TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Bringing passkeys to Android and Chrome

231 点作者 Heavywater超过 2 年前

26 条评论

stavros超过 2 年前
The thread here seems like a dumpster fire to me. Everyone here is worrying about lock-in to an open standard, so I want to clarify things.<p>WebAuthn is an open standard. It&#x27;s a way for you to prove to a website that you have a specific private key. There&#x27;s no lock-in, because the key is portable (unless you don&#x27;t want it to be). There&#x27;s no privacy issue, because the key is unique per website. There&#x27;s no security issue, because it&#x27;s unphishable and can be unstealable if it&#x27;s in hardware.<p>If you don&#x27;t like Google or Apple, use your favorite password manager. All it will have to keep is a private key per website, and you&#x27;re done. No usernames or passwords. You visit a site and are automatically logged in with a browser prompt.<p>This is amazing, it&#x27;s the best thing that&#x27;s ever happened to authentication. It&#x27;s something the end user <i>cannot</i> have stolen. Can we be a bit more excited about it?<p>EDIT: If you want to try it, I just verified that <a href="https:&#x2F;&#x2F;www.pastery.net&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.pastery.net&#x2F;</a> works great with Passkeys even though I haven&#x27;t touched the code in a year.<p>That means that django-webauthin also works great with Passkeys, for you Django users:<p><a href="https:&#x2F;&#x2F;pypi.org&#x2F;project&#x2F;django-webauthin&#x2F;" rel="nofollow">https:&#x2F;&#x2F;pypi.org&#x2F;project&#x2F;django-webauthin&#x2F;</a><p>Also, the latest Firefox on Android seems to work great.
评论 #33185930 未加载
评论 #33185403 未加载
评论 #33186868 未加载
评论 #33188556 未加载
评论 #33199302 未加载
评论 #33187790 未加载
评论 #33187808 未加载
评论 #33191728 未加载
cglong超过 2 年前
People are raising really good points here, but I do find it interesting how negatively this news is being received vs. when Apple said the same thing: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=31643917" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=31643917</a>
评论 #33180191 未加载
评论 #33180341 未加载
评论 #33181364 未加载
wnevets超过 2 年前
Passkeys sound like another way for companies like Google and Apple to lock you into their walled garden. Having each walled garden randomly generating a key for every single domain instead of using the actual domain name as part of the key is a great way to lock regular people into their respective ecosystems.
评论 #33180466 未加载
评论 #33182220 未加载
评论 #33179419 未加载
评论 #33181836 未加载
评论 #33179476 未加载
评论 #33179403 未加载
account-5超过 2 年前
I don&#x27;t use my phone to log in to anything. All my stuff is done on a computer with a password manager.<p>At no time am I even likely to rely on Google for anything this important; every other week there&#x27;s a thread about Google killing off accounts for no reason. No way would any sane person allow Google access to this with their track record. And this isn&#x27;t even considering my suspicion that Google only wants to &quot;help&quot; with this so you&#x27;re locked into their services and they are better able to track your activity.
评论 #33179703 未加载
评论 #33179559 未加载
评论 #33180098 未加载
评论 #33180302 未加载
评论 #33184560 未加载
评论 #33186641 未加载
jasonjayr超过 2 年前
And what happens if your Google account that these keys are tied to is locked&#x2F;revoked for a nebulous ToS violation?
评论 #33178864 未加载
评论 #33178896 未加载
评论 #33182314 未加载
评论 #33179107 未加载
jrm4超过 2 年前
Nah.<p>For all the talk of &quot;one app to rule them all&quot; (which is an awful idea) this is a step closer to that.<p>For all it&#x27;s faults, crypto has one thing right -- not your keys, not your stuff. I get that doing keys&#x2F;passwords is hard, but the best thing in the long run is for them to stay in the hands of the user.<p>And if not, the holder of the keys needs to be someone you can easily hold accountable, i.e. either fire, or arrest, or sue if they get it wrong.
评论 #33179466 未加载
评论 #33179049 未加载
madjam002超过 2 年前
See also <a href="https:&#x2F;&#x2F;security.googleblog.com&#x2F;2022&#x2F;10&#x2F;SecurityofPasskeysintheGooglePasswordManager.html" rel="nofollow">https:&#x2F;&#x2F;security.googleblog.com&#x2F;2022&#x2F;10&#x2F;SecurityofPasskeysin...</a> which provides a more technical overview
colordrops超过 2 年前
Ugh, I hope they don&#x27;t make it difficult to use third party password managers. I&#x27;m pretty happy with vault warden.
评论 #33178705 未加载
jeroenhd超过 2 年前
Can we have this but self-hostable and open source, please? Something like Bitwarden that you can stuff onto your own device? I know there are hosted services for handling auth on the server backend, but what about the other way around?<p>I use Krypton but that&#x27;s not maintained (and already broken on some websites like Github). I trust the secure storage module of my phone and I trust my computer&#x27;s TPM, unlike many other Linux users; surely it should be possible to integrate with the OS somehow to make it secure, right? The last example I saw used USB over IP to inject a virtual FIDO device, which works great, but the implementation is clearly not ready for prime time.
评论 #33185169 未加载
fotta超过 2 年前
Google&#x27;s auth is getting increasingly frustrating. Recently when I logged in with TOTP 2FA, I had to also open up YouTube on another device and click approve. What&#x27;s the point of 2FA if they&#x27;re just going to ignore it?
评论 #33180210 未加载
genpfault超过 2 年前
&gt; Passkeys on users’ phones and computers are backed up and synced through the cloud to prevent lockouts in the case of device loss.<p>How do you back them up locally?
评论 #33180906 未加载
评论 #33185410 未加载
okhuman超过 2 年前
Check out AuthCompanion, a passwordless login implementation for ideas. <a href="https:&#x2F;&#x2F;github.com&#x2F;authcompanion&#x2F;authcompanion2" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;authcompanion&#x2F;authcompanion2</a>
评论 #33180027 未加载
politelemon超过 2 年前
&gt; A passkey on a phone can also be used to sign in on a nearby device. For example, an Android user can now sign in to a passkey-enabled website using Safari on a Mac. Similarly, passkey support in Chrome means that a Chrome user, for example on Windows, can do the same using a passkey stored on their iOS device.<p>&gt; Since passkeys are built on industry standards, this works across different platforms and browsers - including Windows, macOS and iOS, and ChromeOS, with a uniform user experience.<p>I see no mention of Linux in these examples, which tells me that users having access to their keys is not a primary concern for these implementations?
评论 #33187709 未加载
pabs3超过 2 年前
For those of you who want something like this with Firefox on Linux, the virtual-fido project might provide a decent alternative, it uses Linux&#x27;s USB-over-IP support to provide a fake FIDO device, and Firefox supports FIDO devices for WebAuthn:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;bulwarkid&#x2F;virtual-fido&#x2F;" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;bulwarkid&#x2F;virtual-fido&#x2F;</a> <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=32881956" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=32881956</a>
LibertyBeta超过 2 年前
Interesting. I&#x27;m still struggling to see how this is better than just using a yubi&#x2F;solo-key
评论 #33178817 未加载
评论 #33178952 未加载
评论 #33178806 未加载
评论 #33178878 未加载
评论 #33179240 未加载
评论 #33178778 未加载
评论 #33178803 未加载
ok_dad超过 2 年前
Try telling the authorities you &quot;forgot&quot; your password when they know you use passkeys.
评论 #33185644 未加载
fleddr超过 2 年前
I&#x27;m noticing very little discussion about the user aspect, and I say that with non-savvy users in mind. I run a mid-sized web app&#x2F;community where I&#x27;ve been supporting such users for a long time.<p>Right now, I offer a classic login, and a few social providers. You&#x27;d think this is straightforward to support, but about 70% of support requests consists of the endless ways in which users can mess this up.<p>&quot;Can&#x27;t get in&quot;<p>Try recover password. Email didn&#x27;t come. Because they entered the wrong email. Correct email this time. No wait, think I signed up with a social account, not sure which one, have many. Login worked. Wait now it doesn&#x27;t again (saved browser password did not update).<p>This is just the tip of the iceberg. This new solution, whatever merit it has, is going to be additive. It won&#x27;t replace anything, it&#x27;s yet another way to log in, if at all, as it depends on websites implementing it and about 90% of the web is basically not maintained.<p>So it&#x27;s only adding complexity&#x2F;confusion specifically to these users, which I consider to be the vast majority. In turn leading to more support headaches.
评论 #33185084 未加载
dickhardt超过 2 年前
Q: how many of you will add support to Passkeys to your application? Is it worth the effort of adding yet-another-way-to-login for your users? It will be a long time before you could use it as the ONLY way to login. You will need to figure out how to enable your existing users to convert to Passkeys. Apple has a glide path for converting username password -&gt; but not for other mechanisms.<p>I believe we in letting the user choose whatever way is best for them to login -- and to take that burden off of the developer. If you want to learn more, check out the Show HN post on Hellō I wrote this morning. <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=33177705#33182379" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=33177705#33182379</a>
rektide超过 2 年前
It&#x27;s be a damned good time for someone to start building a competing Google Sync impl &amp; server &amp; passkey implementation into Chromium.<p>For a while this was largely built around XMPP but now the stock Google implementation is custom.<p>I&#x27;d love a refresher crash course on what&#x27;s in Chrome that&#x27;s not in Chromium. It&#x27;s been a long time since I used Chromium but I think when I did it seemed to have a as-best-I-could-tell working Google Sync implementation.<p>It&#x27;s hard to imagine a scarier project to fork. I dont think there&#x27;s a lot of resources out there for DIY&#x27;iny a Chromium fork.
pabs3超过 2 年前
I wish WebAuthn would have a standardised HTTP header or TLS extension so it would be usable without JavaScript, currently every website has to implement their own login protocol in JavaScript.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;w3c&#x2F;webauthn&#x2F;issues&#x2F;1255" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;w3c&#x2F;webauthn&#x2F;issues&#x2F;1255</a> <a href="https:&#x2F;&#x2F;github.com&#x2F;w3c&#x2F;webauthn&#x2F;issues&#x2F;1616" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;w3c&#x2F;webauthn&#x2F;issues&#x2F;1616</a>
pabs3超过 2 年前
Here is the technical side of how passkeys work:<p><a href="https:&#x2F;&#x2F;www.imperialviolet.org&#x2F;2022&#x2F;09&#x2F;22&#x2F;passkeys.html" rel="nofollow">https:&#x2F;&#x2F;www.imperialviolet.org&#x2F;2022&#x2F;09&#x2F;22&#x2F;passkeys.html</a> <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=32946750" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=32946750</a>
评论 #33187665 未加载
xg15超过 2 年前
Dumb question: what keeps me from spoofing the fingerprint[1] and obtaining all the passcodes at once?<p>[1] <a href="https:&#x2F;&#x2F;phys.org&#x2F;news&#x2F;2005-12-biometric-expert-easy-spoof-fingerprint.html" rel="nofollow">https:&#x2F;&#x2F;phys.org&#x2F;news&#x2F;2005-12-biometric-expert-easy-spoof-fi...</a>
评论 #33185192 未加载
评论 #33182268 未加载
mimi89999超过 2 年前
Do you know if it&#x27;s possible to see a list of stored passkeys in Android? I installed the Play Service beta, managed to create a passkey and sign in, but can&#x27;t see the list of credentials anywhere in the UI.
评论 #33184736 未加载
评论 #33185199 未加载
sneak超过 2 年前
Pretty soon you won&#x27;t be able to log in to any major website with javascript disabled.
greatgib超过 2 年前
Another product that they will use their dominant position to force down our throat!
评论 #33178893 未加载
thrillgore超过 2 年前
Coming never to Firefox, Edge, and iOS.
评论 #33185204 未加载
评论 #33180223 未加载
评论 #33185716 未加载