificate) before you can assume control of the account. This is a GOOD thing.
      - secabeen 1y ago
        That's fine for financial accounts, but people have hundreds of accounts, and you don't know which ones are the ones that matter beforehand. Is it your family member's AO3 stories that you want? Or maybe the login to the web forum that was their primary social outlet in old age? This assumes that those non-financial sites even have a process to let you in.
  - RandomGerm4n 1y ago
    KeepassXC also has the option to export passkeys
- pjjpo 1y ago
  Happy user of Bitwarden and use their passkey support when I can. But generally I've been underwhelmed with the passkey UX, likely no fault of Bitwarden or similar. With extensions installed, Android configured to use Bitwarden for passkeys, etc, it feels like a 10% chance or so Bitwarden will be checked for a passkey and otherwise it's randomly either the browser or phone. Without being able to reliably read a passkey, I always need to set up password + OTP as a backup. While there's some benefit to passkeys when available, having to set up multiple auths anyways just makes it feel like too much of a hassle...
- reginald78 1y ago
  And how long until the attestation feature is used to ban their implementation? The threats have already been made to keepass.

Gigachad 1y ago

The main benefit you get is that you don't have to type in 2FA codes anymore since 2FA was built to solve credential stuffing / password reuse which isn't a problem on Passkeys. It is nice to just have a one click login for things.

aaomidi 1y ago
Yes but also depends on how the end system is configured. You can require Google IDP to still have 2FA with passkeys.
Someone1234 1y ago
First-generation 2FA solved basic credential compromise issues using code-based methods (e.g. TOTP/HOTP). Modern 2FA (e.g. push notifications) adds authentication integrity, phishing resistance, and user validation through real-time, context-aware approvals. Passkeys replace passwords and also render basic TOTP/HOTP-based 2FA unnecessary. However, they do not replace modern, push-based 2FA, which may still be needed in higher-assurance or enterprise scenarios. Regardless personally I am waiting for full FIDO Alliance interoperability/sync, so I'm not locked into a single password manager. I've already had to migrate password managers after my choice was taken over by Private Equity.
- esseph 1y ago
  Pushed based is also insecure, why would you want that if you have a passkey unlocked by a pin+touch? That's context aware, requires something you have and something you know.
- Almondsetat 1y ago
  Push notifications don't protect against realtime phishing attacks
- crote 1y ago
  The main benefit of FIDO2 is origin verification: it is literally impossible to authenticate on a phishing website, as on a phishing website the browser won't send valid origin data to your token. Push notification based 2FA can never obtain that level of security.

1oooqooq 1y ago

it is a big tech plot to tie people verification to a device they control. there's no way you can sugar coat it.

astrange 1y ago
Get a Yubikey.
- lukeschlather 1y ago
  Can I store a passkey on a YubiKey?
  - chipsrafferty 1y ago
    That's all it does.
    - 01HNNWZ0MV43FF 1y ago
      This "passkey" business has been so confusing. I have had an HSM for years. I thought "Passkey" was that stupid Windows thing where they want you to use a 4-digit or 5-digit PIN. If a "passkey" means an HSM, I'm already onboard. If it means PINs and TPMs, I'm not onboard
      - esseph 1y ago
        HSM can store a passkey that you optionally can use a touch + pin/password to unlock.
      - dingaling 1y ago
        Passkey is a catchy but vague name for ssh keys used for website auth. Everything else about them, such as HSM, is industry overlay motivated by their own motivations and aspirations.
      - astrange 1y ago
        A TPM is an HSM.

montroser 1y ago

It's probably not a grand plot at this moment. But yeah, it seems like I'm going to eventually be forced to involve a third party in my login processes, and it will come with not much benefit to me, and will come with a bunch of risks and downsides. It might actually be net positive across the Internet, especially for the most vulnerable people. But at the same time, it could also easily become yet another source of sweet behavioral data ripe for abuse by big tech and government

rurp 1y ago

Big tech initiatives can, and often do, have more than one motivation. I'm sure many folks working on AMP only cared about serving web pages faster to users, just like I'm sure many other folks involved loved the lockin potential. I expect the same is happening with passkeys. Many are just trying to make their customers more secure, but I don't for a second think that companies who are constantly looking for more ways to lock in users don't see any potential for that here.

conradev 1y ago
They're working on a secure exchange format between managers: https://fidoalliance.org/specifications-credential-exchange-specifications/ https://fidoalliance.org/specifications-credential-exchange-...
- marcosdumay 1y ago
  It has been on the HN frontpage before. By "secure" understand "from the user escaping big corpos", and one that the most used open source project was already rejected from because open source is just not compatible with it.
  - altairprime 1y ago
    Open source isn’t compatible if it isn’t running in a secure attestation environment, because 1) people will modify it to be more convenient and less secure; and then 2) they’ll transfer keys from their HSM into plaintext. I’ve watched extremely competent developers spend months figuring out how to bypass second-device factors in order to have a more convenient workflow with their auth key stored in cleartext in a dot file. I know without a shadow of a doubt that if unattested open source was allowed to interop with passkeys, they’d abuse that just as readily in order to be free of the restrictions that HSM-mandatory storage carries. Whatever the “most used open source project” you’re referring to is, all they need to do* is issue a 100%-reproducible binary that they then sign with their usual signing key. Once they submit that build for an independent audit and have it verified as not secretly backdoored, then the other password managers can trust it when secure boot attestation chains all the way down to their signature. This maintains the key benefits of open source — inspectability, pull requests, and so on — while adhering the specifications of PassKeys that protect them against expert users. The password manager, whoever they are, would have likely figured this opportunity out on their own and then rejected it. I can’t be sure, though. Perhaps they didn’t realize it was possible! Or perhaps they opted out of participating. Whatever the case, that’s not any fault of open source. It’s the fault of signatures: no binary is going to be permitted to exchange PassKeys unless it's signed by a trusted party adhering to the PassKeys ‘HSM only’ agreements. Whether their signed binary is reproducible open source or pure binary closed source is irrelevant in an attested environment. No user-modifiable solution will ever be acceptable? Unless reproducible builds and audited modifications. But that’s not an open source problem. I have extensive Ghidra experience and source code is certainly no significant obstacle to extracting passwords. Source code is irrelevant to the problem; signatures, attestation, and secure boot are the key. It would be perfectly reasonable for a consortium of no-cost, no-profit, open source password managers to jointly accept each other’s PassKeys for transfer under attested conditions — and if they did so genuinely without it being backdoored, then that would be a convincing argument both as an alternative to the ‘corporate’ passkeys system, as well as a convincing argument for W3C and the corporations to accept interop with their signed binaries under attested conditions rather than see the PassKeys ecosystem splinter. Certainly the W3C would pressure for their acceptance if their intentions were genuine :) A useful analogy is blackhat badges. Whether the badge is open source or not has no impact on that blackhat requires an attestation from someone other than you that you’re welcome at the conference. Having source code is like having a badge schematic in this analogy: there are lots of good outcomes from it, but gatecrashing without agreeing to their rules isn’t welcome. * Assuming that they want to pass at all, as opposed to taking some sort of hard stance against the core precept of PassKeys: i.e. “the user can’t be trusted, even if they’re an expert”. But, again, that’s nothing to do with open source.

zzo38computer 1y ago

> I have a hard time believing that WebAuthn is some grand plot by Big Tech to lock people into their walled gardens. I do not agree. I think it (and some related things) is a grand plot, and mostly seems to benefit Google and Cloudflare, for lock in. (They might also want to actually improve security in some ways, but that is minor, and there are better ways to do that anyways.) I think X.509 would be better (and does not require a web browser to use, nor does it hide stuff from the user, and also does not require a new different incompatible specification to be made for everything). (Unfortunately, the way X.509 is often used (for server authentication) is also in bad ways, but it can be used better, both for server side and client side.)

benreesman 1y ago

FIDO2 is already a mess: it takes an excellent model (U2F / physical custody) and makes it worse in ways ranging from annoying to dangerous: - in the typical mundane case, its prescriptive about a PIN with the well-known bad outcomes on that - in the limit case, a bad guy who has already demonstrated a willingness to steal your credential now needs to threaten harm to get what he wants There's a reason bank tellers can't open the vault and a reason everyone knows that. Physical custody (U2F) is intuitive, maps extremely well onto existing infrastructure (everyone has keys for their car and home), scalable in security (safes are common, well understood, and can be made arbitrarily secure). So by the time you're at FIDO2 / demand a pin? Already user hostile. Strictly lockout increasing, strictly violence incentivizing. Moving right along, Webauthn could mandate trivial portability as a QR code, TOTP style seed, a zillion ways. Nope: vendor lock in battle (FireFox overlays its password thing on the same pixrls that the Proton or BitWarden one does that I turned on!). None of this is about security, none of it is about safety, none of it is about welfare. It's about money.

seemaze 1y ago

how can I "use a good password that enforces origin binding"? Is this accomplished on the user side or by the provider?

zmgsabst 1y ago

Google banned ad blockers from Chrome by claiming it secured non-technical users.

muppetman 1y ago
No they didn't. Ublock Origin Lite works fine in Chrome. Certainly they took strong adblocking capabilities away, but I can still browse the web on Chrome fairly ad free.
- zmgsabst 1y ago
  So… they took away Ublock Origin (and other “strong adblocking”) for the reason I said…?
  - Balinares 1y ago
    No they didn't. Adguard works fine. Ublock has been dragging its feet, but that's on Ublock. Yes, I know, there were all those clickbait headlines. I saw them too, and people got super upset when you pointed out the clickbait and that adblockers would in fact still work. Well here we are, and lo, adblockers still work. There's plenty enough of shitty things Google actually does and did, no point in inventing easily disprovable ones. Mind you, the fact Google could change APIs further to actually prevent adblocking is on its own a sufficient reason to foster competing browsers, so let's perhaps focus on that.
    - omnimus 1y ago
      The “strong capabilities” means tracking/fingerprinting prevention. So yeah you might not see ads but the ads see you. The fact they can do this without pushback is pretty clear sign this will only continue.
      - tim333 1y ago
        I'm fine with ad people knowing that. I think people can overact a bit. I mean do you feel the need to wear a mask and disguise when going to shops and cafes in case the shops and cafes see where you go?

foxylad 1y ago

Yes - title should be "Passkeys are just passwords your granddad and the websites he visits can't stuff up". Passkeys will do for authentication what TLS did for transport.

apple4ever 1y ago
Until he messes something up and loses all his passkeys.

cookiengineer 1y ago

Remember when the internet of military contractors got exfiltrated because the CI/CD pipeline of a firewall vendor got breached? Guess what their password was: solarwinds123 So yes, I am in favor of passkeys everywhere because humans are bad at realizing their operational risks when they start creating an account and haven't even used it yet. Without password managers, humans tend to reuse their passwords, which makes one breach a breach of all accounts. Humans are also bad at remembering passwords, so time based recreation of passwords will always lead to the month or week or iteration as a suffix. And that's the actual problem that can be prevented with passkeys (or MFA that is not based on sending SMS or emails which are unencrypted as a transport channel). But I agree with the author's implied sentiment: export/import should work between password managers and be required by law, because currently Microsoft's authenticator workflow is pretty useless if you can reset the passkeys via email ownership anyways.

sam_lowry_ 1y ago
> when they start creating an account and haven't even used it yet. This is a niche case that is already handled more or less properly by the BigTech.
- cookiengineer 1y ago
  Why is this a niche use case? Are you suggesting that people will change their passwords after they created an account and realize that it needs a better level of security? Because I would argue that Collection #1-#6 proved the exact opposite: Humans reuse passwords, and invent sequences or suffixes when forced to change it.
JohnFen 1y ago
> Remember when the internet of military contractors got exfiltrated because the CI/CD pipeline of a firewall vendor got breached? Guess what their password was: solarwinds123 So I get to be punished because of incompetent military contractors?
- cookiengineer 1y ago

heavenlyblue 1y ago

Have you tried to log in AWS account using corporate identity? How many redirects it takes? Or Bing/Microsoft? Or the new trendy thing where you have to put in your email before password field is shown (because it may require 2-auth). All of these platforms made authentication less secure because a) due to so many differen domains handling authentication I no longer can know if I am at the one I should trust b) since there's often no password shown password mamagers no longer automatically fill in username fields These idiots broke the system that worked so well before with a password manager and it no longer works. For very little reason. Don't say it's users who are to blame, it is as much the big companies who are making it worse because they are dysfunctional.

xg15 1y ago

> The design of passkeys is pretty solidly based around the idea that users are the weakest link the system and need to be protected from themselves. What happened to actually educating users instead? (And not undermining your own security advices by making legitimate sites look like phishing sites)

adiabatty 1y ago
> What happened to actually educating users instead? I’m against passkeys for all the usual reasons, but people have been trying to educate end users for decades now. The lessons don’t always stick, and new users are being made every year.

hulitu 1y ago

> If a sophisticated attacker wanted to target an organiztion with passwords/push auth, ... it can target the Remote Code Executor: the web browser. /s