Hacker News Reader

Comment by akersten | Hacker News Reader

What baby? Oh boy, a new authentication method just as secure as my unique per-site random password that I keep in my password manager already anyway, except I also completely lose access to it if I ever get locked out of my Google devices. The future is truly revolutionary.

View on HN

Passkeys are stored in your password manager, too. You'll only lose access to your passkeys if Google is your password manager and you get locked out of your Google account. So, if you don't trust Google, use another password manager. (May I recommend Bitwarden?)

The advantage of passkeys is that no one can trick you into giving your passkeys to the wrong person. Every time this comes up, people say "I don't need that! I've got a password manager. I'm too smart to get tricked." But they are wrong.

The concern is that the site you're logging into can tell the difference between a passkey created by Google on a (recent, non-rooted, locked bootloader) Android device using its cryptoprocessor, and a passkey created by Bitwarden which you can sync/backup as you like. And Google, Apple & Microsoft are well positioned to encourage people towards the former over the latter.

The possibility that sites will require attested keys does seem pretty remote at the moment, but if passkeys take off and >95% of people use keys tied to their phone, I could totally see sites starting to prevent you using a key from Bitwarden. I don't think there's a conspiracy trying to achieve this, but the incentives of security & lock-in could push us there.

Exactly. We saw this with banking apps forcing use to use insecure but attested devices for their insurances. Fool me once... no thank you to passkeys for now.

I believe passkeys can be made phishing resistant, as they can be cryptographically bound to a given application, and the application has to attest itself to your system too.

You won't be able to use your google account passkey to log into the perfect clone of "gmail.com" where the 'a' is actually a greek or cyrillic letter or something, and neither will your ageing parents. You could still paste your password into the fake site from your password manager, or the spyware on your computer could still sniff it from your clipboard.

Password managers check the domain before they fill.

But users can and do override this decision. "Huh, why isn't 1Password autofilling my password on bank0f4merica.com? Let me quickly select 'autofill and remember'..."

I'm somewhat desensitized to this myself for non-bank use cases. It's unfortunately necessary with corporate merges and rebrands. After all, how is my password manager supposed to know that it's safe to fill my hulu.com password on disneyplus.com? The same applies to mobile apps providing some-outsourcing-vendor.com instead of my-actual-service-provider.com etc.

For passkeys, there's native support for that type of thing using "related origin requests": https://web.dev/articles/webauthn-related-origin-requests

> But users can and do override this decision.

Yes. That is a feature, not a bug.

Transferability and delegation of authority are features. Calling them "phishing vectors" only makes them seem like a bug.

Being able to enter my Hulu password on disneyplus.com is a feature, being able to enter my Bank of America password on bank0famerica.com is a bug. The problem is that the same behavior causes both.

I'll raise you a better one:

Being able to give your Hulu or Bank of America password to your spouse is a feature, but giving it to a scammer is a bug.

Can't have one without the other, but I disagree making credentials non-transferrable is the right choice.

Name one password manager with an "autofill and remember..." action that fills passwords from unrelated domains.

You're spreading nothing more than FUD. This is a completely imaginary threat vector that doesn't exist. And even threats that do exist don't always justfity security at every cost. The optimum amount of security is never 100%.

...until you login to, say, your Microsoft account on one of like 27 domains that use the same SSO and your autofill doesn't trigger so you just grumble to yourself "man I hate the modern web" and manually copy/paste it in.

Hopefully after thoroughly checking the URL but you only have two minutes before the Uber gets here and just need to get this one last thing done ASAP...

Reply on news.ycombinator.com