←back to thread

Passkeys and Modern Authentication

(lucumr.pocoo.org)
184 points Bogdanp | 7 comments | 02 Sep 25 13:47 UTC | HN request time: 1.177s | source | bottom
Show context
alphazard ◴[02 Sep 25 17:11 UTC] No.45105959[source]▶
Unfortunately the tech community is full of people who pride themselves on being aware of and advocating for the latest standard put out by whatever company. That's how we end up with lots of complicated nonsense like most of what is sent in HTTP headers, or the contents of a TLS certificate.

On the topic of authentication, it's solved. SSH nailed it, any further complexity is strictly worse. Signing up is uploading a public key. Signing in is cryptographically signing a commitment to the current ephemeral tunnel.

replies(10): >>45106121 #>>45106140 #>>45106170 #>>45106176 #>>45106183 #>>45106261 #>>45106406 #>>45106911 #>>45107421 #>>45107745 #
1. karmarepellent ◴[02 Sep 25 17:24 UTC] No.45106183[source]▶
> Signing in is cryptographically signing a commitment to the current ephemeral tunnel.

I can see how SSH could be used for authentication on the web. And I have no doubt that it would be sound out-of-the-box. But I am not sure what you mean by your last sentence. Do you mean that authentication targets are gated and only reachable by establishing a tunnel via some kind of forwarding?

Aside from the wonderful possibilities that are offered by using port forwarding of some kind, you could also simply use OpenSSH's ForceCommand to let users authenticate via SSH and then return a short-lived token that can then be used to log into an application (or even a SSO service).

I guess no one uses SSH for authentication in this way because it is non-standard and kind of shuts out non-technical people.

replies(3): >>45106528 #>>45106698 #>>45106862 #
2. alphazard ◴[02 Sep 25 17:45 UTC] No.45106528[source]▶
> authentication targets are gated and only reachable by establishing a tunnel via some kind of forwarding?

No, it's just how you authenticate with signing keys. Given that a secure channel has been set up with ephemeral keys, you can sign a commitment to the channel (like the hash of the shared secret key) to prove who you are to the other party.

> let users authenticate via SSH and then return a short-lived token that can then be used to log into an application (or even a SSO service)

This is exactly what I recommend. If everyone did this, then eventually then the browsers or 1password could support it.

replies(1): >>45108542 #
3. manithree ◴[02 Sep 25 17:57 UTC] No.45106698[source]▶
Not just non-technical people, but a lot of Windows developers I've worked with over the years can't seem to grasp the asymmetric key concept enough to use it for git (and then complain about git over over https).

Being in charge of the strength and security of your private key is something most people don't want to do, so we get multiple identities made "easy" by walled gardens getting popular in passkeys.

4. ◴[02 Sep 25 18:08 UTC] No.45106862[source]▶
5. palata ◴[02 Sep 25 20:26 UTC] No.45108542[source]▶
The thing is, if you want to use SSH with a secure element, suddenly you're using FIDO2, right? OpenSSH already supports it.

And WebAuthn is using FIDO2, it's not that different, it's just that WebAuthn adds some stuff like a relying party.

replies(1): >>45117422 #
6. NoGravitas ◴[03 Sep 25 16:10 UTC] No.45117422{3}[source]▶
It's the stuff it adds that most people object to.
replies(1): >>45121043 #
7. palata ◴[03 Sep 25 22:25 UTC] No.45121043{4}[source]▶
It feels more like people object for the sake of objecting. I often have this feeling: people first don't care (about security, about renewable energy, ...), and the moment they start caring, there is a high risk that they will just object to everything, sometimes without good reasons.

Sure, we are being abused by TooBigTech and surveillance capitalism. It doesn't mean that all security is bad. Security is a compromise. Yet many people go "this added security comes from a governement/TooBigTech so it proves that it is a lie". Which is wrong: it doesn't prove it. Sometimes there are good things coming from governments/TooBigTech.

The world is more nuanced than people seem to realise.