Hacker News Reader

Comment by lumb63 | Hacker News Reader

How is this, practically, any better than existing 2FA? A 2FA code is stored on a device just like a passkey is.

Passwords had a security and a usability problem, I guess, and so the solution was to add 2FA, which allegedly improves security. Now, we’re dropping the security of passwords to solve the usability issue. This doesn’t seem to be a big improvement to me.

View on HN

It's less secure than 2FA and more secure than passwords. How is it practically better than 2FA, because it's easier.

Given that most regular 2FA is implemented with SMS and doesn't even require stealing someone's device, I think passkeys are arguably more secure.

Oh totally. I was only thinking about the TOTP 2FA, for which I also have a giant rant about being user-hostile.

It's different.

2FA just means 2 factors.

Passkeys are just a factor. Usually a more secure factor than a password.

and the Passkeys requires to be secured by a PIN or biometric.

So Passkey = Something you have, PIN = Something you know.

A pin is not "something you know" legally. Biometrics are especially not.

Not saying you think this, just adding to the conversation.. the pin is to unlock that factor and passkeys should not be taken to mean that MFA for accounts is not needed.

However Google is saying this:

> this means that passkeys protect you against phishing and any accidental mishandling that passwords are prone to, such as being reused or exposed in a data breach. This is stronger protection than most 2SV (2FA/MFA) methods offer today, which is why we allow you to skip not only the password but also 2SV when you use a passkey.

> 2FA code is stored on the device

That's not how 2FA works.

I understand, but your statement feels pedantic. Practically, if someone has access to your device, your 2FA codes are compromised.

Yes, Passkeys do not offer much against rubber-hose cryptanalysis. Actually, it's a bit worse than passwords as it doesn't require captured human to be concious.

I believe Passkeys are great for those whose threat profile doesn't include physical assault risks.

You can use PIN for Passkey instead of Fingerprints

Good point.

What? It is how it works. The TOTP secret is stored on device which can be used to arbitrarily generate codes.

TOTP is not 2FA, but can be used for 2FA. What is the "secret stored on device" when SMS is used for 2FA?

Passkeys are stored in Secure Enclave on Apple devices, or on YubiKeys. Not sure about Androids.

> What is the "secret stored on device" when SMS is used for 2FA?

IMEI number?

When you request an SMS 2FA code, they're blindly sending an auth code to your phone number over SMS, that's all they know. That number could be registered to any SIM card which could be in any device. Someone could have socially engineered a rep at your carrier to have that number transferred to their device, which is a real thing that happens.

And the solution to that is? Disable SMS/phone number as 2FA? No, drop 2FA altogether for a more secure password...nonsense.

Reply on news.ycombinator.com