6 ms·

Passkeys have way too many footguns for me. If I use my phone to sign in I'm going to accidentally create a passkey there on iOS embedded webview. When I use Go

• weird-eye-issue 8mo ago
  Embedded webviews are the stupidest thing ever. Yesterday I got halfway through a checkout process, had to go back to another app to check something, and then the webview simply disappeared so I didn't bother finishing the checkout. This was on Android Usually I open it in Chrome but for some reason I didn't realize it was a webview this time
  • OptionOfT 8mo ago
    Embedded WebViews are a way to track you: https://news.ycombinator.com/item?id=32514793 https://news.ycombinator.com/item?id=32514793
  • mgrandl 8mo ago
    I disable them on every app that lets me. It is in every way worse UX than simply opening the browser.
  • dgxyz 8mo ago
    God yes that. Our VPN client fell over the other day because the auth popup opens an embedded web browser which throws a javascript error as it's bouncing through our ID provider pages. How the fuck we got there I don't know. Everything is a gigantic Heath Robinson contraption.
• EnPissant 8mo ago
  You can just use bitwarden everywhere if you are ok with it in the cloud.
  • rstat1 8mo ago
    Doesn't need to be in the cloud for it work everywhere.
    • deleted 8mo ago
      [deleted]
    • EnPissant 8mo ago
      True. You can self-host.
  • arjie 8mo ago
    I do use Bitwarden everywhere but a couple of times the passkey prompt doesn't show it. I think that's how I got the webview for one of my google accounts stored in iOS keychain.
    • ezfe 8mo ago
      Anytime you save to your iOS keychain you’re doing so through the system prompt and Bitwarden should be included as a target option in that prompt. If it’s not, that’s a Bitwarden issue. 1Password shows up in the system UI regardless of context on iOS.
  • mkehrt 8mo ago
    Tell that to my mom who has created a bunch of passkeys all over the place without knowing what they are. I'm trying to unwind it but it's a mess.
    • goku12 8mo ago
      Passkeys are an antipattern in UX design. You want to make it simple for the users? Great! But stop treating them as too stupid to decide anything on their own. Stop locking them out of the decision loop and doing things behind their back. This is practically the corporate design philosophy of the past two decades. You can see this a lot in smartphone design. I keep asking what advantages passkeys offer over TLS self-signed client certificates. I haven't got any answers so far. Perhaps increase the security by encrypting the private key with a password or an external token. This is safe, like SSH and unlike regular passwords, because no secrets are sent to the server. TLS certs and (encrypted) keys are more tangible and easier to manage. Perhaps passkeys do offer some advantages over TLS certs. But can't those be added to TLS, rather than rollout an entirely new system? The infuriating part is that this facility exists in browsers. They just let it rot to an extend that it's practically unusable. Meanwhile, Gemini browsers are using it quite successfully (for those who use Gemini).
• madduci 8mo ago
  For this reason I am avoiding it like a plague. It is an additional way to fingerprint your activity and the scenarios where you migrate your passkeys from a device to another seems not really well "oiled"
  • lxgr 8mo ago
    How can passkeys be used to fingerprint you? The WebAuthN extension goes to pretty great lengths to avoid fingerprinting.
    • madduci 8mo ago
      Don't they get associated to a particular device?
      • lxgr 8mo ago
        Yes, but they're used, by design, to authenticate you. Even revealing the fact that a given passkey exists on your device requires your active confirmation according to the spec, so unless you actually want to authenticate and click the corresponding button, the site learns nothing about you (other than that your browser theoretically supports WebAuthN, which most do these days, so that's significantly less than one bit of fingerprinting data on you). In other words, you can't be fingerprinted by WebAuthN, unless there's a (pretty severe) bug in an implementation.
      • ezfe 8mo ago
        No, they can be synced.
        • madduci 8mo ago
          TIL, thanks
• cedws 8mo ago
  There’s another foot gun I wrote about recently: https://cedwards.xyz/passkeys-are-not-2fa/ https://cedwards.xyz/passkeys-are-not-2fa/
  • dwedge 8mo ago
    I was reading your other blog post about storing them in bitwarden I have to disagree with this point: > Unless you were forced to by some organisational policy, there’s no point setting up 2FA only to reduce the effective security to 1FA because of convenience features. 2FA both stored in your password manager is less secure than storing than separately, but it still offers security compared to a single factor. The attack methods you mentioned (RAT, keylogger) require your device to be compromised, and if your device is not compromised 2fa will help you. To slip into opinion mode, I consider my password manager being compromised to be mostly total compromise anyway. Also I really like the style and font of your blog.
    • TacticalCoder 8mo ago
      > To slip into opinion mode, I consider my password manager being compromised to be mostly total compromise anyway. But how is that no the entire point? If your 2FA is a proper device, like a Yubikey, the attack surface is tinier than tiny and the device ensures that your secret never leaves the device. We did see cases of passwords managers getting compromised. We haven't seen yet a secret being extracted from a Yubikey. So where you say you consider that your software (password manager) getting compromised is total compromise, we're saying: "as long as the HSM on a Yubikey does its job, we have actual 2FA and there cannot be a total compromise".
      • dwedge 8mo ago
        You're right, I should have been more clear in that I meant a local compromise of the machine running the password manager client, not the server running the password manager itself. If my sessions and all of my data can be intercepted, the yubikey 2fa seems like it's only saving me from a token "nobody can login remotely to this one service" which at that point seems pretty moot
• shaky-carrousel 8mo ago
  I truly don't see the advantage of passkeys over a password manager like bitwarden, with random passwords.
  • bryantwolf 8mo ago
    The advantage is that the password never leave the device. It has a public key and signs challenges with the private key but nothing sensitive goes over the wire on every login
    • valenterry 8mo ago
      It should be noted that that is not an inherential advantage of passkeys over passwords. It is possible to achieve the same with passwords, e.g. by using a hash-cascade.
      • mi_lk 8mo ago
        is it fair to say all passkey implementations have this advantage while only some password implementations can match?
        • simoncion 8mo ago
          It is absolutely unfair to say it. Just like passwords stored in a password manager, passkeys can be copied out of the device for safekeeping. Because you can copy them out, a user can be induced to give them to someone. I saw passkey boosters go very, very rapidly from "Passkeys are immune to phishing!" to "Passkeys are phishing resistant!" when lots of real-world people started using passkeys and demonstrated that you absolutely must have a way to back them up and move them around.
          • lxgr 8mo ago
            > passkeys can be copied out of the device for safekeeping You can't copy them out on at least the iOS, Android, and (to my knowledge) Windows default implementations. > lots of real-world people started using passkeys and demonstrated that you absolutely must have a way to back them up and move them around. Millions of people use them without being able to move them around in the way you describe.
• lxgr 8mo ago
  Passkeys on iOS and macOS actually work quite well in that regard. They get stored in your provider of choice across the web, web views, apps etc., at least in my experience. Mine is Bitwarden, and that's available on pretty much all platforms, natively where available (except on macOS currently), as a browser extension otherwise. For the rare instance in which I need to authenticate using a passkey on a computer where I'm not logged into Bitwarden, there's the cross-device CaBLE flow where I can scan a QR code with my phone and use Bitwarden to authenticate. This works across OSes and browsers.
  • javier2 8mo ago
    except... i store my password for work in bitwarden, so I dont want to also keep my work passkeys in the same place. For my personal stuff, that is a risk I can live with so far, but for work it seems dumb.
    • lxgr 8mo ago
      Yeah, definitely don’t mix work and personal credentials. But many password managers allow using different accounts/vaults on one machine.
    • ezfe 8mo ago
      Your Bitwarden should enforce the necessary 2-Factor auth for this scenario, but if you’re worried just make sure to be careful when registering that single passkey.
  • freeopinion 8mo ago
    > This works across OSes and browsers. It doesn't work for me in Firefox on Linux. I'm very curious to know how it works for you.
    • lxgr 8mo ago
      Does their Firefox extension not inject its own WebAuthN implementation into every visited site on Linux? It does for me on macOS (i.e. it overrides the OS/browser-provided one).
• giancarlostoro 8mo ago
  I just use iOS' wallet for all of it, the only exception being if its something I 100% need to open outside of my iphone / macs. Then I go for BitWarden, turns out I dont need any apps to open outside of that sandbox, I am okay only opening these up on Mac. I can always type my password on Linux. That's what bitwarden is for anyway.
• duxup 8mo ago
  Yup. I hate them. I get the problem they're trying to solve, it just seems like I have more work to do... and I honestly don't even follow what is going on sometimes. I recently moved to a new computer and it's just an AUTHHELLSCAPE.
• zenmac 8mo ago
  >If I had any discipline around this it would make sense but if I accidentally double tap on the screen I've got a passkey and it's stuck on my phone. The problem is not with passkey rather system such as iOS keeps a tight lid on how files are uploaded and retrieved from the device. There is a real disconnect between desktop and mobile file system now days.
• ezfe 8mo ago
  The system always asks where you want to store it, and all passkey managers vend to the system prompt with labels so you can see where it is. This is not an issue on iOS, I can’t tell how what you’re describing could happen.
• snailmailman 8mo ago
  I like the concept of them, and I want them to work well purely so people stop using bad passwords. But nearly everywhere does it differently and weirdly and likely wrongly. When I log into my Amazon account with a passkey, it then asks me for a 2FA code. The 2FA code is stored on the same device as a passkey, that step literally does nothing. After I do the 2FA code, it then prompts me to create a passkey. No! I have one. I signed in with one. Some devices give me the option to use a QR code. I like that option usually, I can easily use my phone to authenticate. But sometimes i can’t get the QR code to appear. Support varies by OS, browser, and set of installed extensions. And there’s no easy way to control which of those three handles the passkey when something decides wrongly. I had to troubleshoot something on someone else’s computer, and saw that they logged in to windows with a passkey and QR code. I’ve looked, and I can’t seem to set that up on my windows computer. There isn’t an option to and I have no idea why.
  • trueismywork 8mo ago
    Passkeys IMO will only work with dedicated U2F/FIFO keys like Yubikeys.
    • RGamma 8mo ago
      Beware that Passkey storage is limited though and I don't think you can reuse one for multiple sites. My Yubikey 5 NFC stores up to 32 and you should have some redundancy if you ever lose it. You also can't export them. I only use passkeys (in Bitwarden) for things I don't care about.
      • encrypted_bird 8mo ago
        As someone who's looking into possibly getting a YubiKey 5 NFC actually, I would like to ask: if you can't export the entries, if you make a backup of the YubiKey (perhaps with the magic of buying two of them), then how would one ensure redundancy?
• nerdsniper 8mo ago
  > I'm sure it's of use to many people but it's been no end of pain for me and it has really signaled to me what it's like to grow into an old man unable to use computers when I was once a young man who would find this easy. My only "good" solution for passkey UX is to make sure all my devices are Apple. Apple's password/keychain integrates reasonably well enough with Chrome, I can share passkeys with my cofounder easily in shared folder (he is also all-in on Apple ecosystem) and I can share passkeys with my work computer (different AppleID) for low-stakes things like news websites or Amazon.com (I work in IT security for the org, so I know exactly how much I can trust my employer) I do also use Linux and Windows personally, and the passkey story is much worse there, particularly for Linux which doesn't seem to play well with my Yubikeys. Luckily, a lot of websites seem to have a "Scan this QR code with your iPhone" feature to complete the passkey authentication.
• wolvoleo 8mo ago
  I like them but I must be the owner of them. Not Google, Apple or Microsoft. And be able to save the private keys for safekeeping, something the fido alliance doesn't really want me to do. We finally have bit warden but there's still some usability issues with that. Right now most sites that I use that allow them have conditions that make it impossible to use for me. For example PayPal only allows them in chrome and edge. So yeah I'll wait for them to become actually open and usable.