4 ms·

The website should display a qr code you can scan with your phone that allows you to then login, unfortunately a lot of sites don't implement this, and some don

The website should display a qr code you can scan with your phone that allows you to then login, unfortunately a lot of sites don't implement this, and some don't implement backup codes. This isn't the fault of passkeys per se, but of poor implementations.

201984 8d ago
How does scanning the barcode with your phone log you into the computer? Does your phone need network access for that?
- jerkstate 8d ago
  what good is a phone if it isn't on a network?
  - cpburns2009 8d ago
    Have you ever been in a large building with awful cell reception and no wifi access?
  - cesarb 8d ago
    > what good is a phone if it isn't on a network? 1. It might be on a voice network but not on a data network; for instance, if you don't have a data plan. 2. Modern smartphones are actually a hybrid of a traditional cell phone and a traditional PDA, and you might be using it for the PDA part.
- deleted 8d ago
  [deleted]
- roryirvine 8d ago
  If you're not happy connecting your phone to the network, then how likely is it that you would you be willing to enter your login details on a machine you don't control?
  - stonogo 8d ago
    Poor people exist.
    - roryirvine 8d ago
      The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription. The number of people sharing GP's concerns for reasons of poverty rather than because of their personal security posture will be vanishingly small.
      - arcfour 8d ago
        I'll have to remember this one the next time I hear the phone/poverty argument made in bad faith.
      - rcxdude 8d ago
        They still exist, though. And in my experience people in vulnerable positions have somewhere between zero and one phones at any given time, without necessarily any good continuity between them.
      - kps 8d ago
        > The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription. Only 85%¹ of the population are over the age of 4. Smart kids they've got. ¹ https://populationpyramids.org/zambia https://populationpyramids.org/zambia
      - stonogo 8d ago
        I don't think "fuck 10% of the population" is as strong an argument as you seem to think it is.
  - tavavex 8d ago
    What if you just can't have internet on your phone? Like if the computer is connected via Ethernet and there's no wifi network you can connect to? What if you're abroad and have no roaming? And the ultimate question about a person that the modern world can barely conceptualize - what if you have a dumbphone? Or what if your smartphone is lost or stolen or dead and you need to access some account? That last one has happened to me, and I sure am glad I know the key passwords that I need for survival. These may seem like nitpicks, but there's probably a thousand rare scenarios like these that exist. You inevitably have to consider them when you're moving from punching in letters and numbers that you remember in the normal, low-tech way to a complex networked two-device workflow.
- Yokolos 8d ago
  Steam does this. If I want to login, it shows a barcode I can scan with the app and it logs me in without needing to enter my login information. Phone needs internet access, doesn't need to be on the same network as the device I'm logging in on. I assume the QR code contains a token for the device, which is used by the app to authorize the login and the server automatically logs in the client on the device with the matching token. Seems a lot safer to me than using my login credentials on a potentially unsafe device.
  - limagnolia 8d ago
    Yes, this is how it could work, or it could display a code you type into your phone.
- jon-wood 8d ago
  There's a whole set of fallbacks built in to the standard, including Bluetooth, local network connections, and going via a relay server. All of them eventually end up with your device signing something and handing that back to the browser on the other device to complete the authentication flow.
  - thwarted 8d ago
    I cannot speak to how accurate your description is, but this description sounds like there are multiple weak points and multiple attack vectors that open this up to increased risk of compromise, undermining the very security stance it's supposed to provide.
    - sgerenser 8d ago
      See my response above... I believe the description is incorrect, and bluetooth is required to prove physical proximity.
    - LocalPCGuy 8d ago
      The spec is quite thorough and well thought out in this regard. Despite what it "sounds like" when described, it is very secure, even with a variety of implementations. What is far weaker is that most sites that offer passkeys also offer a multitude of fallback recovery options.
  - sgerenser 8d ago
    AFAIK, the "scan this QR code" method of signing in with a passkey on a phone on a device w/o the passkey requires Bluetooth. There's some type of handshaking that goes on in order for you to prove you're in physical proximity of the device you are logging in on, to prevent phishing attacks.
    - sgerenser 8d ago
      Since I might have made someone mad... to clarify, as I understand it, Bluetooth is absolutely required for this "Scan the QR code" flow to work. However, it's also possible the actual authentication traffic to travel over a different pathway (wifi, cellular), but the bluetooth part is always required though to prove proximity. So on e.g. a library computer without Bluetooth enabled, you would not be able to log in with a passkey on your phone.
alienbaby 8d ago
That's still a terrible solution. Plenty of people don't have phones that can do that, or dont have e it with them when they do etc..
RHSeeger 8d ago
The fact that nearly every passkey implementation is lacking in a variety of very impactful ways... is a very good reason to _not_ use passkeys. When every passkey interaction is a different variety of user interaction nightmare, it's not very convincing that it's a good idea in the first place
- judge2020 8d ago
  They're talking about a web-based QR code solution separate from passkeys. Passkey QR codes are only WebAuthn via CTAP hybrid transport (with BLE verified proximity)
wpollock 8d ago
> The website should display a qr code you can scan with your phone that allows you to then login... A malicious website can display a QR code too. I think this "feature" could cause some of the security issues that passkesys were intended to solve. I use Keepass and the free tier of Dropbox, to keep my passwords strong and available across multiple devices. (Dropbox not required, you can store the database on a thumb drive.) Backups are no problem. Keepass (or KeepassXC) stores other data as well, including the correct URLs for sites. So my workflow is simply to click the URL from within Keepass, copy the username and password, and paste them into the login screen. So easy even an adult can do it! (Humor attempt) For convenience, Keepass database can be unlocked with either a password or biometrics (your fingerprint). (Not affiliated with Keepass, just a happy longtime user.)
- LocalPCGuy 8d ago
  That QR code from a malicious website will not actually communicate with the malicious website with authentication from the correct origin, most QR code phishing scams do not actually use passkeys but rather fall back to trying to get the user's fallback login information (if any). By spec, if the domain does not perfectly match the domain where the passkey was originally created, the phone (or passkey provider) will fail to find a matching passkey. And the domain is derived, not provided by the QR code data (it's all in the spec). Basically, it's very hard if not basically impossible to spoof a QR code to access the real passkey via a malicious site. (caveat, without already having compromised something like the user's DNS, maybe? Even then the site would likely fail the cryptographic checks.)
- Ferret7446 7d ago
  The phishing protections of passkeys also works against "malicious QR codes". Which is a great example of why passkeys are kind of good, you stop needing to worry about a lot of attacks.
- dwaite 7d ago
  Yes, the passkey flow QR code contains a public key, and a local key exchange is done over bluetooth to prove proximity. That is used to set up a confidential channel. That means attackers need more than to display a QR code, they also need a local presence (radio).

201984 8d ago

How does scanning the barcode with your phone log you into the computer? Does your phone need network access for that?

jerkstate 8d ago
what good is a phone if it isn't on a network?
- cpburns2009 8d ago
  Have you ever been in a large building with awful cell reception and no wifi access?
- cesarb 8d ago
  > what good is a phone if it isn't on a network? 1. It might be on a voice network but not on a data network; for instance, if you don't have a data plan. 2. Modern smartphones are actually a hybrid of a traditional cell phone and a traditional PDA, and you might be using it for the PDA part.
deleted 8d ago
[deleted]
roryirvine 8d ago
If you're not happy connecting your phone to the network, then how likely is it that you would you be willing to enter your login details on a machine you don't control?
- stonogo 8d ago
  Poor people exist.
  - roryirvine 8d ago
    The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription. The number of people sharing GP's concerns for reasons of poverty rather than because of their personal security posture will be vanishingly small.
    - arcfour 8d ago
      I'll have to remember this one the next time I hear the phone/poverty argument made in bad faith.
    - rcxdude 8d ago
      They still exist, though. And in my experience people in vulnerable positions have somewhere between zero and one phones at any given time, without necessarily any good continuity between them.
    - kps 8d ago
      > The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription. Only 85%¹ of the population are over the age of 4. Smart kids they've got. ¹ https://populationpyramids.org/zambia https://populationpyramids.org/zambia
    - stonogo 8d ago
      I don't think "fuck 10% of the population" is as strong an argument as you seem to think it is.
- tavavex 8d ago
  What if you just can't have internet on your phone? Like if the computer is connected via Ethernet and there's no wifi network you can connect to? What if you're abroad and have no roaming? And the ultimate question about a person that the modern world can barely conceptualize - what if you have a dumbphone? Or what if your smartphone is lost or stolen or dead and you need to access some account? That last one has happened to me, and I sure am glad I know the key passwords that I need for survival. These may seem like nitpicks, but there's probably a thousand rare scenarios like these that exist. You inevitably have to consider them when you're moving from punching in letters and numbers that you remember in the normal, low-tech way to a complex networked two-device workflow.
Yokolos 8d ago
Steam does this. If I want to login, it shows a barcode I can scan with the app and it logs me in without needing to enter my login information. Phone needs internet access, doesn't need to be on the same network as the device I'm logging in on. I assume the QR code contains a token for the device, which is used by the app to authorize the login and the server automatically logs in the client on the device with the matching token. Seems a lot safer to me than using my login credentials on a potentially unsafe device.
- limagnolia 8d ago
  Yes, this is how it could work, or it could display a code you type into your phone.
jon-wood 8d ago
There's a whole set of fallbacks built in to the standard, including Bluetooth, local network connections, and going via a relay server. All of them eventually end up with your device signing something and handing that back to the browser on the other device to complete the authentication flow.
- thwarted 8d ago
  I cannot speak to how accurate your description is, but this description sounds like there are multiple weak points and multiple attack vectors that open this up to increased risk of compromise, undermining the very security stance it's supposed to provide.
  - sgerenser 8d ago
    See my response above... I believe the description is incorrect, and bluetooth is required to prove physical proximity.
  - LocalPCGuy 8d ago
    The spec is quite thorough and well thought out in this regard. Despite what it "sounds like" when described, it is very secure, even with a variety of implementations. What is far weaker is that most sites that offer passkeys also offer a multitude of fallback recovery options.
- sgerenser 8d ago
  AFAIK, the "scan this QR code" method of signing in with a passkey on a phone on a device w/o the passkey requires Bluetooth. There's some type of handshaking that goes on in order for you to prove you're in physical proximity of the device you are logging in on, to prevent phishing attacks.
  - sgerenser 8d ago
    Since I might have made someone mad... to clarify, as I understand it, Bluetooth is absolutely required for this "Scan the QR code" flow to work. However, it's also possible the actual authentication traffic to travel over a different pathway (wifi, cellular), but the bluetooth part is always required though to prove proximity. So on e.g. a library computer without Bluetooth enabled, you would not be able to log in with a passkey on your phone.

alienbaby 8d ago

That's still a terrible solution. Plenty of people don't have phones that can do that, or dont have e it with them when they do etc..

RHSeeger 8d ago

The fact that nearly every passkey implementation is lacking in a variety of very impactful ways... is a very good reason to _not_ use passkeys. When every passkey interaction is a different variety of user interaction nightmare, it's not very convincing that it's a good idea in the first place

judge2020 8d ago
They're talking about a web-based QR code solution separate from passkeys. Passkey QR codes are only WebAuthn via CTAP hybrid transport (with BLE verified proximity)

wpollock 8d ago

> The website should display a qr code you can scan with your phone that allows you to then login... A malicious website can display a QR code too. I think this "feature" could cause some of the security issues that passkesys were intended to solve. I use Keepass and the free tier of Dropbox, to keep my passwords strong and available across multiple devices. (Dropbox not required, you can store the database on a thumb drive.) Backups are no problem. Keepass (or KeepassXC) stores other data as well, including the correct URLs for sites. So my workflow is simply to click the URL from within Keepass, copy the username and password, and paste them into the login screen. So easy even an adult can do it! (Humor attempt) For convenience, Keepass database can be unlocked with either a password or biometrics (your fingerprint). (Not affiliated with Keepass, just a happy longtime user.)

LocalPCGuy 8d ago
That QR code from a malicious website will not actually communicate with the malicious website with authentication from the correct origin, most QR code phishing scams do not actually use passkeys but rather fall back to trying to get the user's fallback login information (if any). By spec, if the domain does not perfectly match the domain where the passkey was originally created, the phone (or passkey provider) will fail to find a matching passkey. And the domain is derived, not provided by the QR code data (it's all in the spec). Basically, it's very hard if not basically impossible to spoof a QR code to access the real passkey via a malicious site. (caveat, without already having compromised something like the user's DNS, maybe? Even then the site would likely fail the cryptographic checks.)
Ferret7446 7d ago
The phishing protections of passkeys also works against "malicious QR codes". Which is a great example of why passkeys are kind of good, you stop needing to worry about a lot of attacks.
dwaite 7d ago
Yes, the passkey flow QR code contains a public key, and a local key exchange is done over bluetooth to prove proximity. That is used to set up a confidential channel. That means attackers need more than to display a QR code, they also need a local presence (radio).