Top
Best
New

Posted by todsacerdoti 7 days ago

Yep, Passkeys Still Have Problems(fy.blackhats.net.au)
192 points | 213 commentspage 3
inerte 7 days ago||
I update a spreadsheet with all my accounts and money and their values so I know my net worth and its changes, and oh boy every month getting these numbers is such a chore.

Since it's been a few days, sometimes I am logged out of either bank/traders and also the password manager.

So it's open the bank site, click on login/password, password manager browser extension asks to login. Type password manager password. It asks for 2FA. Unlock phone with face. Find app, open app, unlock app with face. Approve password manager login. Click on bank login/password again. I am in! No, bank wants to 2FA with mobile. Unlock phone with face. Open bank mobile app, unlock with face. Get code or approve login. Back to computer, type code or click approve.

Repeat that 12 times for all the accounts, and by the end of it I have neck pain with all the "pick up phone to face unlock" motions.

I am a bit paranoid so I turn on 2FA and passkeys and whatnot, but all of this makes me want to use `123password` everywhere and never change it.

XorNot 7 days ago|
For me everything goes in Keepass. And the only thing I want in life is the ability to change a password from Keepass in a standardized way.

Instead we've got Passkeys and the general promise by omission that I will be banned from using Keepass to store and backup my passwords as I see fit on my own devices.

People want me to trust the corporate overlords who at every turn have practiced lock in and rent seeking tactics.

emadda 6 days ago||
Related: I released a hosted sign in page for passkey auth today.

Take a look:

https://passkeybot.com

cheeseburgerz 5 days ago||
I'm tired, boss.
cindyllm 5 days ago|
[dead]
stalfosknight 7 days ago||
Passkeys are a completely seamless experience on Apple platforms in my experience so far.
freehorse 7 days ago|
Not that seamless if you do not want to be locked into a single platform, though. This is what the article mostly talks about.
growse 7 days ago|||
Why are you locked into a single platform?

I use bitwarden, Google and a yubikey for passkeys. Which of these am I locked into?

happyopossum 7 days ago|||
Apple has offered an “iCloud for windows” app for ages that literally syncs your iCloud Keychain (passwords and passkeys) to a windows box where you can use browser extensions for chrome, edge, etc.

You’re still not platform locked…

everfrustrated 7 days ago||
The biggest problem I have with passkeys is being tied to a single device you still need a flow to reset/get in _without_ the passkey. As you're only as secure as your weakest link passkeys don't add any security.

That said, if you have a mac with a fingerprint scanner they sure are very convenient option.

And don't get me started on terrible vendors like Rippling that only support a single passkey! Madness.

mmsimanga 7 days ago||
I dropped my phone and it literally fell apart. As a result I have been locked out of my AWS account. The get a phone call verification just does not work. Only saving grace is that it was an account I used to test things.
jmsgwd 7 days ago||
I keep hearing it repeated, but where does this "tied to a single device" idea come from?

The default, built-for-the-masses implementation of passkeys is called "synced passkeys". They are designed to sync between all your enrolled devices, ideally using end-to-end encryption.

You authenticate with whatever device you happen to be using at the time - phone, tablet, laptop, desktop - doesn't matter. If you lose one, you replace that device and re-enroll - then all your passkeys magically re-appear on the new device.

If you're cross-platform, modern password managers work across ecosystems - for example, 1Password syncs passkeys between Mac, Windows, iOS, Android, and Linux. If you're all-in on Apple, their native passkey implementation syncs passkeys between all your Apple devices. I thought Google and Microsoft do something similar now.

It's a real mystery why people believe passkeys have to be stored on your phone only.

everfrustrated 6 days ago|||
If I use windows at home (gaming), mac at work and android on my phone - how exactly are these supposed to seamlessly work together?
jmsgwd 6 days ago||
There are many cross-platform password managers that sync very nicely, which would solve for the machines you control - the Windows gaming machine and Android phone.

For machines you don't control, such as your employer Mac, well that's a special case. In theory you can use "FIDO Cross-Device Authentication", which is a passkey flow designed specifically for authenticating on one device using a passkey stored on a different device, and involves scanning a QR code.

I've never tried this though. Personally I tend to avoid mixing personal stuff with work stuff, so the problem rarely arises.

spencerflem 7 days ago|||
Because by default, they do, and you have to explicitly install software to let it be moved. And even if you do, it’s discouraged and the spec is allowed to deny you access.
timmyc123 7 days ago|||
This is not correct. The default credential manager on all devices except for Windows, creates synced passkeys. And Windows will be changing soon.
spencerflem 7 days ago||
Synced to one ecosystem tho. I don’t care if Microsoft deigns to let me use it across all of my devices they own.

Passwords I can bring anywhere.

timmyc123 6 days ago||
Not exactly. For example, the default credential manager on Android is Google Password Manager, which works on Windows, macOS, iOS, and Ubuntu. There are also dozens of other third party choices.
timmyc123 6 days ago||||
> it’s discouraged

Why do you say that? There are billions of synced passkeys being used by users with some of the largest sites and services in the world.

spencerflem 6 days ago||
Last I heard, they were pushing hard for resident keys only, maybe that's changed. I don't like that there's still the option to restrict it to that in the same way having the option to force remote attestation makes me uneasy.
timmyc123 6 days ago||
A passkey is a discoverable credential (aka resident key) in spec terminology. But the type of credential has no relationship to attestation (which is not used in the consumer passkey ecosystem).
spencerflem 6 days ago||
Ah my bad, I thought the distinction was resident = stored on a YubiKey/Secure Enclave/TPM and that was what made them resident.

To my credit I think yubikey uses the term that way and webauthn has a different definition but in the context of passkeys you’re right.

jmsgwd 6 days ago|||
Just to point out, protecting a key using the secure enclave and syncing it using end-to-end encryption aren’t necessarily mutually exclusive.

The security property you care about is that the plaintext key is only ever processed in use within the secure enclave (transiently, during authentication).

That doesn’t preclude syncing or backing up the encrypted key via a cloud service - if the device allows the application to do that.

spencerflem 6 days ago||
Huh interesting, how does that work? I thought the way yubikeys operate the keys are generated on-device and are impossible to remove, and also come in limited number.

How do the decryption keys for the encrypted passkeys get shared between devices?

jmsgwd 6 days ago||
>Huh interesting, how does that work? I thought the way yubikeys operate the keys are generated on-device and are impossible to remove, and also come in limited number.

I wasn't referring to hardware keys (like YubiKeys), but rather on-device secure enclaves, TEEs, or TPMs.

Also I said "protecting a key using the secure enclave", which is perhaps a bit of a sleight of hand :-)

By that I mean a key that is wrapped (encrypted) using a parent key stored in the secure enclave. The key itself is not stored in the SE. But since it is wrapped using a parent key that is stored in the SE, that means it can only be decrypted in the SE. I believe this is how iCloud Keychain works, for example.

Digging into this further, it looks like I might have been wrong to imply that a credential manager app can instruct the SE itself to perform the proof of possession calculations needed for passkey authentication using a private key that is "protected" in this sense. When the app asks the SE to decrypt a passkey private key, it looks like the SE might return the passkey private key in plaintext to the app, and then the app itself performs the proof of possession calculation transiently outside the SE. I'm not sure about that, but I'd love to know.

> How do the decryption keys for the encrypted passkeys get shared between devices?

They get established as part of the device enrolment process. I suspect this simply adds another layer to the key hierarchy, so that your passkey private keys are encrypted under a sync key (parent) which is encrypted under a SE key (grandparent).

In that case, you could still claim that your passkeys are "protected by the SE" since they are encrypted at rest and in transit, and they cannot be decrypted anywhere except in the SEs of your enrolled devices.

timmyc123 6 days ago|||
> stored on a YubiKey/Secure Enclave/TPM and that was what made them resident.

Stored in an authenticator/credential manager in general, not specific to a security key, secure enclave, or TPM.

jmsgwd 7 days ago|||
> Because by default, they do, and you have to explicitly install software to let it be moved

Apple's native passkey implementation doesn't require doesn't require you to install extra software, and the passkeys sync by default. I thought Google's and Microsoft's were similar - but I haven't tried them.

> And even if you do, it’s discouraged

Really? Where is it discouraged? I thought synced passkeys are intended as the solution for consumers.

> the spec is allowed to deny you access

Yeah but I thought that's for enterprise use cases, not consumer. E.g. employers that want to enforce device type restrictions on their employees.

spencerflem 7 days ago||
It does if you want to share accounts between my iOS phone and Linux desktop. And it still puts you entirely at the whims of Apple, etc. if you’re allowed to log in to unrelated accounts.

& I think it is mostly being used for enterprises for now ,but much like TPM and remote attestation running on “my” computer, I don’t like that it’s an option

bakies 7 days ago||
starting to really hate these, regret ever using one
andrewmcwatters 7 days ago||
I don't care what you other people in auth do, I work in auth too, please stop making signing into anything 5 steps.

1. First I get redirected to a special sign-in page.

2. Then I sign-in with my email only.

3. Then it finally asks me for a password, even for services that would never reasonably use SSO or have another post-email receive process.

4. Then I get redirected again to enter 2fa.

5. Then these websites ask if I want to create a passkey. No, I never want to create a passkey, and you keep asking me anyway.

6. Then, and only then, do I get to finally go back to using the service I wanted, and by then, you've lost whatever my `?originalUrl=` was, and I have to find it again.

No, don't send me a magic link. Because then I have to go do 4 more steps with Gmail or another mailbox provider and now signing in has become 10 or more steps.

No, don't tell me getting rid of passwords will help most of the population, and then force all of us to do the above, and blatantly lie to us that it's better.

Stop it. Get some help.

magnetowasright 6 days ago||
I still find myself stuck on step 0: find the fucking log in button that is for some reason tiny/looks disabled/not easily discernible as a button
andrewmcwatters 6 days ago||
[dead]
eddyg 7 days ago||
If you created a passkey, it would be one step.
andrewmcwatters 7 days ago||
[dead]
jason_s 7 days ago|
Please don't use fixed-width fonts to write text. Please use fixed-width fonts to write code.
dpifke 7 days ago||
Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting.

(quoting https://news.ycombinator.com/newsguidelines.html)

dantillberg 7 days ago|||
I think part of the distress experienced by readers is due to mixing the fixed-width font with "text-align: justify". So it's close but not exactly fixed/consistent.
miloignis 7 days ago||
Ah, thank you for pointing that out! I was wondering what it was.
nine_k 7 days ago||
Firefox Reader Mode makes such sites more readable.