Hacker News Reader

Comment by Analemma_ | Hacker News Reader

[flagged]

What passkeys are isn't something that most people want.

I prefer passwords precisely because passkeys have achieved their design objectives. They are just not objectives that I share.

No, passkey export is intended to be a thing and is becoming a thing. I'm not sure if Microsoft has implemented it yet but here is Apple's version:

https://mobileidworld.com/apple-introduces-cross-platform-pa...

Someone should tell Apple; they’ve been cloud-syncing passkeys for years.

And yet people still need to share authentications between different devices (or people) and back them up for recovery purposes. If you're expecting only what you're saying, you'll find yourself simultaneously disappointed at how low the uptake is in the real world and how many major implementations (e.g. Apple) have a vastly different security model.

> And yet people still need to share authentications between different devices (or people)

Absolutely. The problem with narrowly targeted security measures is they are a poor fit for nearly everything.

No, their point is that they are absurdly long and not phishable. Point b is not practical for mass uptake, as hardware devices get broken/lost/stolen all thr time. And no, only nerds will have multiple ones.

Sounds like the sort of thing that will lock me out for any of a dozen different reasons.

Ya really what you want is your passwords saved in an encrypted vault that you can copy from device to device for backup. If passkeys are really one per device and you have have 100 passkeys from 100 different services, and moving to a new device requires accessing each of those 100 services to create a new passkey for the new device, that sounds terrible

> If passkeys are really one per device and you have have 100 passkeys from 100 different services, and moving to a new device requires accessing each of those 100 services ....

I'm typing this on my Firefox remote app. Everything is cached in it. It runs in a VM at home.

I suppose I am simulating having just one device.

Everyone else: don't do this

Why not? It actually sounds like the best way to use passkeys and still have control over them.

I've been super happy with it. My logins are always with me but they never leave the house.

> It actually sounds like the best way to use passkeys and still have control over them.

I belatedly recall that I tried to setup a Google passkey in a VM and was rebuffed. Google depends on Windows Hello for passkey presentation prompts - and Hello is disabled in an RDP session (ostensibly because facial rec won't be needed).

I poked at the problem for a while and couldn't find a workaround.

It's a safe, simple and secure config. I understand that's not for everyone.

It's simple and convenient, it may or may not be secure, it is not safe, it's fragile. I understand avoiding unnecessary single points of failure is not for everyone.

> it may or may not be secure

It is secure.

> it is not safe,

This is incorrect.

> it's fragile

This is incorrect. Many thousands of sessions over most of a decade all testify to to it's robustness and reliability.

> I understand avoiding unnecessary single points of failure is not for everyone.

That's an interesting segue.

If that means I lose access to my accounts if my device dies on me, then hard pass.

> The whole point of passkeys is that they are a) one per device

Hm, so then i need one for my account and one for every device where i use this account

> and b) stored on the device's secure enclave, where in theory you're never supposed to be able to export/exfiltrate them, only validate them

i heard that the new "device's secure enclave" is the cloud.

One per device you want to authenticate with. So for example you can use your phone to do the authentication for many other devices you own.

And if I want to share the credentials with my parents who I may not always be available to?

You can either share your passkey physically, or you can add one of their passkeys to your account.

The whole _point_ of Passkeys is that they are representable as clear-text data, and so they can be synced.

The WebAuthn _also_ allows device-bound keys, but they are not "passkeys".

> The WebAuthn _also_ allows device-bound keys, but they are not "passkeys".

True. WebAuth is good fit for a login that's tied to a user - and that user only logs into it from their workstation and maybe a laptop. There are better options when more flexibility is needed.

Happily, there are enough secure options that my phones will always be authenticator-free.

> The whole _point_ of Passkeys is that they are representable as clear-text data, and so they can be synced.

That seems to be counter to everything else I've heard about it so far. If that was the case, exporting would be easy, yet many password managers have had open feature requests for some time (1y+?).

I don't know what the truth is, but if you're right, there's definitely a lot of misinformation about it. Far more than correct info IME.

You can export passkeys from Apple and MS keyrings just fine. BitWarden and 1Pass also support exporting and cross-device syncing.

What is missing is the standardized interchange format for exported passkeys.

There are or were some people pretty deep into the scene who didn't believe this was supposed to be the case.

For example,

https://github.com/keepassxreboot/keepassxc/issues/10407

Migration protocols require the keys to be representable (at some point) as clear text.

And password managers like BitWarden only allow encrypted export, but the encryption key is specified by the user. So you can trivially decrypt the exported data if you want.

I don't have a dog in this race. Just showing where the other understandings come from. Your logic might lead one to conclude that migration would not then generally be available.

> So for example you can use your phone to do the authentication for many other devices you own.

No batery, no authentication.

Why do i need an additional device ? A device controlled by another vendor.

> The whole point of passkeys is that they are a) one per device and b) stored on the device's secure enclave

This is literally the opposite of what Passkeys are.

Reply on news.ycombinator.com