4 ms·

I thought this was going to be about Passkeys. Maybe if the FIDO Alliance can stop being obstinant and allow real backups, I'd be all in on them.

jjani 1y ago
Even with backups, the attestation issue makes them awful.
- anonymars 1y ago
  I'm not familiar with this issue and a quick search didn't turn up anything obvious. Would you mind elaborating?
  - Arrowmaster 1y ago
    They are referring to the ability of a site you are logging into forcing you to use a client from a specific list or having a list of clients to deny. It's copied over from FIDO hardware keys where each device type needed to be identifiable so higher tier ones could be required or unsecured development versions could be blocked.
    - jjani 1y ago
      This is what I was referring to, and we already have seen this happen in the wild with PayPal at one point (possibly still) blocking passkeys from e.g. Firefox. For now the argument against this seems to be that "Apple zeroes this out so service providers can't do it without risking issues for their many users who use Apple to store their keys", but clearly this is so precarious of a situation it may as well not be a thing. You can't depend on one trillion-dollar company not changing their minds on that tomorrow.
      - reginald78 1y ago
        Even with the current flimsy "What about iPhones?" defense against attestation, is there anything stopping say Microsoft from just forcing you to install a different app to use Microsoft services?
    - bux93 1y ago
      It's like DRM: it will annoy legitimate users and keep them from obviously legit usecases, and be circumvented by people who are motivated.
      - anonymars 1y ago
        Thanks, yes, I see this just came up in a similar comment thread (https://news.ycombinator.com/item?id=44823752 https://news.ycombinator.com/item?id=44823752) What a crock, to not bother coming up with a way to make passkeys portable and then threaten to ban providers who actually thought about how humans might use them in the real world
  - pandorobo 1y ago
    Specifically they are referring to synced passkeys (passkeys generated by services like Google password manager/1Password/Apple and are linked to that account). Because these passkeys are stored in the Cloud and synced to your providers account (i.e. Google/Apple/1Password etc), they can't support attestation. It leads to a scenario where Relying Parties (the apps consuming the passkey), cannot react to incidents in passkey providers. For example: If tomorrow, 1Password was breached and all their cloud-stored passkeys were leaked, RP's have no way to identify and revoke the passkeys associated with that leak. Additionally, if a passkey provider turns out to be malicious, there is no way to block them.
- UltraSane 1y ago
  Why?
Wowfunhappy 1y ago
But if you could back up a passkey, wouldn't the key just be a password? (I do agree with you about backups being essential, but my conclusion was "the idea is fundamentally flawed," rather than "it's one tweak away from greatness.")
- burnt-resistor 1y ago
  This is the irreducible problem. It's the Emperor's New Clothes™. So either the secrets get generated and stored in tamper-protected hardware, or they are stored somewhere else that can be made portable. For the latter, then they ought to be serializable into some standard form.
- harg 1y ago
  No, because unlike a password you never provide the private key for a passkey to the site you’re logging into, which is how many password breaches occur.
- hooverd 1y ago
  Passkeys solve phishing by being domain bound and never exposing the private key. It's a huge improvement!
AgentME 1y ago
Passkeys on cryptocurrency wallets such as the Trezor and Ledger are tied to the device's seed phrase and can be backed up.
- baobun 1y ago
  Did you try that? I can't find any confirmation on if it's actually working for classical keys but it's for sure not supported for resident keys on Ledger. https://www.ledger.com/blog/strengthen-the-security-of-your-accounts-with-webauthn https://www.ledger.com/blog/strengthen-the-security-of-your-... https://github.com/LedgerHQ/app-security-key/issues/6 https://github.com/LedgerHQ/app-security-key/issues/6 https://github.com/LedgerHQ/app-security-key/issues/7 https://github.com/LedgerHQ/app-security-key/issues/7 Is Trezor implementation more mature?
  - AgentME 1y ago
    Damn I misremembered, I've only tried it on Trezor, not Ledger. What I do know is I've successfully used my Trezor for signing in to Google and several other sites through one or both of Chrome or Firefox.
eddythompson80 1y ago
What do you mean by real backups? What's stopping you from backing up your keys? Its up to the passkey "provider" to allow passkeys backup/sync.
- politelemon 1y ago
  Not really, they have no incentive to provide such a thing nor is it mandatory for them to do so.
  - stavros 1y ago
    Are you saying password managers don't have an incentive to provide a feature users want? That describes literally their entire featureset.
    - anonymars 1y ago
      What incentive do they have to make it easy to migrate to a different provider?
      - stavros 1y ago
        People want the ability to back their passkeys up. The fact that this can be used for migrating is an unfortunate side-effect, as far as the provider is concerned.
- reginald78 1y ago
  Well, having your passkey provider blocked for doing that might stop you. https://github.com/keepassxreboot/keepassxc/issues/10407 https://github.com/keepassxreboot/keepassxc/issues/10407 Of course, they might just block you for not being on a whitelist of approved providers anyway.
  - eddythompson80 1y ago
    That's such a strawman argument. Read the link you pasted again
deleted 1y ago
[deleted]
cyberax 1y ago
Erm... Passkeys _are_ backupable/syncable WebAuthn keys. You can get the clear-text Passkey private keys by just looking into your storage (Keychain on iOS). What's missing is a standardized format for the export.
burnt-resistor 1y ago
Same. Sacrificing security by selling superficial convenience and limited security advantages for crucial inconveniences. Perhaps there ought to be a well-known, "ACME" password-changing API such that a password manager could hypothetically change every password for every service contained in an automated fashion.

jjani 1y ago

Even with backups, the attestation issue makes them awful.

anonymars 1y ago
I'm not familiar with this issue and a quick search didn't turn up anything obvious. Would you mind elaborating?
- Arrowmaster 1y ago
  They are referring to the ability of a site you are logging into forcing you to use a client from a specific list or having a list of clients to deny. It's copied over from FIDO hardware keys where each device type needed to be identifiable so higher tier ones could be required or unsecured development versions could be blocked.
  - jjani 1y ago
    This is what I was referring to, and we already have seen this happen in the wild with PayPal at one point (possibly still) blocking passkeys from e.g. Firefox. For now the argument against this seems to be that "Apple zeroes this out so service providers can't do it without risking issues for their many users who use Apple to store their keys", but clearly this is so precarious of a situation it may as well not be a thing. You can't depend on one trillion-dollar company not changing their minds on that tomorrow.
    - reginald78 1y ago
      Even with the current flimsy "What about iPhones?" defense against attestation, is there anything stopping say Microsoft from just forcing you to install a different app to use Microsoft services?
  - bux93 1y ago
    It's like DRM: it will annoy legitimate users and keep them from obviously legit usecases, and be circumvented by people who are motivated.
    - anonymars 1y ago
      Thanks, yes, I see this just came up in a similar comment thread (https://news.ycombinator.com/item?id=44823752 https://news.ycombinator.com/item?id=44823752) What a crock, to not bother coming up with a way to make passkeys portable and then threaten to ban providers who actually thought about how humans might use them in the real world
- pandorobo 1y ago
  Specifically they are referring to synced passkeys (passkeys generated by services like Google password manager/1Password/Apple and are linked to that account). Because these passkeys are stored in the Cloud and synced to your providers account (i.e. Google/Apple/1Password etc), they can't support attestation. It leads to a scenario where Relying Parties (the apps consuming the passkey), cannot react to incidents in passkey providers. For example: If tomorrow, 1Password was breached and all their cloud-stored passkeys were leaked, RP's have no way to identify and revoke the passkeys associated with that leak. Additionally, if a passkey provider turns out to be malicious, there is no way to block them.
UltraSane 1y ago
Why?

Wowfunhappy 1y ago

But if you could back up a passkey, wouldn't the key just be a password? (I do agree with you about backups being essential, but my conclusion was "the idea is fundamentally flawed," rather than "it's one tweak away from greatness.")

burnt-resistor 1y ago
This is the irreducible problem. It's the Emperor's New Clothes™. So either the secrets get generated and stored in tamper-protected hardware, or they are stored somewhere else that can be made portable. For the latter, then they ought to be serializable into some standard form.
harg 1y ago
No, because unlike a password you never provide the private key for a passkey to the site you’re logging into, which is how many password breaches occur.
hooverd 1y ago
Passkeys solve phishing by being domain bound and never exposing the private key. It's a huge improvement!

AgentME 1y ago

Passkeys on cryptocurrency wallets such as the Trezor and Ledger are tied to the device's seed phrase and can be backed up.

baobun 1y ago
Did you try that? I can't find any confirmation on if it's actually working for classical keys but it's for sure not supported for resident keys on Ledger. https://www.ledger.com/blog/strengthen-the-security-of-your-accounts-with-webauthn https://www.ledger.com/blog/strengthen-the-security-of-your-... https://github.com/LedgerHQ/app-security-key/issues/6 https://github.com/LedgerHQ/app-security-key/issues/6 https://github.com/LedgerHQ/app-security-key/issues/7 https://github.com/LedgerHQ/app-security-key/issues/7 Is Trezor implementation more mature?
- AgentME 1y ago
  Damn I misremembered, I've only tried it on Trezor, not Ledger. What I do know is I've successfully used my Trezor for signing in to Google and several other sites through one or both of Chrome or Firefox.

eddythompson80 1y ago

What do you mean by real backups? What's stopping you from backing up your keys? Its up to the passkey "provider" to allow passkeys backup/sync.

politelemon 1y ago
Not really, they have no incentive to provide such a thing nor is it mandatory for them to do so.
- stavros 1y ago
  Are you saying password managers don't have an incentive to provide a feature users want? That describes literally their entire featureset.
  - anonymars 1y ago
    What incentive do they have to make it easy to migrate to a different provider?
    - stavros 1y ago
      People want the ability to back their passkeys up. The fact that this can be used for migrating is an unfortunate side-effect, as far as the provider is concerned.
reginald78 1y ago
Well, having your passkey provider blocked for doing that might stop you. https://github.com/keepassxreboot/keepassxc/issues/10407 https://github.com/keepassxreboot/keepassxc/issues/10407 Of course, they might just block you for not being on a whitelist of approved providers anyway.
- eddythompson80 1y ago
  That's such a strawman argument. Read the link you pasted again

deleted 1y ago

[deleted]

cyberax 1y ago

Erm... Passkeys _are_ backupable/syncable WebAuthn keys. You can get the clear-text Passkey private keys by just looking into your storage (Keychain on iOS). What's missing is a standardized format for the export.

burnt-resistor 1y ago

Same. Sacrificing security by selling superficial convenience and limited security advantages for crucial inconveniences. Perhaps there ought to be a well-known, "ACME" password-changing API such that a password manager could hypothetically change every password for every service contained in an automated fashion.