Hacker News Reader

Comment by MBCook | Hacker News Reader

Boy I’m so tired of people trying to make clever attack names. They don’t help remember things, there are too many.

So all 3 “pass-ta-key” attacks are not attacks on passkeys, they’re attacks on the Google vault.

And if you get access to the vault, then you get everything. OK. And if you get access to a synced traditional password vault, then you get everything.

So… meh. These are bugs, they will be fixed. Good on them for disclosing them. But this does not prove that passkeys are terrible. This does not make them less secure than random passwords.

If it wasn’t for the fact that they just happen to be getting passkeys, seems like this wouldn’t be worth a headline or discussing at all. And if they have this level of access, then they also get all the standard password credentials in the vault too, right?

View on HN

Have we standardized a way to backup and export passkeys yet? Do websites commonly allow multiple passkeys to be registered?

There’s FIDO CXF/CXP: https://fidoalliance.org/specs/cx/cxf-v1.0-ps-errata-2026030...

To my understanding both Apple Passwords and the Android equivalent allow you to export passkeys to a different app (password manager), but I haven’t tried it yet.

If anyone has direct experience I appreciate to know how it was.

I had a click around Apple Passwords on macos and I could not find a way to move my passkeys to another app. I could only see a way to share them with other Apple Passwords users.

I can confirm it works on iOS 27. I haven’t tried elsewhere though

I think it’s a 27 feature.

Those are the right questions: While I'd personally prefer full copy/import/export control, having the ability to set up an second key in advance is functionally-similar to having a backup of the first one. If I had my 'druthers:

1. All sites/services would allow the registration of 5 or more keys, which can be tracked/revoked separately. That way if one device is stolen, you can invalidate that key without affecting others.

2. There are two sets of keys: "Regular Use" and "Backup/Recovery".

3. Attempting to use a Backup/Recovery key prompts to user to confirm that they want to invalidate the Regular keys and promote the backup key(s) to the new regular. In this way, a compromised backup cannot be used in secret.

It's not functionally equivalent, but it is a workaround, but requires doing it on every site (if they allow it) and it cannot be freely moved and re-backed up offline from the site.

The actual reason is people have many devices. I assume this is at least somewhat common, but I still avoid passkeys so IDK.

You're designing a system where we should just be able to backup our own keys if we want to.

Also, can I add a backup key without having the private key with me? Ideally I would like to keep a master key in a vault, to recover compromised accounts and such, but requiring me to load the master key to create every account prevents truly secure storage.

From account security POV, it is better to disallow backup or export passkeys. Each device should get their unique key.

This would be quite bad from usability or privacy pov, I guess.

It's ao comically bad it proves the while thing is a joke unless you're trusting Apple or Google to sync and back them up for you. One cynical angle at why the backup is being slow-rolled is because the major players have an incentive to not do it. They want you dependent on them and locked into their ecosystem.

It's completely insane to treat a credential to an account as something that cannot be backed up. It implies there's another form of recovery, which likely means that key is only as secure as the other recovery options. And when it comes all the way back to the master key to your manager itself the loop falls somewhat apart.

It's a hard problem, but passkeys aren't ready for me yet.

>They want you dependent on them and locked into their ecosystem.

This is a strange conclusion to come to when clearly a lot of effort was put into developing an open standard (Credential Exchange Format) to make it easy and secure to move credentials between vendors/ecosystems, without opening end-users up to phishing attacks on credential export.

If big tech wanted to lock people in, it seems like it would have been a lot easier to just... not create an open standard.

Bug tech isn't a single entity. But I strongly believe a different group would have finished this obvious gap by now.

> backup / export

Last I heard this was a major point of contention between two groups, and last I checked, both had extremely valid concerns.

> Multiple passkeys

I commonly have two software and two hardware keys registered per site.

How is this easier than just using a password manager? Why not standardize the password input mechanism so they reliably update, etc.

I feel like all of the security of passkeys could have been build in a compatible way with new standards and enhancements to existing password interactions.

> How is this easier than just using a password manager?

Easy and Secure are often at odds.

I am using a password manager, I have a passkey saved in it. Should that service go down or have some kind of software problem with that passkey, I have physical ones which also can work for offline services such as my OS logins.

Why is a password manager a "service" it should really just be a program and as many encrypted backups as you want. Maybe you pay for them to host those backups, but that's a choice you should be able to make.

> Why is a password manager a "service" it should really just be a program

"Okay, my password manager is now a program. Oh no, program won't run. Not sure why!"

"Glad I have these physical passkeys! Also helps with those airgapped servers at work!"

I'm not against physical keys at all. I have one on my keychain. I'm against making things hard to maintain ourselves. Being dependent on Apple and Google to agree before we can own our own keys is what bothers me.

> And if you get access to the vault, then you get everything. OK. And if you get access to a synced traditional password vault, then you get everything.

No? It’s why 2FA exists. I have an email with password of 5 characters only and the password leaked decade ago, never changed it and no one accessed it because it has 2fa. I can share my whole password vault and I would not care about it because it’s useless without 2fa. Not the case with passkey, glad I never set it up on any of my accounts, pass+mfa is good for 99% of accounts (not sms obviously), rest are public private keys.

There is nothing stopping people from using passkeys with MFA. I’ve seen them do it. It’s against the suggestion, but they can do it.

Majority of second factors are phishable. If you are using a password (phishable) + a phishable second factor (any kind of 6 digit code that you need to type or paste into a text box), you are less secure than if you were using only a passkey.

Reply on news.ycombinator.com