Hacker News Reader

Comment by ChuckMcM | Hacker News Reader

I'll give you "site specific" but I'm less confident on "can't be stolen." If the computer can fetch them to use them something running on the computer can too. Of course even "site specific" is valuable in the "gmail account" or "apple ID" world. The last Kreb's article was something like $30 each for gmail creds.

Also my computer doesn't have a secure enclave because I'm keeping it disabled to prevent my machine from upgrading to Windows 11 :-). I wonder what it would try to do in that case.

That said, are people putting their cryptowallets in the secure enclave too these days? That would be new information for me.

View on HN

The key isn't fetched and never leaves the enclave. The enclave does the crypto functions.

Passkeys are meant to replace passwords for the average user. And they definitely succeed at that.

So in order to access a service your access device has to have a secure enclave that can enact this crypto?

Most modern devices do contain a hardware based Secure Enclave.

Because the technology is newish I would do some research before using it for anything really important.

> Most modern devices do contain a hardware based Secure Enclave.

So like Intel's SGX was so secure until it was not?

You have to start somewhere.

If my setup is secure enough that someone has to break SGX on my laptop to beat it, that's good enough for me. What is your threat model anyway?

It depends on the implementation, but I think that's the general idea. https://developer.android.com/privacy-and-security/keystore for Android, for example.

Or you can use an external hardware security key; the latest versions of most security keys (like YubiKey 5, Nitrokey 3, etc) support Passkeys. Passkeys are basically just U2F 2.0, allowing you to use an asymmetric key pair as the first factor instead of the second.

Thanks for that, Yubikey notes that you cannot copy passkeys (this is good!), but now I'm wondering if I can have multiple passkeys (for a backup key)...

That's up to each services to implement, but so far all the sites I use with Passkeys have my two Yubikeys registered.

What if you use multiple different devices? How can they share the key?

You can add passkeys for each device (e.g. Windows Hello) or use cloud-synced keys (iCloud, Google, 1Password, probably more)

Reply on news.ycombinator.com