Hacker News Reader

> Luckily, FIDO2 can fix a lot of these problems. People who don't have significant security needs can use a trusted service (currently Apple, Google, and a few small companies) rather than a physical device.

And from the article:

> “If I'm Google implementing passkeys, I cede a lot of control to Apple if my user is on an Apple device, I cede a lot of control to Microsoft if the user is on a Windows device, I cede a lot of UX control to Android and browsers,”

To me it sounds like Google, Microsoft, Apple, etc. seizing the last bits of control away from the average person. Everyone will be absolutely beholden to a few big tech companies. Using a fake name or birthday on accounts will be unthinkable because a locked account will mean losing access to your life and the only way to get it back will be to verify your identity which better match the info you provided initially.

We used to have outrage over things like using real names and now we've somehow fallen to the point where everyone is going to mindlessly accept a scheme that could easily morph into verified identities managed by private companies. Participating online will require a verified identity and everything you do will be mapped back to it.

shout out to all my friends celebrating their 123rd birthdays this year, according my Apple/iCloud shared calendars (1900 cohort)

> Having a business where you can go to a physical office and show up with ID so you can get your account back would solve this problem.

I've wanted something similar, combined with a tree approach to account recovery where the effort for recovery can vary depending on the importance of the account.

Say I lose access to my McDonald's account. That's not a very important account. It just contains some reward points that would get me some discounts at McDonald's. That account would be a leaf on the recovery tree. It's parent node would be my email account, currently at Fastmail. Recovery of my McDonald's account would just require responding to a recovery email McDonald's would send to my email.

My email account is much more important. Its parent node would be my domain name, currently registered at Namecheap. Recovery of my email account at Fastmail would involve demonstrating to Fastmail that I control my email domain.

My domain name is so important, since it is in the ultimate recovery path for so many descendant nodes, it would probably have at least two parent nodes (I didn't say anything about the tree having to be a binary tree).

They would be businesses that can verify my ID in person using government documents like my passport, and provide a way for me to prove that identity to third parties.

Banks would be good candidates to run such a business. Post offices would also be good candidates.

The protocol between the root verifiers and their direct child nodes could be a zero knowledge protocol so that the child node doesn't get your real identity and the root verifier doesn't know who the child node is. All the root needs to learn is that you are being verified for some site, and all the site needs to learn is that you are the same person who set up the account.

Such a zero knowledge protocol could also be good for age verification, which more and more jurisdictions are requiring from some sites. With such a protocol between the age verifiers and the sites you could have age verification without giving up anonymous accounts.

> My domain name is so important, since it is in the ultimate recovery path for so many descendant nodes, it would probably have at least two parent nodes (I didn't say anything about the tree having to be a binary tree).

If your domain name can have multiple descendant nodes and multiple parent nodes, is that still a tree?

Probably not. I should have said directed acyclic graph.

Actually I guess it doesn't even have to acyclic. You just need a directed graph where that has a non-empty set R of nodes such that (1) nodes in R do not have incoming edges, and (2) every node that has an incoming edge can be reached by some path that starts in R.

From what I can understand from the wikipedia page for the graph theory trees https://en.wikipedia.org/wiki/Tree_(graph_theory), what I'm used to calling tree ("computer science trees"?) are rooted trees, and what you described could be called a tree.

Which kind of makes sense, because a tree has stuff that branches out at the top (the branches) and at the bottom (the roots). The trunk has multiple parents and multiple children.

Definitions aside, I like your idea a lot. I feel like it's one of the few propositions that recognizes how important proving your identity already is, and how it will only become more important. The system is flexible and makes sense. It's the kind of thing that I think most people could understand, and thus use.

I’ve wanted to build something very similar for quite a while. Mind dropping me an email?

ic@fastmail-co-uk

Yubico has proffered a standard enhancement designed to enable FIDO keys to “automatically” enroll a paired backup when you enroll a primary key.

They wrote about it here in 2020: https://www.yubico.com/blog/yubico-proposes-webauthn-protoco...

I’m not clear on whether it has gained any traction, and it’s not something I see a lot of my peers in security aware of.

Wait - the way this works is you have a backup key, if you lose your primary you replace it using your backup. NB this is only needed when you move to a new device with a new secure enclave too, so at no point is this pizza situation likely.

Yeah, but you need to add all those secrets to your backup key. So you need to get it out every time you register somewhere.

I have to admit that I don't own an hardware security key. But since those let you use public key cryptography to login, you could at least theoretically use the same public key for multiple services. Whether the FIDO2 protocol lets you do that or not, I admit I don't know.

The keys are baked in to the devices and are tamper proof. So two devices means you have two different public keys.

I use YubiKeys for accounts I consider important and they're a pretty huge hassle compared to a password manager. I'm also scared to get rid of any of the old ones I've got just in case they're linked to an account I forgot about.

I thought you could generate a key on your PC and store it inside the YubiKey, are you sure it isn't possible?

It’s possible, at least for GPG. I’m not sure about WebAuthn. Regardless, generating the key right on the device is the most secure way of doing it.

It’s also hard to manage keys you’re loading yourself. Once I loaded a private key onto my YubiKey and accidentally failed to backup the private key because I used the wrong syntax when I exported it. I didn’t even realize until I got a new YubiKey and went to load my GPG keys onto it. I was only using it for signing, so it wasn’t a huge deal, but if I’d been using it for encryption / decryption it would have been a disaster.

It doesn’t, which would make disaster recovery a huge pain. You would have to register your backup key for every account you have.

The Apple/google “passkey” approach lets you use WebAuthn while having encrypted, cloud stored, private key escrow. It is much more convenient. Obviously with the downsides that implies.