←back to thread

Passkeys and Modern Authentication

(lucumr.pocoo.org)
184 points Bogdanp | 5 comments | 02 Sep 25 13:47 UTC | HN request time: 0s | source
Show context
alphazard ◴[02 Sep 25 17:11 UTC] No.45105959[source]▶
Unfortunately the tech community is full of people who pride themselves on being aware of and advocating for the latest standard put out by whatever company. That's how we end up with lots of complicated nonsense like most of what is sent in HTTP headers, or the contents of a TLS certificate.

On the topic of authentication, it's solved. SSH nailed it, any further complexity is strictly worse. Signing up is uploading a public key. Signing in is cryptographically signing a commitment to the current ephemeral tunnel.

replies(10): >>45106121 #>>45106140 #>>45106170 #>>45106176 #>>45106183 #>>45106261 #>>45106406 #>>45106911 #>>45107421 #>>45107745 #
01HNNWZ0MV43FF ◴[02 Sep 25 17:28 UTC] No.45106261[source]▶
> Signing up is uploading a public key. Signing in is cryptographically signing a commitment to the current ephemeral tunnel.

How do I sign in from multiple computers?

replies(2): >>45106320 #>>45106359 #
karmarepellent ◴[02 Sep 25 17:32 UTC] No.45106320[source]▶
A service that lets you sign up by uploading a SSH public key could just as well let you upload multiple public keys in your profile to be able to connect from other devices.
replies(1): >>45106390 #
1. tadfisher ◴[02 Sep 25 17:37 UTC] No.45106390[source]▶
Amazing, just like passkeys!
replies(2): >>45106466 #>>45109429 #
2. karmarepellent ◴[02 Sep 25 17:41 UTC] No.45106466[source]▶
The sarcasm is duly noted. But I simply answered the question. I don't have any strong opinion regarding passkeys.
replies(1): >>45107913 #
3. ◴[02 Sep 25 19:30 UTC] No.45107913[source]▶
4. Nextgrid ◴[02 Sep 25 21:39 UTC] No.45109429[source]▶
Biggest difference is that SSH keys allow you to store and submit the public key without the private key being present.

With passkeys, the private key must be present and usable (at least with current implementations) at the time of enrolment.

This raises a major problem: with SSH keys you can keep an backup key in a secure location (bank vault, etc) and still be able to register it. With passkeys your backup key must be present and connected when registering it, so you can’t keep it in a secure location as you always need it when registering. This exposes both keys to risks such as hardware failure (let’s say faulty USB port that spikes anything plugged in with 12V… you connect your main key, it doesn’t work, now you connect your backup key and same thing happens… by the time you realize both your primary and backup keys are toast).

replies(1): >>45111569 #
5. tadfisher ◴[03 Sep 25 02:11 UTC] No.45111569[source]▶
With SSH, "registering" your key on a server means having out-of-band access to copy your public key. There is no such facility if you're registering a never-before-seen user with a new key, so it makes a whole heap of sense to ensure that the credential you're registering has a working private key that exists.