Hacker News Reader

Comment by the_snooze | Hacker News Reader

Passkeys are effectively SSH keys under the hood. All implementions I've seen are two-factor as far as the user is concerned: the server challenges the client to prove they own a private key, and the private key is encrypted client-side under a password, PIN, or biometric.

View on HN

> Passkeys are effectively SSH keys under the hood.

Yes, that's the common rebuttal. It's resistant to MITM and phishing, but it's still not two-factor.

If you store your passkey on a yubikey with PIN, I suppose it's two-factor in the sense that you need the key and a PIN, but you can only store so many passkeys that way.

But why is 2FA superior? I understand that a yubikey seems more secure than the secure enclave of a computer, but that's a very specific factor (yubikey could incidentally be a single factor actually).

Is it just that more is better?

It's not so much that it's "more" in the sense of more of the same, like, e.g. requiring 2 different passwords. That's a waste of time. But 2FA makes the attackers job much more difficult. If someone steals my password or compromises a key, then they still need to hijack my SIM for SMS or steal my phone to get a code from my authenticator app. That's 2 completely different kinds of shenanigans that need to be successful.

How would a key compromise look like? A server-side key compromise just gives you public key material, which is useless. A client-side key compromise gives you an encrypted private key, but you've completely owned the client at that point so you've won already regardless of how weak or strong the authentication method is.

Traditional server-side 2FA (e.g., "give me a password and a 1-time code") is superfluous in a passkey world, because it's ultimately just a hack to make up for the fact that password-only auth is weak. Key auth is incredibly strong, so a server-side 2FA challenge doesn't buy you much.

The advantage of a physical second factor is that you need the physical second factor.

Put all of your passkeys in a single repo (as most people will), and you're literally putting all of your eggs in a single basket. Better hope nobody gets ahold of that basket.

non-physical second factors have no benefit in your view? I don't think either, just curious to know if that's your position as well.

Reply on news.ycombinator.com