Hacker News Reader

Comment by mhoad | Hacker News Reader

How do I leave the Apple ecosystem if I go all in on this? Sounds like major vendor lock in under a deceptive title of “open standards” but I’m hoping I’m wrong here. Does anybody happen to know yet?

View on HN

Just add more authenticators to every RP (site you auth into). From the point of view of an RP, "your account in the Apple ecosystem" here is the exact same thing as "one of your Yubikeys", basically.

That seems like an enormous pain if you have dozens or hundreds of services. It could take hours to do this one at a time. (I'm assuming one minute per service, though that depends on how hard it is to find the "add another authenticator" page for each service.)

It's possible I'm unaware that there is a simple protocol for this. Am I incorrect here?

Well, realistically not all services will support WebAuthn… spending an hour to handle a dozen important ones doesn't sound like a big deal to me.

The goal of the recent initiatives is to create widespread passwordless authentication, so it seems likely that the number of services that support WebAuthn will grow dramatically over the next few years.

You should always add at least two keys for every service in case you lose the first anyway. That was the case even before Apple passkey so just keep doing the same.

This isn't a great solution, as in order to enrol in new services you have to either retrieve your backup key from its safe storage location, or keep the backup key with you at all times (which defeats its purpose).

And if you do move away from Apple's Passkey to your second key, you'll want to buy and set up a new backup key. So have to do the tedious mass-enrollment anyway.

Yeah this is absolutely not feasible, I have ~200 separate accounts in my password manager right now just for me personally.

I also have hundreds of accounts. But there are ~10 services that are far more important to me and where I care a lot about security beyond passwords (Fastmail, Dropbox, GitHub, Google Apps, Bank, government websites, etc.). I use most of them already with an U2F key and I’ll use them with Passkey.

The hundreds of other sites will probably take years to support Passkeys (they don’t support U2F either). I can convert them when they support it and I happen to do something else account-wise.

I don’t think it’s a huge issue.

Well how bad do you want to leave the Apple ecosystem? :)

You are 100% correct that you need to add it to each service. This is a consequence of an intentional decision (keys cannot be duplicated). Streamlining it would definitely be an improvement.

That being said, it's not a problem in the real-world because FIDO is so sparsely supported. Hopefully PassKey speeds things along.

Could it be automated by a third-party service?

How much would you be willing to pay for such a service? ;)

Streamlining would be an improvement, but it opens an attack vector.

Unfortunately, security and usability are always in balance.

I should have been more specific. Test how many clicks it takes to add a key to one of your "mainstream" accounts. We would hope that services which support FIDO eventually gravitate to a single UX language, that also reduces the time taken to register new keys.

Agreed

The relevant WebAuthn standard actually supports keys regardless of whether they can be duplicated. Even "virtual", software-only keys are supported. It's up to each individual service whether they allow the user to enroll such keys.

For less important accounts, you could use OAuth with another site. (For example, maybe use GitHub to authenticate for other developer sites.)

It's probably more painful than that.

Let's say that I have two laptops, a MacBook Air and a Lenovo ThinkPad. I create an account with an Apple Passkey on a website. I can now log into my account on the MacBook Air, but not on the Lenovo ThinkPad.

How do I register my ThinkPad? I need to log into my existing account to add a new authenticator (Windows Hello in this case). Does the website offer an email link I can use to log into the account? Do I have a backup code that I need to use? Do I need to set a password and log in the normal way (thus removing the advertised phishing and database leak benefits)?

Yeah, that's going to be the next big ecosystem challenge for WebAuthn in my opinion. Ideally platforms would support 3rd party password managers, so you could manage your keys without having to tie your credential database to any one specific platform.

I'm sure as the popularity of WebAuthn grows there'll be more and more demand for cross-platform compatibility until eventually the big players are forced to implement it, but it's going to be kind of rough in the short term until then.

Except Apple are kind of notorious about avoiding cross platform compatibility which is why I ask. Find them hard to trust at this point.

I can already hear them making the “we can’t because it will impact users security” argument in my head.

For normal passwords they currently seem to support third party password managers just fine, including direct integration in Safari and the iOS keyboard.

You can also export everything from iCloud Keychain to use with another password manager.

They could always use Passkeys as an opportunity to lock things down but it would be in direct contrast to what they have been doing with password management recently.

>You can also export everything from iCloud Keychain to use with another password manager.

I can't export anything. This menu item is always disabled for some reason.

That would be nice. I used Hanko for one service I built that uses WebAuthn+email, so new devices get a one-time code in their email and existing just use WebAuthn. It would be kind of nice not to have to rely on email, but it's better than making people remember passwords.

I always was curious about this stuff. I don't want all my eggs in a basket and have to depend completely on others for "logging in". Apple and Google and other Big Corps(tm) have shown they are just fine with terminating your accounts without any recourse and/or warning with no practical way to appeal it. Passwords managers aren't subject to that limitation and all faang companies can do is kill your accounts for their particular services.

As long as your account is tied to your email address, there should be something similar to a password reset.

Reply on news.ycombinator.com