Technology
This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.
Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.
Rules:
1: All Lemmy rules apply
2: Do not post low effort posts
3: NEVER post naziped*gore stuff
4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.
5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)
6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist
7: crypto related posts, unless essential, are disallowed
view the rest of the comments
I foresee hardware tokens becoming more of a thing - also Passkeys (they’re so easy to use!). I do wonder if we’ll have more of a formal process to either backup or have “ownership” of our cloud accounts as they become even more intertwined with our lives.
For example: iCloud Keychain is so easy to use, but what happens to your Passkeys if the account gets frozen? Currently, I don’t think there’s a way to extract the private keys (?).
Just FYI, your account shows up as a bot. You should change it in your account settings.
Thanks!
If your account is frozen they should still be on the device. That would be a good time to change all your passkeys over to a yubikey, or to add one as a secondary token.
The keys being locked in a Secure Enclave is generally considered a feature, not a bug. That passkeys sync at all is somewhat concerning. I wouldn’t expect them to be exportable any time soon.
How do Passkeys sync across devices on a single account?
Apple actually describes the process for sync in some detail: https://support.apple.com/guide/security/secure-keychain-syncing-sec0a319b35f/web
Apple also describes the keychain recovery process in depth (I think this is when you’ve lost all devices?): https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/1/web/1
The Secure Enclave can apparently return the private key. For most keys it is encrypted with a key pair that is permanently stored in the Secure Enclave. For synchronized keys it is apparently encrypted with a key that is also stored in iCloud in such a way that Apple themselves cannot get to it.
It does sound like they could potentially enable exporting the passkeys, I think it’s unlikely they would because they provide a method to move them to other devices already and it does introduce more avenues for misuse. I don’t think it’s a huge requirement anyway, most hardware tokens provide no way to export at all by design. Apps that use them for 2FA should provide for enrolling multiple tokens.
Wow - thanks for this. It’s really interesting! I had a feeling they were exporting the key since Passkeys “magically” migrate from device to device. I’m sure it’s using some token that they would be very hard pressed to divulge.
I guess this rules out exporting the token, but to everyone else’s point, I think it’s still possible to access your on-device Passkeys without an iCloud account.
The use of a “secure enclave” for any purpose is a bug at best, because secure enclaves aren't just secure against your adversaries; they're also secure against you. This is intolerable. All machines must obey their owner, and “secure enclaves” by design don't.
Hard disagree. That rules out yubikey, smart cards, and most any other credential storage systems.