Hacker News Reader

Comment by bragr | Hacker News Reader

>It allows servers to integrate with the strong authenticators now built into devices, like Windows Hello or Apple’s Touch ID.

The problem I have with this is that some consumers won't understand the degree to which all of their access depends on their MS/Apple account. Consider the hypothetical person using this for all their access, smacking their finger down on the reader habitually for every pop-up. Ok now they lose their phone. Do they remember their apple password? Do they know how to recover their account? Are they locked out of their digital lives now? For some percentage of people that answer would seem to be yes.

For example, the Apple account recovery process [1] seems particularly vulnerable scenarios where your devices and wallet are lost together, so don't get your bag stollen while traveling if you don't remember your apple password.

[1] https://support.apple.com/en-us/HT204921

View on HN

I agree that this is an important next step in making WebAuthn accesible enough to supplant passwords. Note that once you're recovering your password, you've already lost access to your end-to-end encrypted data like keychain, and that's a good thing. It's still a solvable problem, and there are three things that I'd like to see in this area.

a) The ability to share passkeys across vendors, including the ability to implement a "sync fabric" as some folks in the WebAuthn working group have called it, so it's interoperable beyond the major vendors.

b) For these vendors to strengthen their own log in experience. Apple only allows their own TOTP implementation and SMS fallback to authenticate to iCloud. I'd like to use WebAuthn exclusively here, so I could back up access to my now-precious Keychain that holds all my FIDO credentials with a YubiKey.

c) A better story about backing up security keys. Implementing a) would give us that. Devices that can be initialized with a given seed like some common hardware crypto wallets would give us that, albeit not without introducing changes to the threat model -- you have to store the seed and input it somehow -- and hhttps://www.yubico.com/blog/yubico-proposes-webauthn-protoco... would give us that as well.

The external dependency, for there to be organizations managing implementations for this 'sync fabric' makes the whole thing quite tenuous and subject to political manoeuvring and other unforeseen factors that come with maintaining hosted solutions.

Based on past observation of large tech companies, I just cannot see this happening:

> so it's interoperable beyond the major vendors.

(though of course time will tell.) Instead I only see this good-faith initiative being turned into a tool to further promote user lock-in to respective ecosystems and platforms.

I don't disagree that it will be hard, but I think that ultimately all that is needed for this to be possible is a standard TPM API that lets you export key material wrapped in a public key (corresponding to another TPM, presumably) only if it's signed by the TPM itself. This would let implementers build something equivalent to Apple's circle of trust (https://support.apple.com/guide/security/secure-keychain-syn...), and use the new API to share 'Passkeys' between devices.

Whether having an open syncing fabric is enough for vendors to want to interoperate with it I don't know, but if they ship TPM comformant hardware, you as a consumer would have the option to use either fabric.

I glossed over a lot of details and the implementation might not end up looking like that, but I believe something similar would be sufficient to kickstart the effort.

> The ability to share passkeys across vendors, including the ability to implement a "sync fabric" as some folks in the WebAuthn working group have called it, so it's interoperable beyond the major vendors.

This is a bit of a new challenge, because websites that consume authentication sometimes need to be able to reason about that authentication's strengths and risks. The models we use for this today, built around countering risks through multiple factors, are not set up to map to these new credentials which are abstracted by software and don't represent a single of the factors strongly.

It may be better to have third party sync fabrics that are cross platform, like a 1Password or Lastpass or Bitwarden, and indicate this so that the quality of the authentication can be reasoned about.

This is already true. iPhones, and Macs for the past few years, are so integrated with iCloud that losing access to your Apple ID is going to give you a very, very bad day. Apple clearly recognizes this with their work on physically pairing devices via iCloud.

WebAuthN is, on the whole, a very good thing. Cross-browser authentication that gets lifted up to a biometric or token level will reduce the vast, vast majority of customer support and friction to creating accounts. Additionally it reduces the dependence on OAuth2, having to "register" applications and requiring customers to remember "did I use Google to sign in here? Did I use Facebook?" etc etc.

Okay sure, but isn't that also true for password managers which Everyone Should Use?

Sane password manager uses a local database which you can't be banned from. You can easily make a backup of that database to some usb drive and put it into safe. You can't make a backup of your iCloud account and be sure that Apple won't ban you because you're living in a place that US does not like.

You definitely, 100% can make a backup of your iCloud Keychain and save it offline. https://support.1password.com/import-safari/

I'm sure the user who remembers to back up their password manager will also remember their Apple (or whatever) password. Parent was talking about failure cases of forgetting your "master password" - that's problematic regardless of the tech.

> You definitely, 100% can make a backup of your iCloud Keychain and save it offline. https://support.1password.com/import-safari/

Can you use it with webauthn after that?

> I'm sure the user who remembers to back up their password manager will also remember their Apple (or whatever) password. Parent was talking about failure cases of forgetting your "master password" - that's problematic regardless of the tech.

Apple password is not enough to recover access. Apple usually uses 2-factor auth.

> the user who remembers to back up their password manager

You don't have to backup your password manager separately if it is local. You just have to back up your computer.

>You definitely, 100% can make a backup of your iCloud Keychain and save it offline. https://support.1password.com/import-safari/ If and only if you have a Mac.

Does the service have access to your apple id email? I presume that it does which means that theoretically I should be able to restore access by sending a password link to that email.

That's presuming that user didn't use icloud email for his icloud account, of course.

They'll learn.

Apple needs to do better though, as always.

Reply on news.ycombinator.com