Hacker News Reader

Comment by timr | Hacker News Reader

The big problem I have with passkeys is that, as currently implemented by ~everyone, they eliminate true second-factor authentication. I haven't seen an implementation yet that allows me to have something I know, and something I possess.

That, to me, is less secure.

View on HN

Passkeys are effectively SSH keys under the hood. All implementions I've seen are two-factor as far as the user is concerned: the server challenges the client to prove they own a private key, and the private key is encrypted client-side under a password, PIN, or biometric.

> Passkeys are effectively SSH keys under the hood.

Yes, that's the common rebuttal. It's resistant to MITM and phishing, but it's still not two-factor.

If you store your passkey on a yubikey with PIN, I suppose it's two-factor in the sense that you need the key and a PIN, but you can only store so many passkeys that way.

But why is 2FA superior? I understand that a yubikey seems more secure than the secure enclave of a computer, but that's a very specific factor (yubikey could incidentally be a single factor actually).

Is it just that more is better?

It's not so much that it's "more" in the sense of more of the same, like, e.g. requiring 2 different passwords. That's a waste of time. But 2FA makes the attackers job much more difficult. If someone steals my password or compromises a key, then they still need to hijack my SIM for SMS or steal my phone to get a code from my authenticator app. That's 2 completely different kinds of shenanigans that need to be successful.

How would a key compromise look like? A server-side key compromise just gives you public key material, which is useless. A client-side key compromise gives you an encrypted private key, but you've completely owned the client at that point so you've won already regardless of how weak or strong the authentication method is.

Traditional server-side 2FA (e.g., "give me a password and a 1-time code") is superfluous in a passkey world, because it's ultimately just a hack to make up for the fact that password-only auth is weak. Key auth is incredibly strong, so a server-side 2FA challenge doesn't buy you much.

The advantage of a physical second factor is that you need the physical second factor.

Put all of your passkeys in a single repo (as most people will), and you're literally putting all of your eggs in a single basket. Better hope nobody gets ahold of that basket.

non-physical second factors have no benefit in your view? I don't think either, just curious to know if that's your position as well.

The “something you know” is what handicaps passwords into being weak - they have to be easy to remember. And they have to be unique per service- because the website has to know the password too and websites get hacked. Because of this people basically have to use password managers. Because otherwise they set every password to “cat123” or “spring2024” etc.

And if people are generating good passwords and storing them anyway- we may as well store digital keys instead.

My password manager is still protected by a good password + 2FA. Passkeys will be protected by this as well. On my phone there is biometric that can replace the password as well.

How secure your passkeys are comes down to how protect them. But it’s definitely an improvement over passwords.

It's an improvement over passwords as long as two things are true:

1. Open source implementations will be indistinguishable to a 3rd party from the big tech versions (so that services can't refuse to authenticate devices that haven't been locked down), and

2. The private key can be extracted from the device by the user and backed up.

Why is #2 important? Passkeys break the 1:1 relationship between credentials and accounts, so just register multiple passkeys.

If it can be extracted, it can be stolen. Better to stick your secret material in a HSM that takes the key with it when it dies.

> My password manager is still protected by a good password + 2FA.

So yeah...your second factor is an actual second factor.

I completely get the argument that passkeys are an improvement for most people. But if you're already using password + pw manager + 2FA, it seems to me that you're a good bit more secure than a passkey alone.

You can usually password-protect your keys. That's 2 factors by itself.

That "usually" may exclude the two implementations that most people will use (but I doubt it), but it's a quite standard feature.

All the implementations i've seen do both, you "HAVE" your phone, and you "ARE" yourself because touchid, faceid, passkey was used to unlock the key on the phone/bitwarden/whatever your using the passkey on, you still have to unlock the vault on the device you have to use the passkey

"Thing you are" is not a replacement for "thing you know" because it can't be rotated (except surgically, and... nope)

There's really no need to rotate it because the biometric is only used locally. Your private key is kept encrypted at rest on your device, and a biometric (or PIN or password) is used to decrypt it during the passkey "do you have the correct private key?" authentication challenge.

The remote server only sees the result of the "do you have the correct private key?" challenge, not the biometric/PIN/password unlocking the private key that happens locally.

No-one's forcing you to use biometrics. Stick a strong password on your device and now it's guarded by something you know.

The ability to send SMSes or authenticate from your phone are both things you know.

No they aren't; not unless access to that phone (including accessing the 2FA functionality) is in turn protected by a passcode/passphrase that you "know".

Anyone with the right information can do either one. Including send SMSes: phone company customer support can let other people use your phone number.

Your comment isn't clear enough to make sense... it sounds like you are agreeing with me, but I'm guessing since you are replying you disagree.

From what i've seen every passkey implementation requires the device + a password or touchid or faceid to actually unlock the passkey authenticator... thats 2 things... the device key vault + your face

An image of your face is something you know. It's also a password that you can't change, and that is written down on a sticky note... on your face.

"Something you know" means something in your head that other people can't access, and that is protected by the 5th amendment. The image of your face is not; it's something other people see every day. So it's not "something you know".

The whole point is to not equate "password" with "touchid/faceid". The former is "something you know", and the latter are not. In the US, it's legal to get access to someone's finger or face. It's not legal to torture someone to reveal a thought.

Agreed - if you want true "thing you have", it needs to be a standalone hardware token, and it needs to be fundamentally impossible to extract the key from it. Otherwise, its key just becomes another "thing you know".

Reply on news.ycombinator.com