Hacker News new | ask | show | jobs
by summermusic 6 days ago
(I might be wrong, please correct me if I am) What I'm gathering from this page is that the Passkey spec can specify whether the app handling the passkey should prompt the user for biometric scan, PIN code, etc. but some apps simply ignore that flag. This makes sense though. I've already logged into my password manager and it hasn't timed out yet, so why would my password manager prompt me again? I'm glad that they don't prompt me again when I'm already logged in. I don't see this as a problem.
2 comments
coldpie 6 days ago
Your understanding is correct and I agree with you. The Passkey spec authors, however, think services should be allowed to ban your client for behaving this way:

> [When UV is required, KeePassXC must request user verification or not handle the request]

> This implementation is not spec compliant and has the potential to be blocked by relying parties.

https://github.com/keepassxreboot/keepassxc/issues/10406

link
Telaneo 6 days ago
> > This implementation is not spec compliant and has the potential to be blocked by relying parties.

The only conclusion I can come to when it comes to this and the earlier kerfuffle regarding being able to export the plain text of passkeys is 'the spec is bad and you should feel bad'.

link
coldpie 6 days ago
Yeah, it sucks. It could've been a cool technology but they're so locked in to "my way or nothing" and won't consider other usecases or security trade-offs other than the ones they decided on. It's just a complete non-starter with that attitude.
link
duskdozer 6 days ago
Right, not only are you authorized, but you are also prompted to manually complete the request, which will fail if you do not accept. However, this isn't considered sufficient by the passkey people, who do in fact want you to retype your password at each prompt.
link