3 ms·

To present a passkey, you have to use a password manager. This provides some anti-phishing protection. Passkeys are locked to a domain, enforced by the browser

To present a passkey, you have to use a password manager. This provides some anti-phishing protection. Passkeys are locked to a domain, enforced by the browser. This completely breaks phishing. That's why we're doing this song and dance in the first place! You can't read a passkey over the phone or use it on the wrong website. The lock-in issue is more complex: - I write a VS Code extension for plain text passkey storage for simplicity. Do you allow servers to reject this? What should they reject? To oversimplify, the corporate folks argue for more control, the open source folks for less. - There is an exchange protocol in the works for data migration: https://fidoalliance.org/specifications-credential-exchange-specifications/ https://fidoalliance.org/specifications-credential-exchange-...

Ferret7446 1y ago
> - I write a VS Code extension for plain text passkey storage for simplicity. Do you allow servers to reject this? What should they reject? To oversimplify, the corporate folks argue for more control, the open source folks for less. Irrelevant, servers can never control what clients do. The only way to control passkeys is using attestation CAs, which is insanely restrictive (not (just) for the users, but for the implementors), e.g., you only allow Yubikeys, Yubico provisions a TPM guarded endorsement key on the valid keys, and you send an additional challenge that must be signed by the endorsement key and validated by Yubico servers. This is completely, absolutely impractical outside of a closed org that supplies all of its own keys.
- conradev 1y ago
  How is it "completely, absolutely impractical outside of a closed org" when I thought Google attests every passkey created on Android? https://www.w3.org/TR/webauthn-3/#sctn-android-key-attestation https://www.w3.org/TR/webauthn-3/#sctn-android-key-attestati... Apple would too, if it were not for iCloud Keychain syncing: https://news.ycombinator.com/item?id=43988852 https://news.ycombinator.com/item?id=43988852 My understanding is that servers can block passkeys from insecure Android devices today if they wanted to.
  - timmyc123 1y ago
    > How is it "completely, absolutely impractical outside of a closed org" when I thought Google attests every passkey created on Android? Passkeys in Google Password Manager are not attested. There is no known synced passkey credential manager that creates attested passkeys.
NoGravitas 1y ago
> This completely breaks phishing. It pushes phishing back to the passkey recovery/reset interface, which is out of scope for passkeys. Saying passkeys provide "some anti-phishing protection" is accurate.

Ferret7446 1y ago

> - I write a VS Code extension for plain text passkey storage for simplicity. Do you allow servers to reject this? What should they reject? To oversimplify, the corporate folks argue for more control, the open source folks for less. Irrelevant, servers can never control what clients do. The only way to control passkeys is using attestation CAs, which is insanely restrictive (not (just) for the users, but for the implementors), e.g., you only allow Yubikeys, Yubico provisions a TPM guarded endorsement key on the valid keys, and you send an additional challenge that must be signed by the endorsement key and validated by Yubico servers. This is completely, absolutely impractical outside of a closed org that supplies all of its own keys.

conradev 1y ago
How is it "completely, absolutely impractical outside of a closed org" when I thought Google attests every passkey created on Android? https://www.w3.org/TR/webauthn-3/#sctn-android-key-attestation https://www.w3.org/TR/webauthn-3/#sctn-android-key-attestati... Apple would too, if it were not for iCloud Keychain syncing: https://news.ycombinator.com/item?id=43988852 https://news.ycombinator.com/item?id=43988852 My understanding is that servers can block passkeys from insecure Android devices today if they wanted to.
- timmyc123 1y ago
  > How is it "completely, absolutely impractical outside of a closed org" when I thought Google attests every passkey created on Android? Passkeys in Google Password Manager are not attested. There is no known synced passkey credential manager that creates attested passkeys.

NoGravitas 1y ago

> This completely breaks phishing. It pushes phishing back to the passkey recovery/reset interface, which is out of scope for passkeys. Saying passkeys provide "some anti-phishing protection" is accurate.