3 ms·
The "standard" answer is that you should either use synced passkeys, or enroll multiple passkeys with the provider. The problem is that some providers (e.g. Pay
by AlotOfReading 10mo ago
The "standard" answer is that you should either use synced passkeys, or enroll multiple passkeys with the provider. The problem is that some providers (e.g. Paypal, some banks) only support one passkey, and synced passkeys aren't supposed to be trusted for attestation (unless they're synced by Apple/Google/Microsoft).
- epaulson 10mo agoAnd every couple of days we see a post or a tweet about "Google/Apple/Microsoft just nuked my account with no notice and no recourse" so trusting them to sync passkeys rightfully makes some people nervous.
- stavros 10mo agoWhereas we never see a horror story involving passwords.
- AlotOfReading 10mo agoThere are two problems with passwords. Reuse, and site breaches. The solution to the former is the same as passkeys: credential managers. Passkeys genuinely solve the second, in exchange for a vastly less comprehensible system (see all the uncertainty people have even here on HN) that doesn't support many of the ways people want to use authentication tokens.
- stavros 10mo agoNo, the biggest issue with passwords is phishing. You can't phish a passkey.
- AlotOfReading 10mo agoAre there any credential managers that don't validate the domain with passwords? Sure, there are issues with PSL subdomain matching, but at the end of the day it's good enough in the real world. All the other stuff (MITM, malicious site, etc) falls under the other case I already mentioned.
- stavros 10mo agoThere's a big difference between "generally doesn't get phished" and "it's impossible to be phished".
- AlotOfReading 10mo agoIt's security, so we're not discussing impossibility. You can still phish a passkey, we're just hoping the cryptography is good enough that it remains astronomically unlikely to succeed. Since we're all reasonable people, that chance is low enough that we're fine accepting it. What I'm saying is that the chance with passwords is still low enough that I'm fine accepting, even though it's much higher than the cryptographic security of passkeys. We're simply disagreeing about where we draw the line of "good enough".
- stavros 10mo agoHow can you phish a passkey?
- AlotOfReading 10mo agoYou crack the private key and forge the challenge? Maybe the other IDs sent alongside it are hard to get for some reason, but the security of passkeys comes down to the cryptography. Cryptography can always be broken, but a good cryptosystem makes the probability low enough that any reasonable person considers it good enough.
- otterley 10mo agoIf you trust that the cryptography employed in passkeys is effectively unbreakable, then it follows that for all intents and purposes, passkeys cannot be phished. It’s the same thing as trusting that your browsing sessions cannot be MITMed because the end to end encryption is sufficiently strong.
- immibis 10mo ago
- bgbntty2 10mo agoThe problem with this is requiring everyone to own a device with a secure enclave or similar hardware capabilities because some people are prone to being phished. Let me choose the level of risk I find acceptable.
- stavros 10mo agoPasskeys don't require this.
- bgbntty2 10mo agoHow else would you make the private key unexportable and the passkey uncopyable?
- stavros 10mo agoYou wouldn't, and still passkeys don't require this.
- bgbntty2 10mo ago[dead]
- coldpie 10mo agoPasskeys don't require it, but relying-parties may: https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994182200 https://github.com/keepassxreboot/keepassxc/issues/10407#iss... If enough RPs ban clients that let users manage their own data in the name of "security," then it is effectively required by passkeys. The passkey spec could have been written to be resilient against this type of abuse, but instead this abuse is explicitly considered a feature of the spec.
- NoGravitas 10mo agoSort of. Passkeys push the phishing to the account recovery or passkey enrollment process.
- stavros 10mo agoHow do you phish the account recovery or enrollment process?
- stavros 10mo agoThat's not what phishing is. Phishing is convincing someone to give you a credential with a page that looks like the one they're supposed to give the credential on. Passkeys cannot be phished.
- immibis 10mo agoThey must be paired with an alternative mechanism, unless you plan to unperson everyone who accidentally drops their phone in a river (this may be the plan for high-security services but it can't be the plan in general) and that mechanism can be phished. Session cookies can't be phished either, so why aren't those sufficient?