Hacker News new | ask | show | jobs
by vel0city 34 days ago
This doesn't change the fact it can still be your physical device that remains in your personal control.

I can stash them on a yubikey or similar device and still meet those requirements. It's still only my device, it doesn't rely on other services, etc.
1 comments
throwawayk7h 34 days ago
There are also non-transferrable passkeys which can't be copied between two secure devices, so it'd be hard to get some passkeys onto your yubikey in the first place.

Furthermore, I personally feel that if you can't actually access the bits, you don't truly "own" it.

link
vel0city 34 days ago
> so it'd be hard to get some passkeys onto your yubikey in the first place.

It's as easy to get a passkey on it as it was to originally create the first passkey. That's the thing with them. You can make a bunch. It was just as easy to add the first passkey as it was the second and third and fourth and fifth and....

The point is to not reuse the same passkey everywhere. Same idea as not using the same password everywhere and not reusing the same SSH key everywhere.

> Furthermore, I personally feel that if you can't actually access the bits, you don't truly "own" it.

So if a certificate authority uses an HSM to sign certificates do they not own those keys? Who does own it then, nobody?

If one uses a hardware Bitcoin wallet do they not own those keys?

Isn't being the exclusive one to operate with the key material with hardware entirely in your possession and control the same as owning it? Why is reading the raw bits the only true level of ownership? Just trying to really understand your perspective.

link
throwawayk7h 33 days ago
Okay let me withdraw slightly. What I mean is: if I choose of my own free will to not be able to access the bits (e.g. via a cryptoprocessor) then sure, I can still "own" it. And that's the case for certificate authorities. But when vendors force me (with remote attestation) to not be able to access the bits, then I see that as me not having control => me not owning the key.
link
vel0city 33 days ago
I'm still just trying to fully understand the delination here. Let's walk through two scenarios.

Service A allows a wide variety of authenticators to store your passkey, it doesn't do any checks at all for the requirement. You choose a USB hardware authenticator. We both agree you own the key in this from what I understand.

Service B allows a stricter list of types of authenticators, and does some checks to ensure you're using an authenticator with a least a certain level of security guarantees. Your USB hardware authenticator meets these requirements. Now this key that is stored in the same place on the same hardware using pretty much the same process is now no longer "yours"?

An interesting perspective to me.

link