News for hackers. Stuff that matters.

A comment on Passkeys: A Shattered Dream. Parent comment

Re:Passkeys: A Shattered Dream by mikestew on Friday April 26, 2024 @11:11AM (#40170400)
The metaphor might be a bit esoteric, but that's similar to wishing that Hardware Security Modules (HSMs) allowed you "get your <private keys>" out of the HSM. As sibling comment says, that's how you get phished. The whole point of an HSM (and a passkey) is that the super-secret private part never leaves the HSM no matter how nicely you ask and no matter how compromised the machine is.

A password manager, OTOH, is happy to hand out your private key ("password" in this case) to anyone that has access to it.

[ Parent | on HN ]
Re:Passkeys: A Shattered Dream by Atotalnoob on Friday April 26, 2024 @05:16PM (#40174411)
Yes, but I don’t want vendor lockin.

I want to move my passkeys where I want and use tools I want.

Not allowing anyway of changing passkeys is terrible. Imagine someone switches from IOS to android. How do they use their passkeys?

Even if they had a big “warning don’t do this” sign it would be better than not allowing it in anyway.

[ Parent | on HN ]
Re:Passkeys: A Shattered Dream by labcomputer on Friday April 26, 2024 @07:50PM (#40175615)
> Not allowing anyway of changing passkeys is terrible.

Who says you can't change your passkeys? Just log into the site with your existing passkey (or other 2FA) and change it.

[ Parent | on HN ]
Re:Passkeys: A Shattered Dream by deadbunny on Friday April 26, 2024 @08:06PM (#40175738)
Sure, I'll just log into all 500+ sites I have logins for and update them.
[ Parent | on HN ]
Re:Passkeys: A Shattered Dream by forty on Saturday April 27, 2024 @07:35AM (#40179174)
It's a middle ground. You should be able to move passkeys from one vendor to another with some export process but the secret key is not exposed when you use it which reduces the risk of having it stolen
[ Parent | on HN ]