Hacker News new | ask | show | jobs
by iand 978 days ago
"To use passkeys, you just use a fingerprint, face scan or pin to unlock your device, and they are 40% faster than passwords — and rely on a type of cryptography that makes them more secure. "

Who wrote this sentence? It's just a mess.
1 comments
TheRealPomax 978 days ago
also, "ah yes, a several digit pin, famously more secure than a same-length password that adds even as little as letters".
link
Macha 978 days ago
The point is more so that the pin unlocks a key on your local device and that key is much stronger than the password the typical user would select. Plus it is site specific in a way that your typical user does not do with passwords.

So it's making a system weaker against offline attacks if someone steals your hardware in exchange for making it stronger against phishing. This is probably the correct tradeoff for most people.

link
avianlyric 978 days ago
A PIN associated with a specific device that been cryptographically linked to your account. So while a seven digit PIN is easier to guess than a password, the physical device is much harder to steal over the internet. It’s defacto 2FA authentication.
link
kube-system 978 days ago
Yes, a several digit pin that unlocks a long private key is more secure than a shared secret with eight characters on its own.
link
progbits 978 days ago
PIN for secure module with throttling and max wrong attempt count is indeed safer than a password you can brute force offline.
link
andrewstuart2 978 days ago
Brute forcing offline kinda only works if you have a stolen hash or artifact like that. For a service like Google, they definitely have rate limits on password attempts.

I'm not saying I prefer either one here, just that password authentication doesn't automatically mean you can brute force offline.

link
postalrat 978 days ago
The real key is stored in a chip. Your pin unlocks the real key. The chip has hardware to rate limit pin attempts.

These types of chips tend to have many layers of physical security to protect the real key.

link
wkat4242 978 days ago
A pin is pretty safe when it unlocks a hardware token that limits the amount of attempts.

It's basically like a chip & pin bank card.

link
wrs 978 days ago
You have to possess the device and the PIN, so yes, it is quite a bit more secure.
link