Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

31–40 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#31

Post by gretch »

juancn wrote: post #26
mingus88 wrote: post #20

Earlier quoted context omitted.

It’s really not that hard. Most of your devices are in the Apple ecosystem and when you are prompted to create a passphrase it will ask you to put it in your iCloud Keychain. Boom, now it is available across all of those This is how it will work for most people who don’t care about security and just casually use their devices. My boomer mom does this. It’s better than the notebook full of handwritten passwords she wa…

What if I lose all my apple devices? House break-in and they steal my mac and my phone? You're basically fucked even if you buy a new one because you need one of the other two to log in.

No technology in the world can protect you against every threat model and unlikely scenario.

What if the robber hits you in the head and you get brain damage and forget your password?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#32

Post by owaislone »

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

Answer to almost all of your questions is that it entirely depends on the service what kind of auth implementation they offer. I personally have completely adopted passkeys and use them with every service that allows it.

I use ProtonPass and have made it the default password store on every device and browser. This way all passkeys get stored in proton and I can login from any other personal device with proton setup.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#34

Post by bflesch »

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

Passkeys basically MITM the 2FA process so that they can track and deplatform you with a single click across all your accounts.

The biometric verification also allows to confirm that a certain person is holding the device, and they can easily be matched to existing passport/travel databases.

Great system if the good guys have it, a bit problematic if it's abused by nepo kids to hide their crimes.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#35

Post by summermusic »

owaislone wrote: post #32
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

Answer to almost all of your questions is that it entirely depends on the service what kind of auth implementation they offer. I personally have completely adopted passkeys and use them with every service that allows it. I use ProtonPass and have made it the default password store on every device and browser. This way all passkeys get stored in proton and I can login from any other personal device with proton setup.

> ...it entirely depends on the service what kind of auth implementation they offer.

I think that's exactly the problem. These are all answerable questions, but getting those answers is confusing for most people.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#36

Post by corndoge »

coldpie wrote: post #27
mingus88 wrote: post #20

Earlier quoted context omitted.

It’s really not that hard. Most of your devices are in the Apple ecosystem and when you are prompted to create a passphrase it will ask you to put it in your iCloud Keychain. Boom, now it is available across all of those This is how it will work for most people who don’t care about security and just casually use their devices. My boomer mom does this. It’s better than the notebook full of handwritten passwords she wa…

Proton Pass is on the official Passkey client naughty list[1]. I hope the services you log in to don't choose to ban it because of those big, scary X's. [1] https://passkeys.dev/docs/reference/known-issues/

The fact that services can ban passkey providers is a major red flag in the protocol and the real issue that nobody talks about

well, people are talking about it but it's not making a difference https://lucumr.pocoo.org/2025/9/2/passkeys/

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#37

Post by rsyring »

FWIW: I find passkeys to be a very simple and easy to use concept.

Simple: it's like a password that I don't have to type in

Easy to use: because I use 1Password and just have it installed on everything. On Android, it can be set as the default passkey provider so, even on mobile, I am using passkeys shared across devices.

Is this "less secure" because I'm sharing the keys through 1Password. I suppose, at some level. But before that, I was simply sharing passwords through 1Password in the exact same way. So, I don't think my security posture has changed any.

What has changed is the UX and IMO for the better. Now I don't have to generate/fill/copy-paste text strings for user names or passwords. 1Password knows what site I'm on and usually responds automatically when I'm in a passkey context. If I have more than one passkey available, because I have multiple accounts (for something like Google Workspace), it shows me options and I pick the one I want.

Honestly, it's mostly a "just works" system and I like it a lot better than passwords.

YMMV, of course.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#38

Post by notatoad »

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

these questions all have easy answers that could be quite easily discovered by simply trying to use passkeys, instead of trying to find reasons not to use them.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#39

Post by msandford »

varispeed wrote: post #24
juancn wrote: post #21

Earlier quoted context omitted.

Same here, also what if I lose the device? I can safely write down a password on a piece of paper and keep it somewhere phyisically safe. Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.

Sounds like something security services would love people to use. Instead of using wrench to extract the password - and distressed person may lose memory, they can just locate the passkey.

Nobody is safe from a nation-state "attack" they'll just go threaten your providers to give up your data. Passwords written on paper are probably safer than a centralized password manager for almost every circumstance other than a government coming after you.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#40

Post by microflash »

cpburns2009 wrote: post #17
datakan wrote: post #6

Passkeys are just SSH keys in how they work. We've been doing this since the 90's. The only people that use SSH keys are the Linux savvy users and those who are forced to via an enterprise solution for vaulting. The average person doesn't know anything about this stuff nor do they care. I also have yet to see a Passkey solution that didn't also have a password on it and a nice little box letting people choose to use…

I can find my ssh keys in `~/.ssh`. No such place exists for passkeys.

It depends on the app you’re using to save passkeys. Use Keepass and it saves the passkeys into kdbx file (similar to SSH keys).
Post reply on HN