Hacker News Reader

Comment by slimsag | Hacker News Reader

The article seems to focus on YubiKeys (even despite using a mac device), but at least in the Apple ecosystem the state of the art is far ahead of plugging in a thumb drive style device IMO.

When I navigate to various websites that support Passkeys these days - Lowes, Home Depot, and handfuls of others - on iPhone (firefox) I am prompted with 'Do you want to use Face ID to sign in?'

If I do the same on macOS (firefox or safari, I'm sure Chrome does it too.), I am similarly prompted 'Do you want to sign in using a passkey?' and it gives me steps to use my mac's fingerprint reader or delegate to the iPhone Face ID to sign in on my Mac.

Combine that with Apple offering to use a private/hidden email address for signing up to the service in the first place and forward mail to your real email, plus the auto-generated secure passwords stored in the new Apple password manager.. and it's a pretty magical and secure experience as a user.

View on HN

I'm not at all sold on this experience for disaster-recovery reasons. I can put a backup Yubikey in a safe deposit box or other off-site location pretty easily and for relatively cheaply. I'm not gonna buy and put a backup laptop or iPhone in one.

If I lost all my devices in a natural disaster I want way to be able to get back in to accounts. And personally I don't want that to be cloud-dependent (bit of chicken-and-egg dependency story, it seems, plus a centralized weakness). I might be misunderstanding the device-as-passkey story, but the stuff I've read about it hasn't seemed to proactively answer that question.

Yeah, if your device is lost or destroyed and you rely on passkeys, you are well and truly f**ed. Your only hope is if you have recovery passwords stored in a password safe or manager. If you already have that safe or manager, than you can already very easily have 25+ character passphrases for every site you use, so what have passkeys gained you except having to be double-vigilant about having a recovery method for every login you create?

That’s not true. You can use iCloud keychain and have numerous recovery options, including other passkeys. A lost device is not a critical issue at all.

To your questions, the password safe can store passkeys as well. The entire point is to get to a place where we aren’t all dependent on some remote site’s security to keep our secrets safe. Why use a 25+ character password which can be compromised in a number of ways when a passkey doesn’t involve sending secrets at all?

a good passkey implementation allows multiple passkeys. you can have faceid on your mac, and you can also have a yubikey in a safe somewhere for disaster recovery.

also, passkeys get backed up in iCloud, so losing your device isn't really an issue. the disaster scenario is more what happens if apple locks you out of iCloud.

The main point of this article is that good implementations are few and far between

Most of my banks don’t support it at all, but the few that do still require SMS as a recovery mechanism. So it’s pretty pointless from a security standpoint.

Even O365 will keep pestering you to add a phone number for recovery if you go passwordless and remove your phone number. I think they may even force you to add it back in certain flows.

I think Apple has one the better impls and they went hard on account security after the rash of celebrity nudes were traced back to poor iCloud account hygiene. Recovery codes get sent to every device in the account with an option to decline, passkeys are first class citizens, and they don’t need to know my phone number for any of it

So whenever I create another account - I need to fetch all my yubikeys from remote locations to enroll them?

I mean if you have one or two accounts it's probably ok. My password manager contains hundreds of passwords. If I am to enroll hardware keys for each of them... Just no.

You need to be able to clone/copy/backup your keys. Enrolling multiple keys - is non solution.

Hi, to answer your hypothetical situation, what I do is save my passwords on apple passwords, and use two yubikeys as the security keys for the apple account itself (cool fact, apple forces you to use two keys as a safeguard, which I think is pretty cool and haven’t seen anyone else doing).

Disclosure: I work for FusionAuth.

When we implemented passkeys a few years ago[0], we chose to implement them as a purely secondary authentication method. So you had to have an account, then you added a passkey.

So you have the normal account recovery process if you need it, while you get the advantage of passkeys for improved, faster regular login.

That's obviously a tradeoff.

I wrote up a bit about this issue[1] last year but I think there's been some progress on standardizing backups of software passkey private keys[2]. The idea of syncing around a private key, no matter how protected it is, still makes me a bit queasy (as it seems you are) but I understand the motivation.

0: https://fusionauth.io/docs/lifecycle/authenticate-users/pass...

1: https://ciamweekly.substack.com/p/on-webauthn-and-passkeys

2: https://www.w3.org/TR/webauthn-3/#sctn-credential-backup

I'm surprised you had a working experience with passkeys. Every time my iPhone asks me to use a Passkey I just get "something went wrong" or some obtuse error message. It has never worked a single time and I just gave up.

Last I read, because it bit me with AWS console two factor, FF on macOS didn’t support pass keys. When did this get fixed?

Several months ago. Even mobile FF on Android supports passkeys now.

And I'm not using Apple's Keychain sync, instead I'm using BitWarden to sync all my passkeys across multiple OSes.

I’ll have to check again, thanks

So, anyone who can get your face on camera can access faceId?

It does a 3d scan of the face, so you can't crack it with an image or video.

it seems kind of bogus to me. You're going from using a cryptographicially secure device to using biometric data.

Biometric data can be copied and faked.

Phones have a TPM just like a USB security key. The face id on a phone based passkey is just the equivalent of pushing the button on the yubikeys.

So they need the physical device. You cannot clone the TPM parts that are in newer phones. The faceID just unlocks that hardware on your phone in the same way pushing the button on a yubikey sends the key up.

That's fair, but consider this:

1) The FaceID TPM is connected to the phone all of the time, whereas you only plug the Yubkey TPM into your computer when you need it.

2) The Biometric data that the FaceID TPM collects is available pretty much all the time when you use the phone. It's not like a fingerprint sensor where you would have to go out of your way to press your finger to it. If you can hijack the OS silently, then you can probably hijack FaceID silently.

It just seems backwards to me to replace a "simple" hardware token that you have to physically plug in with a massively complex internet-connected device. If someone steals your hardware token, you know.

I think a lot of people in this thread are assuming passkeys are passwordless. They are just the latest way to do what we used to need an external Yubikey for.

You can still set the settings on individual sites to ask for a password when using a security key (external USB or device based) if that's where your concern is. The whole 'skip password' thing was just there as a convenience for people who aren't worrying about physical and biometric access but do want the two factor auth (protection against phishing, by far the most common threat).

You can also set your phones unlock how you want too if you don't want faceID.

your face is the pin code, not the passkey.

it unlocks the cryptographically secure device, it doesn't replace it. to access your passkey through faceid, they have to steal your phone, unlock your phone, and then spoof faceID.

No, faceid unlocks a Cryptographic key stored in a TPM like device. Of someone can run arbitrary code on your iPhone, they can get it to unlock the TPM. If they can't, it would be challenging to fake FaceID right now. It uses a bunch of stuff, IR cameras, a depth camera I think, probably some kind of eularian video magnification for pulse detection. Possible to fake but expensive, probably need to hire some old-timers from industrial light and magic to do it with practical effects.

Or you mean literally hold the iPhone to your face, in which case they'd also need to force you to keep your eyes open. The greatest weakness of cryptography has always been that you can beat someone with a five dollar wrench until they unlock the system.

Reply on news.ycombinator.com