Introducing passkeys in Chrome

https://blog.chromium.org/2022/12/introducing-passkeys-in-chrome.html

by aborsy • 4 years ago

120 206 4 years ago

blog.chromium.org

fud101• 4 years ago

does this work with yubikeys?

ac50hz• 4 years ago

Yes, https://passkey.org/

tedd4u• 4 years ago

Good to see this. Apple's WWDC video on Passkeys [1] has a good explanation of how passkeys work, including the nifty feature where you can use your phone to log in on a laptop without the laptop getting your credentials.

[1] https://developer.apple.com/videos/play/wwdc2022/10092/

kccqzy• 4 years ago

And what's more nifty is that the phone can be Android or iOS, the laptop can be Windows or macOS and it will all work.

knaik9424• 4 years ago

How is that different from password+2 factor? Logging-in is already platform independent.

knaik9424• 4 years ago

I don't see why I should be worried about storing and using credentials on my own devices. What would be the point, what threat does it protect against, and in what way is it more useful than using OAuth 2.0 "sign in with" feature?

taftster• 4 years ago

Logging into devices you don't own, for example.

nine_k• 4 years ago

The threat model: a device is stolen, the credentials there are poorly encrypted, credentials retrieved, used to access your bank account and siphon off all the funds.

FeistySkink2• 4 years ago

What's wrong with any of the existing methods of logging into my laptop?

zagrebian• 4 years ago

I hope Firefox gets this soon.

josephg2• 4 years ago

Any updates on passkey support in Firefox? Firefox seems to (still) only support hardware keys. (FF 107 / MacOS)

https://webauthn.io/

evolve2k• 4 years ago

I’m very glad to see passkeys coming especially for the contribution they make to improving user experience.

Concerned for the “Big tech” vendor lock-in this will likely facilitate.

Anyone played with this in Chrome yet?

How hard will it be to migrate away from Chrome with this in place?

tryptophan• 4 years ago

I also think passkeys are great and the future...but the issue of who controls the keys is really important to resolve.

If chrome holds them and never lets you export...then those accounts are not yours. They are Google's. No thanks.

knaik9424• 4 years ago

I think I got a prompt for this yesterday on a Google account, I was logging into an incognito window while connected to a VPN. I am staying away from enabling because it's not clear how to manage the private and public keys myself.

RjQoLCOSwiIKfpm4• 4 years ago

"A passkey doesn't leave your mobile device when signing in like this. Only a securely generated code is exchanged with the site so, unlike a password, there's nothing that could be leaked."

How to circumvent this in order to store the "passkey" in a regular password manager on the same desktop machine, not an external mobile device, so you can do proper backups of it and need no secondary device?

NOTICE: I am aware of the security implications. I don't care about them. I don't want any locked-down hardware to prevent me from accessing my own keys. I want control of my own keys.

aiiane• 4 years ago

You don't have to use a mobile device; you can just generate a passkey on a desktop machine.

punk_ihaq3• 4 years ago

Unless you're using Linux.

https://developers.google.com/identity/passkeys/supported-en...

ganbatekudasai3• 4 years ago

It sounds like you just want to continue randomly generated passwords, instead of passkeys? They seem to already solve exactly your problem?

RjQoLCOSwiIKfpm4• 4 years ago

Yes. But Google wants people to make a "transition", so I assume they will not allow passwords at some point in the future.

Dylan16807• 4 years ago

That doesn't prevent leaking, which can matter even if it's unique password.

kpollls• 4 years ago

you could also buy a hardware key like a Yubikey

RjQoLCOSwiIKfpm4• 4 years ago

"I don't want any locked-down hardware to prevent me from accessing my own keys."

punk_ihaq3• 4 years ago

Linux users be damned: "Chrome on Linux doesn't support passkeys with a built-in platform authenticator. Linux users can use passkeys from another device such as an Android phone or an iPhone by scanning a QR code."

No plans to support it either [1] https://developers.google.com/identity/passkeys/supported-en...

lll-o-lll7• 4 years ago

You just use your phone. Because otherwise you need a ton of OS integration to make this work, which I guess Linux doesn’t really care about (at least for now).

rektide2• 4 years ago

It's remarkably tragic how modern computer security regimes favor authoritarian centralized control so absolutely over allowing any flexibility or user choice or say.

stetrain31• 4 years ago

or any other password manager that supports passkeys

Hopefully they will allow third party password managers to provide these to the desktop browser, even on Linux. This seems to be how 1Password etc. are planning to support passkeys.

philistine• 4 years ago

Considering the Linux weirdos have equated a secure enclave with an overreach of kafkaesque proportion into their computer, I wouldn't hold my breath.

psanford10• 4 years ago

Fido keys work just fine on linux. There's already a fido authenticator that protects your keys using the system's TPM[0].

[0] https://github.com/psanford/tpm-fido

lll-o-lll7• 4 years ago

Google Password Manager, and the Apple equivalent, backup the passkeys for you. How they do this is fairly complicated. https://security.googleblog.com/2022/10/SecurityofPasskeysin...

You don’t have control of your keys exactly, but Google can’t see your keys either and you can survive device theft/failure and transfer to a new device. So it’s pretty good in my opinion.

knaik9424• 4 years ago

If I don't control my keys, they are not my keys. It seems more limiting and worse in practice than what it's supposed to be improving on. Google already encrypts my password in password manager, it already can't see my password and can't generate my 2 factor. Being fairly complicated is not a good excuse to let Google manage the keys for me.

codedokode16• 4 years ago

The article doesn't specify how the backup is encrypted, but it says that in can be decrypted with a PIN or unlock pattern. These are weak keys and can be easily bruteforced by Google.

Also if you get banned from Google then you might lose access to your keys.

josephcsible4• 4 years ago

How are you supposed to make use of those backups if Google decides to unperson you?

stetrain31• 4 years ago

1Password has announced support for PassKeys:

https://www.future.1password.com/passkeys/

It would make sense that other password managers could also manage PassKeys as long as they have an extension to integrate with the browser.

varjolintu2• 4 years ago

KeePassXC already has a development branch where WebAuthn is supported in both extension and KeePassXC, so the keys will be stored to your database and can be exported/imported normally. The support needs to be extended and tested for Passkeys also. So yes, controlling your own keys is possible. Browsers just wanted users to use their own walled gardens.

abdullahkhalids• 4 years ago

What is interoperability like and does Chrome employ open standards? If I generate a key in Chromium, can I use it in some other browser that supports passkeys?

cokeandpepsi• 4 years ago

It's mostly WebAuthn isn'it it?

josephg2• 4 years ago

You can noodle around with it on https://webauthn.io/ . Keys will sync within ecosystems - so, if you login with safari on iOS, the same credentials show up on desktop Safari on a mac. That doesn't seem to work between Chrome and Safari, but you can scan a QR code to sign in on chrome using a passkey on your phone.

Right now I'm not sure if this stuff good enough to use instead of passwords. I'd want Firefox support, and preferably built in support in 1Password too. But it might be good enough to use alongside passwords. We need to collectively figure out how to do that. (Do you get a password and a passkey? Or just a passkey & reset via email? How should the user flows work? Any good examples?)

NikolaNovak• 4 years ago

I don't understood this. I keep not understanding this.

What's my basic authentication method to a site or system I can write down, backup, export or memorize? What happens if I go naked to a friend and want to use their devices to access my systems? What happens if I lose one or more of my existing devices? What happens if I get locked out of one or more of my devices? Basically am I the only one who doesn't think phone is my life and I don't want my life to be over if I lose my phone?

I feel like I'm in a twilight zone of phone dependencies. Already so many systems refuse to let me in if I don't have my phone with me due to sms 2fa I didn't ask for, even though I have dozen other devices and valid credentials. Now we just want to stop pretending and just lock me in to phone forever? My phone goes with me everywhere I go and is super likely to get lose broken or stolen. I don't want it to be a dependency to my online access.

p-e-w8• 4 years ago

What's my basic authentication method to a site or system I can write down, backup, export or memorize?

There isn't one. This is by design. Logging into your bank or email provider will in the future require mobile device shenanigans that are either proprietary or so complex and opaque that you have no chance of "controlling" anything, or even really understanding what's actually going on.

The main lobby driving this forward consists of Google, Apple, and Microsoft. This should tell you all you need to know.

stetrain31• 4 years ago

Which part of passkeys / Webauthn / FIDO requires a mobile device?

mynameisvlad9• 4 years ago

What part of WebAuthn, a W3C standard, is "proprietary or [...] complex and opaque"?

The FIDO alliance also consists of far more companies than just "Google, Apple, and Microsoft", although they're certainly members. https://fidoalliance.org/members/

stetrain31• 4 years ago

Do you use SSH keys?

This is SSH keys for signing into websites.

Which, yes, means you need at least one device in your possession containing your private keys.

1Password has already announced support for storing and syncing passkeys. Apple and Google also allow you to sync them via your account.

Nothing ties it specifically to your phone compared to any of your other devices or an online account/vault that you store your keys in.

XorNot• 4 years ago

I can print out my SSH key and store it in a safe, or freely copy it between systems. All of these services are intended to prevent that by using on device secure enclave functionality and the like - it puts control the keys out of my reach.

p-e-w8• 4 years ago

This is SSH keys for signing into websites.

No it's not. It's a shackle that will tie users to two or three platform providers (Google, Apple, and Microsoft) because websites will refuse to interoperate with implementations that aren't from those.

"Your browser is currently unsupported. To log in to your Amazing Bank account, open this website on your Android or iOS phone and place your finger on the home button."

Just because the underlying cryptographic primitives are similar to SSH, doesn't mean this will work anything like SSH in practice.

FeistySkink2• 4 years ago

I'm in the process of migrating to a new phone. My old phone had an eSIM that was tied to some 2FA (not by choice, and it couldn't be changed, because security), and my temp phone doesn't support an eSIM, so until the new one arrives I can't access some services. You don't even need to lose anything to be locked out.

knaik9424• 4 years ago

Did you not keep any of the backup code? I am not sure why 2FA is related to the eSIM unless you mean certain services force using SMS as the method to receive 2FA. I have experienced that same restriction with financial services in the US. I agree, it's frustrating and feels counterproductive to security because it could motivate someone to borrow a friend's device temporarily to access the services. eSIMs are even more annoying as there is a limited amount of times you can switch devices.

bakugo4• 4 years ago

Basically am I the only one who doesn't think phone is my life and I don't want my life to be over if I lose my phone?

A huge percentage of internet users today don't own any devices other than their phone and most big corporations like Google want that percentage to become 100% in the near future because it's within their best interests if users have no control whatsoever over the device they rely on to live their life.

lettergram2• 4 years ago

Imagine when google bans you like people get banned off Twitter…

“sorry your keys were revoked on chrome for an attempted search on an unauthorized topic” (so you can no longer access your bank website)

I imagine it’ll even get more dystopian as mistakes / bugs will happen and Google has no tech support

stetrain31• 4 years ago

Then don’t store/sync your passkeys with Google.

pronlover7232• 4 years ago

I don't know where you get the idea that a mobile device is needed

alanfranz• 4 years ago

It is bad when the dependency is phone only. Example: 2FA codes based on HOTP/TOTP are printable & exportable already, and you could use them on an external devices that are not a phone.

Passkeys are based on FIDO standards, so I believe a phoneless approach should work as well, given the proper device is available.

The bad part is that plenty of bad implementations exist for such external devices. For 2FA many, too many places allow just one device "for security" - which is total bs, of course. This was true for AWS until a couple of years ago, I didn't check this recently.

Google and Github get this right; but a lot of other parties just don't.

vouaobrasil2• 4 years ago

The problem with passkeys is that you need your phone to use them. The more it is adopted, the more likely technology will only work with them in the future. Thus, we will be more tied to our mobile devices. No thanks.

stetrain31• 4 years ago

Why does it need a phone? It's like SSH keys, you just need access to your keys from where you are logging in.

They give the example of using your phone because that's a convenient portable key vault you may have with you. But if you want to keep your keys just on a desktop or in some other password manager that integrates with the browser I don't see any barrier to that. 1Password for example has already announced passkey support.

vouaobrasil2• 4 years ago

Hmm, I didn't know that. Thanks! When I watched Apple's video on passkeys, it seemed to imply a phone was needed.

encryptluks2• 4 years ago

I don't believe you do. You just need an app that supports passkeys, but I could be wrong. The notice says that it integrates with other password managers.

knaik9424• 4 years ago

I realized I got prompted to start an enroll for this yesterday after reading this webpage. I reacted exactly like this first bullet point:

"Some users may be surprised if a biometric authentication suddenly appears on a website or an app and think this is sending sensitive information to the server. With passkeys, the user's biometric information is never revealed to the website or the app. Biometric material never leaves the user's personal device."

Having a notification asking me to enable Bluetooth immediately concerned me even though it was clearly the genuine prompt you get get when Google asks you to sign-in by accepting a prompt on a phone.

I don't see myself using this authentication over pass+2factor even though it should be safer because of 2 main reasons. I avoid turning or keeping Bluetooth on and I don't see a clear way to manually control and export the passkey private key. I understand that it's synced via the OS and Google's password manager, but I don't trust it unless I can back it up and restore it to a device myself.

Is there an open, Google independent implementation like Aegis is for 2 factor?

If I can't control and manage my private keys, it's not my private keys. The more I read about this, the less this feels like an improvement to pass+2 factor. Phishing attempts are easier because Banks don't allow non-sms tied 2 factor authentication.

Thinking of this like SSH key based authentication for website made the value of this clear for me. But I don't want my passkey dependent on my Google login.

https://developers.google.com/identity/passkeys

stetrain31• 4 years ago

Nothing about passkeys needs to be tied to Google. You can use other password managers, and it seems like the major players are all supporting the same standard.

For example you can use 1Password: https://www.future.1password.com/passkeys/

If they can do it, other password managers both cloud and local should be able to do this as well.

knaik9424• 4 years ago

I look forward to that, but as it stands currently, only Google and Apple's password managers are supported. All of the support documents mention its tied to the OS and linux support isn't planned. The table on this page shows there are no plans of "Local user verification" or "Passkey sync" when using Linux.

Additionally it also states that to access the passkey, you need to log in to the given Google account.

"Passkeys generated in Chrome on Android are stored in the Google Password Manager. These passkeys are available on all other Android devices as long as Google Password Manager is available and the same user's Google account is signed in."

https://developers.google.com/identity/passkeys/supported-en....

psanford10• 4 years ago

There are a number of opensource fido key implementations already. There will be opensource passkey implementations.

nmeagent• 4 years ago

With the latest version of Chrome, we're enabling passkeys on Windows 11, macOS, and Android.

Notable absence of GNU/Linux. If I used chromium, I'd feel like even more of a second-class citizen.

TheBrokenRail• 4 years ago

This all seems really cool, but right now I'm just dreading when some site inevitably start forcing you to use it out of some misplaced desire to protect the user from themselves.

It's my account, it should be my choice whether to make the security/convenience tradeoff. Sometimes I just want to use a plain password, stick it in my web browser, and forget about it.

kosherhurricane• 4 years ago

I have a novice question:

If I create a new passkey using Chrome on a Mac, is that passkey stored in chrome (via google account) or on MacOS iCloud Keychain?

Would I get to pick one or the other?

codedokode16• 4 years ago

Password authentication is an example of bad UI design (they are hard to remember and easy to forget), but passkeys are not great either. They have at least three weak points:

First, they are stored in a phone internal storage. This is not secure because phones have complicated software with large attack surface, and if an attacker finds a vulnerability, then they can gain access to all private keys on that device. If the phone is lost or stolen, then the keys can be recovered by reading phone's internal storage. Even if the keys are protected by a PIN, the PINs are usually short and can be easily bruteforced. If they are protected by a fingerprint or biometric lock then I assume that they are not encrypted at all.

Second, to synchronize keys between devices, private keys are uploaded to Google's cloud [1]. The post metions that they are end-to-end encrypted, by doesn't specify any details. However, it says that the keys can be decrypted on a new device if the user provides a PIN or unlock pattern:

To recover the end-to-end encryption key, the user must provide the lock screen PIN, password, or pattern of another existing device that had access to those keys.

This means that keys stored in Google cloud are either not encrypted or use weak encryption keys that can be easily bruteforced by Google.

Third, synchronizing keys relies on Google's infrastructure. If you ever get banned from Google, you will lose the ability to synchronize keys, and maybe access to them as well.

So instead of promoting secure, easy to use, vendor-independent, cheap hardware keys, Google suggests that everyone stores their private keys either in a Google cloud or on devices where Google has root access. I don't think that it's a great idea.

[1] https://security.googleblog.com/2022/10/SecurityofPasskeysin...

Also, I don't like FIDO standard because it requires attestation of hardware keys and doesn't allow to use DIY keys for example.

yencabulator4• 4 years ago

PINs are usually short and can be easily bruteforced

The tamperproof hardware compartment storing that data is supposed to rate limit the guesses (and maybe lock up after too many tries).

Ask FBI how easy it has been guessing iPhone PINs.

greatgib9• 4 years ago

Annoying points with passkey is that one way or another, your creds (ie the passkey) has to stay on your device/app or you are fucked. Good thing with password is that you can have it not stored on any device and just used when you need. Gives you plausible deniability.

Also, now your chrome passkey/password manager has all your creds. Protected only with a single thing (password/biometry). Imagine your are at the Chinese or US border, and tsa is overreaching: with just your finger they can access to all your accounts: Facebook, twitter, Google, Dropbox, ...

You can't temporary delete from a device and readd without redoing the whole setup with the website. To create a passkey on Chrome for Android, you need the Google Play services beta. Otherwise the call to navigator.credentials.create() below will fail.

You see it the moment where apps and websites will not work without the Google play ecosystem just before they added a new lock in?

Also, I can see in advance that most website will only accept a single passkey public key per account. So you can't have one on each of your devices or even easily randomly connect from different web browser to the same site.

stetrain31• 4 years ago

Or use a third party password manager where you can export the keys to some other storage if you wish, or apply other security measures to access those keys?

greatgib9• 4 years ago

Last but not least, now, even in private browsing the public key used could easily tell which device you are using.

stetrain31• 4 years ago

How so?

rektide2• 4 years ago

It's just jaw-dropping how naive passkey has been in trying to pretend browser implementers can do the right thing for users, when the vast epic & total security threats you describe are so readily & obviously apparent. The unwillingness to support real security keys as is the case with linux is just further fuel on the pyre of what a shit not-actually-pro-user attempt this new regime really is. It's all so mediated, so centralized, in big cloud shit.

There's this anti-user mania that users will fuck everything up so we absolutely cannot let them do things like export keys. But this chicken-little sky-is-falling pretense just keeps being an excuse for bad tradeoffs that in no way favor real actual people at all.

jackson1442• 4 years ago

Maybe we're having different experiences on the web, but I've found that there is _significantly_ better support for security keys on the web than there is for Passkeys. Many sites will give the option to use either but only registering security keys actually works.

greatgib9• 4 years ago

Another terrible thing coming to my mind, by definition you will probably not have 2fa when you connect with passkey.

So, now think about Google chrome feature of "backup user passwords" that they always try to have user enable automatically without noticing. And that is not e2e encrypted so they can access any of them along with your wifi passwords.

Will they not save the passkey there for sync with other chromes? Because otherwise it will be directly game over for the normal user. Any google employee or gov or hacker will be able to connect to your accounts even without 2fa. A lot better for them that the current situation with passwords and 2fa.

mynameisvlad9• 4 years ago

You still have 2 factors:

- Something you own, your device with a passkey on it

AND

- Something you are, your biometrics

- Something you know, your PIN

Either of which you need, at least in every single implementation of passkeys I've used.

yencabulator4• 4 years ago

Annoying points with passkey is that one way or another, your creds (ie the passkey) has to stay on your device/app or you are fucked. Good thing with password is that you can have it not stored on any device and just used when you need.

The key is just a bunch of random data used as a cryptographic private key. You could make an authenticator that argon2id's a passphrase to generate the private key, to go back to the world of passwords.

Meanwhile, the average person using passkeys will become immune to phishing.

chrismarlow9• 4 years ago

Look on the bright side: implementing, supporting, and fixing this over the next decade means job security for everyone here.

Shank• 4 years ago

I see a lot of negativity and skepticism in the comments, and I think it's worth saying quite strongly: if you're reading comments on Hacker News, you're a power user, and you already probably have a good password management system. Either you're superhuman and memorize thousands of different passwords per site, or you have a generator or other system for generating unique passwords and storing them. You may also have security keys, TOTP generation, and an innate ability not to be phished.

The reality is the vast majority of the globe does not have any of these traits. People create bad passwords that are reused all the time. People willingly disable 2FA for convenience, or get phished. In attacks over the summer, we've seen people take bribes to just give over passwords and 2FA codes. Passkeys are predicated on a 2FA-by-default philosophy that solves a lot of real-world problems the vast majority of people have. This is a huge win for normal people who use an Android phone or an iPhone in the default configuration and just need to login to places. It may feel like it's too heavy of an instrument for you because your solution is more convenient and well-understood, but most people struggle with this on a day-to-day basis. In my book, passkeys are still not perfect, but they definitely are better than passwords for 99% of the world.

josephcsible4• 4 years ago

We already have regular WebAuthn to fix that problem properly. Passkeys feel like a way to abuse WebAuthn to lock people into your ecosystem forever, on pain of losing all their online accounts.

knaik9424• 4 years ago

If people are going to be using default settings, why not just push a lot harder to force non sms based 2FA? Salted password+2FA should practically match any security benefit being attributed to passkeys. My University forced the entire student and staff population to enroll in Duo 2FA a few years ago and staff/faculty can get a hardware key if they request one. 2FA is required at every single point a University login exists. Everyone just got used to it. I even have to use 2FA when logging in to the VPN using Cisco Anyconnect, there's a third field that says "Duo Action" and it used to say "Second Password" and the options are using a backup code or the word "push" to get a mobile notification.

The fact that passkeys are supposed to replace password and TOTP feels like a security risk. I understand that the phone uses a security enclave or TPM along with a pin/pattern/biometrics to attest a valid 2FA unlock, having it be tied to a mobile phone feels incorrect. I understand that's how it's set up for the vast amount of people already, but shifting from potentially separate devices for TOTP and Pass to a single device for everything seems weaker.

I understand that power users are not the target, but the issue of vendor/device lock based on attestation and not allowing DIY keys. Moving from a piece of information I know like a password, or even an SSH key/cert I print out, to a "password" of a private key even I am not allowed to read feels less secure. It's not a matter of convenience, it's a question of giving up control of key generation and syncing to a third party. From a standpoint of opsec, not having control of your private keys is a much bigger weakness relative to a compromised password. Changing passwords is trivial, but changing a device secured private key is impossible.

Passkeys don't fix the bribes or 5$ wrench loophole [1]. Unless you force users to only use biometrics and pin/patterns are disabled, passkeys will have the same issues that passwords do. In a world where getting people to understand 2FA is hard, it feels short sighted to depend on Bluetooth protocol dependent authentication. Trying to get people to shift from the convenience of a password to the inconvenience of needing to mess with Bluetooth is going to be its own headache. When the topic of needing a superhuman memory to remember passwords comes up, I think of https://xkcd.com/936/ . The conspiracy theorist in me can imagine companies like Netflix forcing passkey reauth every 15 days in order to combat things like password sharing. I respectfully disagree and believe passkeys will serve mostly as an inconvenience for the world. I am struggling to see the use cases where passkeys are meaningfully better than passwords and 2FA unless the use passwords is completely discontinued. And phones would become an even bigger single point of failure. A broken phone would be the same as losing all of your 2FA keys, there would be no password to help demonstrate account ownership to support.

[1] https://xkcd.com/538/

codedokode16• 4 years ago

A better solution would be cheap (less than $1) hardware keys, not locking people into Google/Apple ecosystem and allowing them to decrypt the keys when asked nicely.

Also, on Android Google's passkeys can be stolen if an attacker gains root privileges. Hardware keys without an OS are much more difficult to hack into.

josephcsible4• 4 years ago

A lot of people here aren't differentiating between WebAuthn, a good thing that basically solves phishing, and these new implementations of it, bad things that lock you into one vendor's ecosystem forever because you can't log into your accounts from other operating systems anymore.

psanford10• 4 years ago

You are not locked in. You can create a passkey in ios, on an android phone and on your desktop for the same website.

This is going to accelerate the adoption of WebAuthn across sites on the internet. I consider that to be very good. You can benefit from the better security that your accounts will get from WebAuthn without ever using a synchronizing passkey.

nigamanth2• 4 years ago

I don't understand this, to be honest the more complicated it gets for the user, the more the user gets locked out by themselves. We need a simple username + password thing with an option for 2-factor authentication.

Not a madness of lock screens, passkeys, and all this nonsense. Google shouldn't add this in Google Chrome.

aborsy• 4 years ago

The private keys are encrypted when synced from one device to another. The key for this encryption seems to be a short PIN or biometrics.

Is that true?

If yes, the platform provider can easily decrypt the encrypted keys on their servers.

If not, what’s the other secret known only by the user that encrypts the passkeys in transit? I hope the option of a password is provided.

Further, a closed source unverified password manager such as the iCloud Keychain doesn’t sound a great idea. I could use passkeys in Android (and if there is no external hardware key support), but not on Apple’s platform.

stetrain31• 4 years ago

Apple supports third party password managers at the system level on iOS and as browser extensions in Safari.

codedokode16• 4 years ago

Is that true?

It seems so. The article [1] mentions that you can copy the keys to a new device and you need only a backup stored in a Google cloud and PIN/unlock pattern which are easy to bruteforce:

In some cases, for example, when the older device was lost or damaged, users may need to recover the end-to-end encryption keys from a secure online backup.
To recover the end-to-end encryption key, the user must provide the lock screen PIN, password, or pattern of another existing device that had access to those keys.

So it means that Google and their friends from government organizations will be able to decrypt cloud backups easily.

[1] https://security.googleblog.com/2022/10/SecurityofPasskeysin...

nunez• 4 years ago

for those concerned about vendor lock-in, 1password and others are working on ways to support passkey auth. it's an open standard.

ohCh6zos• 4 years ago

So far all of these solutions involve the cloud in some way, including 1password. Why would I store my passwords in the cloud?

pronlover7232• 4 years ago

this entire comment section is so full of BS! People ranting about stuff they don't understand and coming up with random conspiracy theories that have no basis in reality

PassKeys are NOT proprietary. They're a standard. You can implement it yourself if you want or use several other implementations not run by FAMG.

Here's a video on how it works

https://www.youtube.com/watch?v=SWocv4BhCNg

* Can I share the keys between chrome, firefox, and safari?

You don't need to. That's not how it works. Chrome, Firefox, and Safari and every device will have a different key for the same service (see video)

* How do I share keys between different types of devices? (mac, ios, android, windows)

You don't. You authenticate and a new key is created on each device, possibly on each piece of software (Firefox, Chrome, Safari, App). To be more clear, when and if you decide to use a service from a new device or new browser you'll be asked if you want to login via passkey. If you have a passkey on another device you can (see video) use that to login from the other device (similar to how google asks viat the gmail app of you were trying to log into some other device or Apple asks across your device). After you authenticate you can then create a new passkey for this device/software you're using. This new passkey is separate from the previous passkey. You effectively have 2 passkeys now, one to login with one device/software, one to with a different device/software. (See video)

* What happens if my devices are gone?

You follow whatever recovery procedures the service has, just like if you forgot your password.

* What happens if I want to change my login (email to a new email for example)?

Unrelated. Your email is not shared with passkey. So login and set a new email

* What's the difference between a password and passkey?

A password can be use by any one from anywhere. A passkey can only be used with the piece of software/device it was associated with when created. A passkey is useless if stolen/leaked

shortcake272• 4 years ago

What happens if my devices are gone? You follow whatever recovery procedures the service has, just like if you forgot your password

Are you sure? If so, why? Passkeys are advertised as a replacement for username + password + 2FA. Current practices generally allow for a password to be reset via email, but not MFA, as half the point of MFA is to protect against password resets. So the reset process for a passkey can’t be the same as a password otherwise you don’t have “real” MFA.

I feel that account recovery is either going to get a lot harder (eg KYC for what would have been previously been an email), or services will enforce additional data collection (eg phone number) to aid recovery. Neither of these are good.

knaik9424• 4 years ago

I don't see what benefits a passkey has over using a password+TOPT/HOTP 2 factor. It seems like this is trying to solve a problem that has been becoming less significant over the years as more and more people use 2 factor properly and websites properly salt passwords. The current marketing doesn't properly show the need for this. I am not worried about a single password compromise because I don't reuse passwords and there is no risk my non-sms 2FA being compromised.

It seem more like how I have to enroll my device to Duo if I want to use it for 2 factor to log in and Duo using a proprietary implementation locking me into their software. As it stands, despite this being an open standard, Google has made it clear it has no plans to add support to linux for "Local user verification" or "Passkey sync".

The idea that Google will one day push users to only use passkeys and phase out passwords isn't unfounded. It's clear that Google would be motivated to make such a push. The reason people are concerned is because using Google ties the passkey to your Google login. From what I recall, Google also used a proprietary method to generator TOTP/HOTP making it impossible to use third party authenticators to log in to Google. Google Authenticator is open sourced but hasn't been updated in over 2 years. I believe Aegis supports Google Accounts so it can be used instead of Authenticator.

I understand this from the more basic SSH authentication using a generated public/private key. I am also aware of Yubikeys, which are also open, but I have chosen to continue using passwords because I want complete control over my private keys.

This is informed and healthy concern for a new implementation of security protocols.

shortcake272• 4 years ago

I can see a benefit for users who don’t use password managers / 2FA, but I can’t see a benefit over a strong random password + TOTP. Only difference is that with a password + TOTP you’re in full control of both the password + recovery codes. So you can get your accounts back even if you lose access to your password manager. With passkeys you have no control over anything, so if you lose access to your password manager you’re finished. Seems worse.

codedokode16• 4 years ago

what benefits a passkey has over using a password+TOPT/HOTP 2 factor

The benefit is that you don't need to remember different password for each site. However, it seems that passkeys are not secure, can be stolen by an attacker with root access or silently decrypted by Google. The better solution is hardware keys independent from Google.

codedokode16• 4 years ago

They're a standard. You can implement it yourself

You can make your DIY authenticator, but websites might choose not to trust your self-signed attestation as it is not "secure".

Also, as I understand, passkeys stored on an Android phone can be stolen by an attacker with root access or by Google if you use biometric lock or PIN or lock pattern.

tomjen3• 4 years ago

If you have to create a new passkey for each new login, sooner or later that will not be possible.

psanford10• 4 years ago

Passwords have had a good run but on the modern internet they are a failure. 99% of the population uses the same bad passwords everywhere. We've tried to get people to behave securely with passwords but it just doesn't work. Its not their fault! Humans did not evolve to remember long distinct random strings. It is unfair to expect humans to never be tricked into typing their password into the wrong website.

Its time for something new. I think WebAuthn and passkeys have a real shot to let us finally move onto a better form of authentication than passwords. They have real security benefits and hopefully usability benefits.

I know that there's a lot of distrust of Apple and Google here when it comes to passkeys. But seriously this is not a giant ploy to trick you into buying an iPhone/Android. You can use a yubikey on sites that support passkeys. You can use an opensource solokey. You can use a software based fido key. You can use a an opensource tpm-fido authenticator. There will be opensource passkey implementations that support roaming. The standards are all open and there's nothing blocking interoperability. This is not a locked-in ecosystem.

We've given passwords a good long try. They served their purpose but now are showing a lot of downsides. We need to be serious about looking for better alternatives that serve our end users. Passkeys is a good attempt at that. Lets give it a shot.

knaik9424• 4 years ago

The current implementation shows that there is already an issue of openness. Requiring Apple or Google's password manager to manage and sync the passkeys is an issue. Google explicitly stating there is no planned support for "Local user verification" or "Passkey sync" shows they don't plan on support interoperability. A company following proper password hashing protocol means that repeat passwords isn't an issue. Pushing for 2FA using TOPT/HOTP protects people who reuse passwords and accidentally has one compromised.

Until open source, free roaming, implementations of passkeys exist that expose the private key to the end user, it's effectively a locked-in ecosystem. I still haven't seen a good reason to replace tried and tested pass+2fa with passkeys. A simple push to force non-sms 2FA is an existing solution to the problem passkeys is attempting to solve. A compromised password is much less valuable now than it was even a few years ago. Even if you miss when a password was compromised, companies that care about security have started sending those "a new login was detected" emails that would alert you of any concerning activity.

psanford10• 4 years ago

TOTP/HOTP is phishable. Webauthn is not.

Until open source, free roaming, implementations of passkeys exist that expose the private key to the end user, it's effectively a locked-in ecosystem.

As I said above, there already are free implementations of FIDO keys that give you control over the keys.

Tigress8780• 4 years ago

While WebAuthn is an open standard, but the fact that it explicitly provides attestation API [1][2] and related database that can be used to verify devices [3] is already worrying.

Site owners really have the option to lock you into one or a dozen of ecosystems should they decide to. It is entirely possible that your home-made hardware key or software password manager will be disallowed from logging into Google or Apple.

For example, Cloudflare actively uses the attestation feature [4] to replace captchas, and they probably only allow a few manufacturers.

[1] https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...

[2] https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Gu...

[3] https://fidoalliance.org/metadata/

[4] https://blog.cloudflare.com/introducing-cryptographic-attest...

thedougd• 4 years ago

I have research to do, but I've been struggling a bit with the introduction of iCloud sync for WebAuthN. I was excited to offer WebAuthN as a method for 2FA/MFA to replace the use of phone apps, OTP, etc.

However, now it seems that both the WebAuthN secret and the password could both be synced to iCloud. Now I we to worry about employees syncing both factors to iCloud and properly securing their iCloud accounts? That's not good and will almost certainly require new intrusive controls.

Introducing passkeys in Chrome

Related Stories