Passkeys: A shattered dream • Hacker News Board

Re: Passkeys: A shattered dream

#101

Post by cjk2 » Fri, Apr 26, 2024, 8:53 AM UTC

lambdaone wrote: post #90

cjk2 wrote: post #57

Earlier quoted context omitted.

To be fair I've been to the US a few times and I've never been shot and I did end up in hospital and it was smooth as butter. Because I didn't hang around where I was likely to get shot and actually checked my insurance cover and had the cert on me. Note I live in London and everyone tells me I'm going to get stabbed too and die from the pollution...

London's homicide rate is (roughly, depending on which source you use and year you take) about one-fifth of the average US homicide rate; you are safer in London than in almost anywhere in the US.

13 per million per year in London. 60 per million per year in New York.

That's an 0.006% chance of getting murdered killed in NY every year.

And that doesn't account for (a) putting yourself in a good position to get killed like being a gang member and (b) the aggregate reduction in risk by only travelling there.

Re: Passkeys: A shattered dream

#102

Post by dimitar » Fri, Apr 26, 2024, 8:53 AM UTC

red_trumpet wrote: post #70

dimitar wrote: post #64

Earlier quoted context omitted.

Use a different factor of authentication and setup a new passkey?

Do you have to do this for every account? Like changing my password on every account?

yeah, I agree this is not a good experience

Re: Passkeys: A shattered dream

#103

Post by nurumaik » Fri, Apr 26, 2024, 8:55 AM UTC

Why couldn't passkeys just be a user-friendly wrapper around assymetric key pairs tech people already using?

Re: Passkeys: A shattered dream

#104

Post by frizlab » Fri, Apr 26, 2024, 8:57 AM UTC

My biggest issue with passkey is not passkey itself, which, when it works, is great, but more the implementation of it done on most websites.

Use a passkey on https://www.passkeys.io and it works great! On google too. But use it on PayPal, it does not anymore. Who’s to blame?

Re: Passkeys: A shattered dream

#105

Post by Tomte » Fri, Apr 26, 2024, 8:57 AM UTC

saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

Enroll another passkey. Password manager can also do that (Bitwarden, for example), so I really don‘t see a reason for all the agitation.

Re: Passkeys: A shattered dream

#106

Post by Shank » Fri, Apr 26, 2024, 8:58 AM UTC

nurumaik wrote: post #103

Why couldn't passkeys just be a user-friendly wrapper around assymetric key pairs tech people already using?

That’s basically what they are?

Re: Passkeys: A shattered dream

#107

Post by pricechild » Fri, Apr 26, 2024, 8:59 AM UTC

saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

Bitwarden (& vaultwarden) also offer passkey which seem to work pretty well.

I've not had a problem registering both this and my phone on any site.

Re: Passkeys: A shattered dream

#108

Post by cyborgx7 » Fri, Apr 26, 2024, 8:59 AM UTC

4ad wrote: post #89

myspy wrote: post #88

I think I'm a tech guy and know my fields. I still have no real clue how passkeys work, how it is better, what it really is. When your security feature is not as simple as - remember a name and a password and store it somewhere safe - it doesn't work. Something about keys that are on devices. But what happens when I use a phone and a pc? How to get access then? Do I need a User/PW for the first time? Or do I need one…

Passkeys are exactly like SSH keys. You should use them exactly like you use SSH keys.

If they are exactly like SSH keys, then why not just keep using SSH keys. Clearly, there is something else to them.

Re: Passkeys: A shattered dream

#109

Post by vouaobrasil » Fri, Apr 26, 2024, 9:05 AM UTC

threatofrain wrote: post #98

vouaobrasil wrote: post #96

Passkeys are horrible because the design encourages the need for a smartphone, which is itself a disaster.

Passkeys only encourage the need for a password management tool, which is funny because if everyone had password management tools to begin with then we wouldn't need passkeys.

True, the technical aspect of passkeys does that. But in practical Apple and others want to heavily push for the smartphone as that tool, because it locks people further into that system.

Re: Passkeys: A shattered dream

#110

Post by Tempest1981 » Fri, Apr 26, 2024, 9:07 AM UTC

cassianoleal wrote: post #78

saagarjha wrote: post #21

The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…

I agree. So far I think KeePassXC is the only one that allows you to export your Passkeys. I believe Bitwarden are working on it as well. That said, it's unclear whether this will provide any portability of passkeys between providers.

Once you export your passkeys, is there anything that can import them?