GitHub announced today the introduction of passwordless authentication support in public beta, allowing users to upgrade from security keys to passkeys.
Maybe I’m misinterpreting something here, but wouldn’t that mean, I can’t just access my account if I lose my auth device? Am I supposed to always have a passkey device locked somewhere safe?
I just tried this out with Github. My passkey lives in 1Password so it’s backed up and synced across devices. It also lets me sign in with normal MFA/TOTP if I don’t have the passkey, or use a recovery code. Incidentally @brian@programming.dev this is working in Firefox now.
Passkeys use a challenge/response protocol that doesn’t transmit any actual secrets. This makes them phishing resistant as you can’t just “type in your passkey secret” it gitnub .com
You’re supposed to have multiple devices (phone, tablet, laptop, desktop, etc) that all store your passkey securely (it can’t just be sitting on the SSD…). You’re also supposed to backup your passkey.
Yes, if you lose access to all your devices it could prove challenging to access GitHub… but that’s a pretty unlikely scenario and most people should be willing to pay the price (what self respecting programmer travels anywhere without two or three devices?)
You are also supposed to backup everything you have on GitHub elsewhere… so it shouldn’t be a total disaster if you lose access. It’d just be annoying. And presumably GitHub has some kind of recovery process for someone who’s lost access to an account? What if the repository maintainer dies? Someone else has to be able to take over.
On the other hand - if my bank required a passkey… then I’d probably switch banks. If all my stuff is stolen or destroyed, I still need access to my money. And if someone compromises my bank… well it’s just money. The stakes are far higher if a popular GitHub repository is compromised.
As someone who works with people too stupid to log in to github without having to reset their password every time and having to take a full hour to figure out how to use their recovery method, that’s going to be a pain in the butt. I can foresee lots of "hey, quick question"s if they really do phase out simpler login methods. It’s good to have options for sure, but the standard login method should stay imo
My understanding is that these passkeys can be securely synced - either via your device cloud (e.g. iCloud), or hopefully soon via your password manager. So not that different in terms of UX than current 2FA, but more secure in the backend.
SQRL’s problem is it only focuses on the login component. It doesn’t really solve storage/backup/sync. All three have to be extremely easy to use otherwise any authentication system is a non-starter for the general public.
Passwords might not be secure, but they are user friendly (if you allow bad passwords). That ease of use cannot be taken away.
Firefox does support Passkeys - it’s just incomplete - specifically some of the major key storage locations aren’t supported yet (and it depends what operating system you’re running Firefox on, since every OS has different options for secure key storage).
Very mixed feelings on GitHub’s recent approaches to security. Tighter security measures are great, but deprecating password authentication on git operations seems obtuse to me. What if I want to push a change from a machine that’s not mine and doesn’t have my registered SSH key on it? I don’t have a Yubikey or anything similar nor do I intend to get one in the foreseeable future.
I’m with you on this. How on earth are one-off login events supposed to work? I want nothing about me logging on to be stored on that device or account other than, for example, the code I download. Maybe I’m missing something but the search I just did suggested connecting my phone via bluetooth, which is also not an option.
I just got a repo token and do git add remote origin https://REPO_TOKEN@github.com/username/repo.git and say bye-bye to usernames and passwords. Easiest pushes and pulls ever with private, public or org repos.
we’re talking about a hypothetical one-off situation on a computer that isn’t yours though; right? That happens from time to time, and an authentication process that requires you to persist your auth information on disk carries some extra risks. You need to remember to delete it when you’re done.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !programming@programming.dev
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person’s post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
Follow the programming.dev instance rules
Keep content related to programming in some way
If you’re posting long videos try to add in some form of tldr for those who don’t want to watch videos
Maybe I’m misinterpreting something here, but wouldn’t that mean, I can’t just access my account if I lose my auth device? Am I supposed to always have a passkey device locked somewhere safe?
I just tried this out with Github. My passkey lives in 1Password so it’s backed up and synced across devices. It also lets me sign in with normal MFA/TOTP if I don’t have the passkey, or use a recovery code. Incidentally @brian@programming.dev this is working in Firefox now.
So, it’s just a password with a different name.
Seriously, what is the functional difference between this and stricter password requirements? I don’t see it.
Passkeys use a challenge/response protocol that doesn’t transmit any actual secrets. This makes them phishing resistant as you can’t just “type in your passkey secret” it gitnub .com
You’re supposed to have multiple devices (phone, tablet, laptop, desktop, etc) that all store your passkey securely (it can’t just be sitting on the SSD…). You’re also supposed to backup your passkey.
Yes, if you lose access to all your devices it could prove challenging to access GitHub… but that’s a pretty unlikely scenario and most people should be willing to pay the price (what self respecting programmer travels anywhere without two or three devices?)
You are also supposed to backup everything you have on GitHub elsewhere… so it shouldn’t be a total disaster if you lose access. It’d just be annoying. And presumably GitHub has some kind of recovery process for someone who’s lost access to an account? What if the repository maintainer dies? Someone else has to be able to take over.
On the other hand - if my bank required a passkey… then I’d probably switch banks. If all my stuff is stolen or destroyed, I still need access to my money. And if someone compromises my bank… well it’s just money. The stakes are far higher if a popular GitHub repository is compromised.
As someone who works with people too stupid to log in to github without having to reset their password every time and having to take a full hour to figure out how to use their recovery method, that’s going to be a pain in the butt. I can foresee lots of "hey, quick question"s if they really do phase out simpler login methods. It’s good to have options for sure, but the standard login method should stay imo
My understanding is that these passkeys can be securely synced - either via your device cloud (e.g. iCloud), or hopefully soon via your password manager. So not that different in terms of UX than current 2FA, but more secure in the backend.
I like it on principle, but haven’t tried any passkey stuff yet. Truth be told, I kinda liked SQRL, but that is clearly going nowhere.
SQRL’s problem is it only focuses on the login component. It doesn’t really solve storage/backup/sync. All three have to be extremely easy to use otherwise any authentication system is a non-starter for the general public.
Passwords might not be secure, but they are user friendly (if you allow bad passwords). That ease of use cannot be taken away.
Excellent point. I’ve got exactly one SQRL login and even it was just to play with it. I never got as far as real world considerations. :)
For anyone else trying to get it to work on firefox, it doesn’t support passkeys yet but it’s on the roadmap. https://connect.mozilla.org/t5/ideas/support-webauthn-passkeys/idc-p/30123/highlight/true#M17028
Firefox does support Passkeys - it’s just incomplete - specifically some of the major key storage locations aren’t supported yet (and it depends what operating system you’re running Firefox on, since every OS has different options for secure key storage).
Very mixed feelings on GitHub’s recent approaches to security. Tighter security measures are great, but deprecating password authentication on git operations seems obtuse to me. What if I want to push a change from a machine that’s not mine and doesn’t have my registered SSH key on it? I don’t have a Yubikey or anything similar nor do I intend to get one in the foreseeable future.
I’m with you on this. How on earth are one-off login events supposed to work? I want nothing about me logging on to be stored on that device or account other than, for example, the code I download. Maybe I’m missing something but the search I just did suggested connecting my phone via bluetooth, which is also not an option.
I just got a repo token and do
git add remote origin https://REPO_TOKEN@github.com/username/repo.gitand say bye-bye to usernames and passwords. Easiest pushes and pulls ever with private, public or org repos.But now you have the only credential, the REPO_TOKEN in plaintext in your .git/config file. That’s even worse.
Edit: typo
That’s amazing! 😍 (and retarded too lol) :)
That’s how a lot of tools work. Your maven password is in .m2/settings.xml
Your ssh private key is in .ssh/id_rsa
The only person with access to these files should be you. If anyone else does then your machine is compromised
we’re talking about a hypothetical one-off situation on a computer that isn’t yours though; right? That happens from time to time, and an authentication process that requires you to persist your auth information on disk carries some extra risks. You need to remember to delete it when you’re done.
You don’t need to remember to delete it, you can revoke the access from your github account.
Then it’s useless.
For the maven password, ok maybe. Your ssh private key should require a passphrase.