1k VIEWS
Pinterest LinkedIn LINE

On October 12, idcon vol. 29 was held at Money Forward in Tamachi1.

Below is a summary of my real-time tweets.

Passkey Implementation on Android & Chrome by @agektmr

Presentation Overview

  • 1) Passkeys replace passwords and also replace 2-step authentication. 2) Authentication occurs locally; biometrics are not sent over the network. 3) Created passkeys synchronize across devices.
  • Passkeys are a coordinated initiative by Google, Apple, and Microsoft.
  • What makes passkeys remarkable:
    1. The technology is standardized by @FIDOAlliance and the W3C WebAuthn WG.
    2. It provides 2-factor authentication by itself: possession plus knowledge or inherence.
    3. It resists phishing because passkeys are bound to domains.
    4. Widespread adoption eliminates passwords. Only public keys reside on servers, so leaks pose little risk.
  • Demo
    • In this example, “Use your screen lock” appears and biometric authentication signs the user in.
  • Google implements #passkey as discoverable credentials; for Apple, every created FIDO Credential is a passkey.
  • The scope differs by company. Apple includes all #fido credentials; Google calls only credentials synchronized through Google Password Manager passkeys.
  • Synchronization is a breakthrough because credentials were previously bound to one device, requiring an old-device login or SMS authentication; with 100 devices this became unwieldy.
  • Synchronization uses the device-unlock code and requires Google Play services. Android can use #passkey through Google Password Manager.
  • Google Password Manager works only on Android, not Mac, iOS, iPadOS, or Windows. Apple is moving toward iCloud Keychain, but currently has no API.
  • Google plans to enable third-party password managers.
  • Recommended #passkey UX
    • 1) Form autofill through Conditional UI enables seamless login for password users too; create a passkey immediately after the first login.
    • 2) Across ecosystems, use the mode renamed from caBLE to Hybrid. Scan a QR code with a smartphone; BLE proximity verification prevents login if the code is sent elsewhere.
  • Device public key is a WebAuthn extension addressing concerns about abandoning device binding. Apple has no support plans; Android supports it, initially without attestation.

Q&A

Q. Does #passkey synchronization really include private keys?
A. YES, encrypted. The questioner: “That’s bold.”

Q. What about E2EE?
A. Unknown.

Q. If Conditional UI and another device are used with Hybrid, won’t the account be missing?
A. There is room for improvement; Apple’s approach may be good.

Passkey Implementation on iOS , iPadOS, and macOS by @nov

Presentation Overview

  • iOS 16+, iPadOS 16+ at the end of this month, and macOS 13+ support #passkey.
  • #passkey was originally announced at WWDC 21, emphasizing simplicity.
  • Always with you (if you only use Apple devices)
  • Passkey + Autofill = new WebAuthn UX. After about 10 years of #fido work, nobody uses it: people do not care about security, so UX must be good even at some security cost.
  • Demo
    • Use a browser QR code to sign in with an iPhone as the key.
    • A link below the QR code invokes YubiKey, but Conditional UI is not good for YubiKey users.
    • Passkey synchronization took only seconds.
  • Resolved issues:
    1. People with Apple devices get synchronization.
    2. Email fill-in, password fill-in, and 2 Face ID operations are reduced to 1.
  • Unresolved issues:
    1. Updating the email address in a discoverable credential is being discussed at W3C but remains unresolved.
    2. For reauthentication, Conditional UI cannot designate a particular key, so password fill-in shows multiple candidates; a change was merged into the specification.
    3. How should sign-up through autofill work? Password managers handle passwords automatically; a solution is needed.
    4. Crossing 3 platforms remains unsolved, so this is not such a game changer.
    5. On Apple, no FIDO credential can be created if iCloud Keychain is disabled, as on corporate devices. Roaming Credentials remain available.
    6. Analogous to POST /.well-known/change-password, POST /.well-known/webauthn-credentials might let users achieve the goal without noticing.

Q&A

Q. If iCloud Keychain is disabled, must users use YubiKey or similar?
A. YES. Use an iPhone or a Roaming Credential. Apple’s practical answer may be to use a password because alternatives are difficult.

Yahoo’s WebAuthn UX and Considerations for Passkey-Compatible UX by YumejiHattori (a junior colleague of @kura_lab)

  • YJ authentication uses a 2-screen identifier-first pattern. If FIDO is registered to the ID, WebAuthn starts automatically on screen 2; devices without the credential show a failure dialog.
  • FIDO did not support credentials.exists(credentialId), partly because it could be used as a SuperCookie.
  • Credential existence is therefore inferred from the OS.
  • Passkey challenge 1: if registered on #iOS but not #MacOS, #webauthn does not start.
  • The BackupState (BS) flag in authenticatorData.flags can indicate iOS/macOS synchronization, enabling WebAuthn on Mac.
  • Passkey challenge 2: lack of Hybrid (caBLE) support. Signing in to Windows using iOS leaves Windows registered but iOS unregistered.
  • The service wants to suggest WebAuthn, but…
  • Example of full passkey support:
    1. Require users to choose an authentication method, as GitHub does, prominently displaying “Use biometric authentication.” Most press it regardless of availability and encounter disappointment.
    2. With Conditional UI, Touch ID appears when a credential exists; otherwise password and another-device options appear. This is exactly the desired behavior, but…
  • Conditional UI challenges
    • When the service deletes a credential, it remains usable on the device but is rejected by the service.
  • A better UX should account for these issues.
    • If reauthentication: automatically start WebAuthn from cookie history.
    • Else if new login: Conditional UI.
    • Else: show a WebAuthn selection screen, including passive and Hybrid options.

Q&A

Q. When logging into Windows with iOS through Hybrid, can the service tell that iOS was used?
A. Not when registration occurs through Hybrid; Apple deliberately conceals it.

Q. How can a user who once fell back to SMS return to WebAuthn?
A. Perhaps ask them to register WebAuthn on the verification-code screen.

Q. RP-side deletion also affects passwords, but password changes are reflected in Password Manager; what about passkeys?
A. On Android, creating a new credential with the same user handle overwrites it. (by @agektmr)

Q. Could AirDrop be used to share subscriptions?
A. Many sites such as Netflix allow family sharing, so this is not a problem in such cases.

General Q&A

Q. Is AirDrop phishing possible?
A. Both parties must be in each other’s contacts, but that could be bypassed.

Q. Will “passkey” be used for end users? UX currently differs by company.
A. It is not yet used prominently, but appears in help materials.

Q. Users may be prompted for a passkey in both email and password fields; platform support timing varies.
A. Considering reverse brute force…

Q. During reauthentication, supporting #passkey makes the RP dependent on platform-compromise risk. How should RPs view this?
A. If the risk is intolerable, do not use it. A certain US financial institution groaned at this (by @_nat).

Q. Is consumer use premised on no attestation?
A. A certain company assumes none.

Q. Could a malicious authenticator deceive the RP without attestation?
A. Theoretically, yes.
A2. A US platform vendor said nobody uses attestation, though some do.
A3. Perhaps what was trusted under a gentlemen’s agreement has now explicitly become untrustworthy?

Q. Is it “passkey” or “passkeys”?
A. Treat it like password/passwords.
A2. Think of it as a better password—one known to be managed by a password manager.

Watch this video on YouTube.
Playing the video connects to YouTube.

Footnotes

  1. the first in-person event since COVID

Related posts