Hacker News new | ask | show | jobs
by gnabgib 590 days ago
This surely would have been better as a comment on a passkey story?

Re: MFA

Password risk: low quality, reuse, malware, leak, phishing, social eng

Password+MFA risk: malware, leak, phishing, time-limited social eng

Passkey risk: malware

The benefit of MFA with a shared secret (aka password) is to defend against a party that has learned or guessed the secret (low quality password, password reuse, user hack/malware, system hack/leak, phishing). By requiring something you have (access to email, SMS, an authenticator app), and can prove you have access to in a small window - you can significantly reduce the risk of a successful login from someone other than the user. Reduce - if it's user hack/malware, or social engineering the other factor may also be obtainable.

Passkeys use public key crypto, rather than shared secrets. Your password never leaves your device(s), so system hack/leak can only lead to a public key becoming.. public. Passkeys are also machine generated, which eliminates the low quality password and password reuse problems. The negotiation is automated, rather than requiring typing from the user - so the ability to socially engineer is greatly reduced. Finally because the negotiation includes a challenge/response, you still make a time-limited proof you known (like MFA).

1 comments

“never leaves your device(s)” aka “vendor lock-in” :)
That's not what it means? Or certainly not what I meant. As part of the protocol exchange, you do not send the private key. You're free to backup, duplicate to other devices, or write out your keys by hand... but the service has no right or capacity to demand the private key.