Hacker News Reader

Comment by hedora | Hacker News Reader

This thread is a great survey of why the passkey roll out is so controversial. Even without the inevitable “but what if Google/Apple permabans me?” thread, we have confusion about whether QR codes are sufficient, biometrics are necessary, and a baffling UI that maybe means to say “debug the bluetooth stacks on whatever devices are nearby”.

View on HN

You can use yubikeys as passkeys, if you are afraid of a Google/Apple ban

What if you lose your yubikey?

"Go enroll a new one in your 500 accounts" is not a good enough answer. The thing about a regular password manager is that it does not get lost.

The point isn’t that we should have to trust Apple/Google for our passkeys — it’s that we should have full control over the backing store used by our password manager(s).

The standard supports exports, it should arrive; the vast majority of users will never export them from Google or iCloud synced storage though.

https://news.ycombinator.com/item?id=35855133 ("HN: Passkeys will be importable, exportable, cross-device, and across managers")

I am unfamiliar with passkeys. Can they be exported and imported, or WILL it be possible one day?

Because that affects my choice to adopt them today.

Native implementations do not allow exporting and importing. Of course technically it’s possible but they gone great lengths hiding it from user “for security”, so probably they wouldn’t allow any export.

If you run vault warden, it worked for me at passkeys.io and it’s just an SQL DB, so surely you could extract anything (although I didn’t see a specific UI for it).

I have not tested it but some users in the bitwarden forum has mentionned that it's included in the vault export (cf https://community.bitwarden.com/t/passkey-portability/59177/...).

Individual choices to not adopt due to this requirement is unlikely to impact mass market adoption. While I certainly hope the export capability is delivered as promised, it won’t hold most folks back from adopting this auth mechanism.

https://www.engadget.com/google-says-its-secure-entry-passke... (“Google says its secure entry passkeys have been used a billion times by 400 million Google accounts”)

So the average user has only used passkeys 2.5 times? Yikes.

and i bet it went like:

1. login on computer. click next mindlessly on setup flow.

2. use account

3. try to login on phone. click next mindlessly on setup flow again.

4. where's my data?! oh well, lost my old account. let's use the new one

5. eternal confusion while switching devices. never return to site again.

= 2.5 times per user

How often do you login to your Google account once logged in? I don't remember the last time Google asked me to login, because the session persists.

I hope that you properly segment your browsing then, because surely you don't browse the web while logged in to google?

Moving the goalposts to a data security and privacy concern from strong auth factors. I don’t care if Google has my browsing history. I do care if someone else can log into my account, or ease of managing my own credentials. Auth protects you from others, data security and privacy measures protect you from the counterparty.

Not moving the goalposts. Just stating why you'd want to login often, or solve it in some other way.

https://github.blog/2024-04-24-securing-millions-of-develope... ("Finally, as a result of our improved enrollment experience and passkey rollout, our data shows that it’s 47% more likely users will configure two or more forms of 2FA.") that is also promising so it is not just Google, where somebody could argue they promote it for other reasons.

> https://www.engadget.com/google-says-its-secure-entry-passke...

lol. engadget literally copied and pasted the press release they gov via email! it still have all the links hidden by their corporate phishing thing:

    like: https://urldefense.com/v3/__http://g.co/passkeys__;!!Op6eflyXZCqGR5I!GFYwYEDk1Zq0xZpr4q834hOMHa1R4ovVB7D37okCF9TxEVdc5cuJkzdaExbdZ1BvCPR5xkjYtLaF_0Ldk8v53R8$

Until it arrives it's nothing but an empty promise. The biggest players have a lot to gain from not allowing export, or doing what Apple does with "right to repair" and now the DSA in the EU; technically "supporting" repairability or interoperability while making it all but impossible in reality.

It's no surprise that they're trying to gain as much adoption as possible without having it, and that export is the part of the spec that was apparently not deemed important enough to have ready before doing so. KeepassXC is the only one supporting it, and just look at how much backlash they got, with veiled threats of requiring attestation and banning its usage.

No, there is zero reason to be optimistic towards this.

I have been following the discussions closely in https://github.com/w3c/webauthn and I haven't seen anything about exportability there in the past year. The only reference I can find is that post on Hachyderm from a year ago.

We're a year later and the needle didn't move on this. Which is a bit worrying

Where does it say that you have to trust Google / Apple?

Passkeys are webauthn credentials. Store them in whatever webauthn store you like. I use a combination of bitwarden and iCloud.

For 500 accounts you would need 20 yubikeys. That’s quite a yubikeyring.

True. I personally prefer non-residential keys that don't take up any space on your yubikey. The keys are reconstructed on the fly based on a value that I receive from the server I am authenticating against.

Passkeys are residential keys and they consume storage. The minor upside is that they free the user from remembering their username.

The other upside is that you can store them in either HSMs or software-backed stores (password managers) or hybrids (like your phone). It's trade-offs all the way down!

Can't you do the same thing with non-residential keys?

You can. But then you miss out on credentials discovery.

You can get a second one as backup. They actually recommend to do this themselves and provide tools for cloning.

Correct me if I'm wrong but I don't think you're meant to clone them per se. You're better off creating a unique passkey for each device, and if one is lost you can revoke that passkey without bricking your backup device as a login method at the same time.

That's how I treat my Yubikeys at least. The only downside with this is that some services (e.g. PayPal) only let you create one passkey.

"The only downside" is a show stopper that means you do not have a Backup at all.

Most services let you fall back on traditional username and password if you lose your passkey

Then why have one?

Password managers like 1Password support PassKeys.

Reply on news.ycombinator.com