Comment by dcow | Hacker News Reader

Comment by dcow | Hacker News Reader

Parent Full thread

> Passkeys are an insanely overcomplicated solution we don't really need.

This is simply not true. WebAuthN is not overcomplicated needlessly (I wouldn't even call it overcomplicated, it's literally just a signed challenge/response dance). It improves on Passwords+2FA in a few notable ways:

1. It prevents shared secrets from traversing the wire.

2. It naturally enforces that users are all using secure authentication keys without password rules nonsense.

3. It kills 2FA by allowing Relying Parties to request user presence verification as part of the primary challenge.

4. It is origin-bound which mitigates phishing.

Passwords don't have any of these properties. And since your password manager handles the details for you, why wouldn't you want it to improve its implementation under the hood making things better for you with zero effort on your part?

I'm desperately looking forward to my password manager integrating support for Passkeys such that I can:

1. Back up my keys to paper and restore them from paper

2. Disregard/end-run around the "user presence verification" challenge if I want to.

I already deal with a ton of "acknowledge this push notification" or "type in this TOTP code" to verify, and automating every one of those interactions has lifted a huge amount of distraction and hassle from my everyday login-access dances interrupting me every hour or two.

I worry that more and more security people will make their orgs require authenticator attestation, which basically compares a burned-in cert against those certs blessed by FIDO. If too many websites submit to that stupidity, the idea that you can use your Bash-scripted password manager for resident key auth becomes a figment.

Now do the passkey (or is it webauthn?) failure modes. They are a nightmare as outlined in the top post in this thread by dmix.

They're no different than a password manager regardless of what shitty tricks Google is trying du jour.

That is all way more complex than you're acknowledging. I bet you that for the hundreds of millions of dollars that will be spent every year on all of that crap, and all of the pain it will cause in a variety of ways, it will prevent maybe 1000 actual attacks globally per year.

Security does not need to be an arms race. Good enough is good enough.

All of that is for naught if it's too much of a pain in the ass for normal folks to use.

Primary issue with FIDO is not the specs themselves but the extremely confusing nomenclature that FIDO put zero effort into clarifying.

Reply on news.ycombinator.com