Hacker News new | ask | show | jobs
by throwawayk7h 34 days ago
that's not true. Passkeys have an optional remote attestation capability, which second parties can use to completely enforce aspects of your keys, such as them being non-transferrable or not usable without a screen touch etc.
2 comments
cyberax 34 days ago
Passkeys (as defined in the spec) by definition don't.

Non-passkey WebAuthn keys can have additional attestations.

link
throwawayk7h 34 days ago
You don't consider WebAuthn to be passkeys? Why not?
link
cyberax 34 days ago
Passkeys are a subtype of WebAuthn keys, not vice versa.
link
throwawayk7h 33 days ago
be that as it may, when e.g. TicketMaster asks me if I want to "use a passkey," they are potentially referring to something with remote attestation capabilities.
link
vel0city 34 days ago
This doesn't change the fact it can still be your physical device that remains in your personal control.

I can stash them on a yubikey or similar device and still meet those requirements. It's still only my device, it doesn't rely on other services, etc.

link
throwawayk7h 34 days ago
There are also non-transferrable passkeys which can't be copied between two secure devices, so it'd be hard to get some passkeys onto your yubikey in the first place.

Furthermore, I personally feel that if you can't actually access the bits, you don't truly "own" it.

link
vel0city 34 days ago
> so it'd be hard to get some passkeys onto your yubikey in the first place.

It's as easy to get a passkey on it as it was to originally create the first passkey. That's the thing with them. You can make a bunch. It was just as easy to add the first passkey as it was the second and third and fourth and fifth and....

The point is to not reuse the same passkey everywhere. Same idea as not using the same password everywhere and not reusing the same SSH key everywhere.

> Furthermore, I personally feel that if you can't actually access the bits, you don't truly "own" it.

So if a certificate authority uses an HSM to sign certificates do they not own those keys? Who does own it then, nobody?

If one uses a hardware Bitcoin wallet do they not own those keys?

Isn't being the exclusive one to operate with the key material with hardware entirely in your possession and control the same as owning it? Why is reading the raw bits the only true level of ownership? Just trying to really understand your perspective.

link
throwawayk7h 33 days ago
Okay let me withdraw slightly. What I mean is: if I choose of my own free will to not be able to access the bits (e.g. via a cryptoprocessor) then sure, I can still "own" it. And that's the case for certificate authorities. But when vendors force me (with remote attestation) to not be able to access the bits, then I see that as me not having control => me not owning the key.
link
vel0city 32 days ago
I'm still just trying to fully understand the delination here. Let's walk through two scenarios.

Service A allows a wide variety of authenticators to store your passkey, it doesn't do any checks at all for the requirement. You choose a USB hardware authenticator. We both agree you own the key in this from what I understand.

Service B allows a stricter list of types of authenticators, and does some checks to ensure you're using an authenticator with a least a certain level of security guarantees. Your USB hardware authenticator meets these requirements. Now this key that is stored in the same place on the same hardware using pretty much the same process is now no longer "yours"?

An interesting perspective to me.

link