5 ms·

> how do I log in on a device that I don't own? This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR c

• 201984 8d ago
  What if the computer you want to log in on doesn't have Bluetooth? Probably most public computers (like ones in libraries) don't have it.
  • limagnolia 8d ago
    The website should display a qr code you can scan with your phone that allows you to then login, unfortunately a lot of sites don't implement this, and some don't implement backup codes. This isn't the fault of passkeys per se, but of poor implementations.
    • 201984 8d ago
      How does scanning the barcode with your phone log you into the computer? Does your phone need network access for that?
      • jerkstate 8d ago
        what good is a phone if it isn't on a network?
        • cpburns2009 8d ago
          Have you ever been in a large building with awful cell reception and no wifi access?
        • cesarb 8d ago
          > what good is a phone if it isn't on a network? 1. It might be on a voice network but not on a data network; for instance, if you don't have a data plan. 2. Modern smartphones are actually a hybrid of a traditional cell phone and a traditional PDA, and you might be using it for the PDA part.
      • deleted 8d ago
        [deleted]
      • roryirvine 8d ago
        If you're not happy connecting your phone to the network, then how likely is it that you would you be willing to enter your login details on a machine you don't control?
        • stonogo 8d ago
          Poor people exist.
          • roryirvine 8d ago
            The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription. The number of people sharing GP's concerns for reasons of poverty rather than because of their personal security posture will be vanishingly small.
            • arcfour 8d ago
              I'll have to remember this one the next time I hear the phone/poverty argument made in bad faith.
            • rcxdude 8d ago
              They still exist, though. And in my experience people in vulnerable positions have somewhere between zero and one phones at any given time, without necessarily any good continuity between them.
            • kps 8d ago
              > The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription. Only 85%¹ of the population are over the age of 4. Smart kids they've got. ¹ https://populationpyramids.org/zambia https://populationpyramids.org/zambia
            • stonogo 8d ago
              I don't think "fuck 10% of the population" is as strong an argument as you seem to think it is.
        • 8d ago
      • Yokolos 8d ago
        Steam does this. If I want to login, it shows a barcode I can scan with the app and it logs me in without needing to enter my login information. Phone needs internet access, doesn't need to be on the same network as the device I'm logging in on. I assume the QR code contains a token for the device, which is used by the app to authorize the login and the server automatically logs in the client on the device with the matching token. Seems a lot safer to me than using my login credentials on a potentially unsafe device.
        • limagnolia 8d ago
          Yes, this is how it could work, or it could display a code you type into your phone.
      • jon-wood 8d ago
        There's a whole set of fallbacks built in to the standard, including Bluetooth, local network connections, and going via a relay server. All of them eventually end up with your device signing something and handing that back to the browser on the other device to complete the authentication flow.
        • thwarted 8d ago
          I cannot speak to how accurate your description is, but this description sounds like there are multiple weak points and multiple attack vectors that open this up to increased risk of compromise, undermining the very security stance it's supposed to provide.
          • sgerenser 8d ago
            See my response above... I believe the description is incorrect, and bluetooth is required to prove physical proximity.
          • LocalPCGuy 8d ago
            The spec is quite thorough and well thought out in this regard. Despite what it "sounds like" when described, it is very secure, even with a variety of implementations. What is far weaker is that most sites that offer passkeys also offer a multitude of fallback recovery options.
        • sgerenser 8d ago
          AFAIK, the "scan this QR code" method of signing in with a passkey on a phone on a device w/o the passkey requires Bluetooth. There's some type of handshaking that goes on in order for you to prove you're in physical proximity of the device you are logging in on, to prevent phishing attacks.
          • sgerenser 8d ago
            Since I might have made someone mad... to clarify, as I understand it, Bluetooth is absolutely required for this "Scan the QR code" flow to work. However, it's also possible the actual authentication traffic to travel over a different pathway (wifi, cellular), but the bluetooth part is always required though to prove proximity. So on e.g. a library computer without Bluetooth enabled, you would not be able to log in with a passkey on your phone.
    • alienbaby 8d ago
      That's still a terrible solution. Plenty of people don't have phones that can do that, or dont have e it with them when they do etc..
    • RHSeeger 8d ago
      The fact that nearly every passkey implementation is lacking in a variety of very impactful ways... is a very good reason to _not_ use passkeys. When every passkey interaction is a different variety of user interaction nightmare, it's not very convincing that it's a good idea in the first place
      • judge2020 8d ago
        They're talking about a web-based QR code solution separate from passkeys. Passkey QR codes are only WebAuthn via CTAP hybrid transport (with BLE verified proximity)
    • wpollock 8d ago
      > The website should display a qr code you can scan with your phone that allows you to then login... A malicious website can display a QR code too. I think this "feature" could cause some of the security issues that passkesys were intended to solve. I use Keepass and the free tier of Dropbox, to keep my passwords strong and available across multiple devices. (Dropbox not required, you can store the database on a thumb drive.) Backups are no problem. Keepass (or KeepassXC) stores other data as well, including the correct URLs for sites. So my workflow is simply to click the URL from within Keepass, copy the username and password, and paste them into the login screen. So easy even an adult can do it! (Humor attempt) For convenience, Keepass database can be unlocked with either a password or biometrics (your fingerprint). (Not affiliated with Keepass, just a happy longtime user.)
      • LocalPCGuy 8d ago
        That QR code from a malicious website will not actually communicate with the malicious website with authentication from the correct origin, most QR code phishing scams do not actually use passkeys but rather fall back to trying to get the user's fallback login information (if any). By spec, if the domain does not perfectly match the domain where the passkey was originally created, the phone (or passkey provider) will fail to find a matching passkey. And the domain is derived, not provided by the QR code data (it's all in the spec). Basically, it's very hard if not basically impossible to spoof a QR code to access the real passkey via a malicious site. (caveat, without already having compromised something like the user's DNS, maybe? Even then the site would likely fail the cryptographic checks.)
      • Ferret7446 8d ago
        The phishing protections of passkeys also works against "malicious QR codes". Which is a great example of why passkeys are kind of good, you stop needing to worry about a lot of attacks.
      • dwaite 8d ago
        Yes, the passkey flow QR code contains a public key, and a local key exchange is done over bluetooth to prove proximity. That is used to set up a confidential channel. That means attackers need more than to display a QR code, they also need a local presence (radio).
  • xp84 8d ago
    My suggestion would be to not do that. But keep a password and an offline TOTP app if you must. It’s still an option.
  • judge2020 8d ago
    Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms.
    • cesarb 8d ago
      > > What if the computer you want to log in on doesn't have Bluetooth? > Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms. What if the computer you want to log in on doesn't have a WiFi chip? It doesn't have to be an old computer; for instance, the desktop computer I built last year uses a wired gigabit Ethernet connection to the router right next to it, and doesn't have (or need) any WiFi or Bluetooth chip.
      • RHSeeger 8d ago
        The computer I just replaced had neither wifi nor bluetooth. It was a desktop device and had no use for either.
    • reaperducer 8d ago
      Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms. That's a technocratic reply, not one that is useful in the real world. As noted by the person you're replying to, it's not his computer. It's a public library. Most computers in non-residential settings will have various features locked down, including Bluetooth. Hotels, clubs, airport lounges, various government facilities… there are thousands of places where you might really need to use a computer but don't control the technology.
• esseph 8d ago
  Passkey on NFC/USB hardware token (x2) They're cheap enough if you lose one it's not the end of the world. Goes on your keyring. Doesn't require esim management. Use NFC swipe/usb-plug-in + pin to use.
  • pavel_lishin 8d ago
    The problem isn't the cost of replacing it, the problem is - how do you log in when all your passkey-bearing devices just got flushed down the toilet?
    • remix2000 8d ago
      How is that different from accidentally deleting your keepass database? Or forgetting your password? I think it’d be easier for me to forget than find myself trying to flush all my hw tokens…
      • pavel_lishin 8d ago
        I can back up my keepass database, and I can write down my passwords.
        • faust201 8d ago
          Same way. A majority generally have a old phone that was already signed in to google. Or if they remember only Apple ID and password (one very difficult password) + sms. They can login on to a new phone. Everything is SYNCED immediately. What if you have a ransomeware that destroy everything on the same day your house and all backups burn down. And you cant get it from immutable backups as you wrote that decryption key in paper. And the bank will not allow you to access it as the govt deported you elsewhere.
        • megous 8d ago
          I can back up my FIDO2 (non-)resident keys too. In the end it's just a piece of HW with some secret material inside. non-resident FIDO2 keys are easier to back up, because the master secret seed is fixed and shared for all origins and there's nothing stored on the key.
• deleted 8d ago
  [deleted]
• darkwater 8d ago
  >This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport). Ok but how do I share my Netflix or Spotify accounts for example with those?
  • judge2020 8d ago
    In general you shouldn’t - Netflix[0] really should get proper invite-based family sharing, and Spotify’s subscriber agreement has a section that defines Premium as a “Single-user Paid Subscription” and thus can’t be used by multiple people, legally (and you might be at risk of getting banned if they detect it) However, passkeys can and are available to be shared via password managers. They’re not locked to the secure chip on the device where they live usually. iOS’ Passwords app has a share button and 1Password lets you share passkey-containing items. In fact, the QR code login feature makes it even easier to do a one-time sign in to your account for a friend, if you don’t want them to be able to login to your account indefinitely. 0: Netflix doesn’t support passkeys because their main audience is people signing in via smart TVs and whatnot, which largely don’t support CTAP or Webauthn in general)
    • pixl97 8d ago
      >In general you shouldn’ Me to said companies: I will do what I want.
      • brendoelfrendo 8d ago
        Said companies to you: sounds like what you want is to get booted from our service.
        • pixl97 8d ago
          Me: Invents more new ways of being problematic for the company spreading the ideas to millions of others decreasing their profitability to almost nothing. Me to company: Damn, guess you shouldn't have been an asshole about it, kind of backfired on you.
• epihelix 8d ago
  Awesome. I'll just find the thief and ask nicely, shall I?
• deaton 8d ago
  Sign in with a QR code is dangerous though because at that point theres very little stopping QR phishing and forwarding the bluetooth request to your browser. See the most common Discord scam.
  • judge2020 8d ago
    > forwarding the bluetooth request to your browser. This isn't a thing. Discord's QR Code scanning is entirely a feature they made unrelated to passkeys or bluetooth. Passkey auth using a QR code has a step that verifies the proximity of both devices using BLE.
• basch 8d ago
  What if my phone is dead? Stolen? In the same vein as 2fa, going up to a fresh computer and trying to log into anything is now a nightmare. Every service has a 2fa that somehow loops into another provider that also has 2fa. And some 2fa, if not many, make accounts weaker. Apple's solution to get around 2fa is to put in SOMEBODY ELSES phone number that I trust, as a backdoor. It's an insane solution. And its normalized, and nobody questions it.
  • Terr_ 8d ago
    While we're at it, the insanity of those "recovery questions", made even worse when many companies demand the same ones.
    • basch 8d ago
      but you can type anything in the recovery box. its just three additional passwords. should you type the same brother name in each time? should you even answer with a name? don't get me wrong, they were insane, but they can be repurposed.
      • samspot 8d ago
        Good luck remembering what you put there when asked 10 years later.
        • Terr_ 8d ago
          Yeah, many do not even allow you to enter in a custom question, which would be marginally better--at least for users who care about security. Then you'd have the option to craft a question which is (A) personally memorable (B) specifically phrased to avoid ambiguity, (C) not public or guessable, and (D) unique to a service. * "Where is your first pet buried?" * "While on vacation, The Noodle Incident happened in which city?" * In what year did you first see Example Band live in concert along with Alice and Bob?"
        • basch 8d ago
          put it in your password manager?