Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

51–60 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#51

Post by giancarlostoro »

reddalo wrote: post #47
giancarlostoro wrote: post #41

Earlier quoted context omitted.

If you save it via Passwords app, it'll be iOS / macOS mainly, but you can unlock with any Apple device that supports Passkey / Passwords app (so likely modern + reasonably updated) the easiest. If you want it to work "everywhere" then you CAN use your iOS / MacOS Passkey, it will show you a QR code, some places poorly support this, I believe both devices need bluetooth, and then it will authenticate it. Linux is the…

> Linux is the only oddball here, I had issues getting this flow to work. Take a guess why. Passkeys are just a trick for vendor lock-in disguised as a security practice.

Firefox just didn't support it cleanly, I think Chrome did, I don't remember. Apparently it's just due to Linux not having a native passkey implementation. Dang.

Edit:

Apparently BitWarden should work, but my particular passkey was not on there.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#52

Post by 1-more »

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

> If I accidentally set up a passkey on my phone (let’s say I use Safari one day instead of my go-to, Brave), can I still log in without that passkey on other devices?

N=1 and I'm sure I'm holding it wrong, but I can only log in to ADP to request PTO from my personal laptop because I set up an iCloud passkey, work laptop does not allow access to iCloud keychain, and you can't request PTO from mobile.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#53

Post by jerf »

varispeed wrote: post #22

I find it difficult to explain how to use password manager to non-IT person. Whatever I say, they say it is not secure. No amount of explanation will change their mind. They prefer to keep their passwords in their physical note book hidden in the safe (yes, they open the safe etc each time they need to log in somewhere when they get logged out). As someone with ADHD a passkey is something I can lose easily and I don'…

If the person you describe really is doing that for all their passwords, then they are correct. Their password store is more secure than a password manager by nearly every metric that counts.

The one thing I would ding that approach on is recoverability, though. If a fire burns that down, it's gone.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#54

Post by mhurron »

summermusic wrote: post #35
owaislone wrote: post #32

Earlier quoted context omitted.

Answer to almost all of your questions is that it entirely depends on the service what kind of auth implementation they offer. I personally have completely adopted passkeys and use them with every service that allows it. I use ProtonPass and have made it the default password store on every device and browser. This way all passkeys get stored in proton and I can login from any other personal device with proton setup.

> ...it entirely depends on the service what kind of auth implementation they offer. I think that's exactly the problem. These are all answerable questions, but getting those answers is confusing for most people.

> These are all answerable questions, but getting those answers is confusing for most people.

It's the same answer when someone asks 'how am I supposed to have a different password for every site' and 'how am I supposed to remember a password of X+ characters.' Use a password manager. Pretty sure every major one supports passkeys by now.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#55

Post by throwawayffffas »

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

I think the intended workflow is you login with your phone and that device is now the authority that allows other devices to issue their own passkeys.

In my opinion it's a bad plan, because it elevates certain devices to privileged status, if you lose your phone you are hosed.

Passkeys should be allowed to be synced between devices and stored on password managers in the cloud. I am making my own password manager for my personal use, but have not delved into passkeys.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#56

Post by gortok »

helix90 wrote: post #43
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

Listening to Yubikey and OnePassword talk about this, they actually say "One Person, One Device". Which really speaks to their failure to understand their users.

I would love to see what you’re referencing, can you provide a link or citation to that quote?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#57

Post by frizlab »

reddalo wrote: post #47
giancarlostoro wrote: post #41

Earlier quoted context omitted.

If you save it via Passwords app, it'll be iOS / macOS mainly, but you can unlock with any Apple device that supports Passkey / Passwords app (so likely modern + reasonably updated) the easiest. If you want it to work "everywhere" then you CAN use your iOS / MacOS Passkey, it will show you a QR code, some places poorly support this, I believe both devices need bluetooth, and then it will authenticate it. Linux is the…

> Linux is the only oddball here, I had issues getting this flow to work. Take a guess why. Passkeys are just a trick for vendor lock-in disguised as a security practice.

They are, however, completely unphishable, which is a big plus IMHO

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#58

Post by moi2388 »

reddalo wrote: post #47
giancarlostoro wrote: post #41

Earlier quoted context omitted.

If you save it via Passwords app, it'll be iOS / macOS mainly, but you can unlock with any Apple device that supports Passkey / Passwords app (so likely modern + reasonably updated) the easiest. If you want it to work "everywhere" then you CAN use your iOS / MacOS Passkey, it will show you a QR code, some places poorly support this, I believe both devices need bluetooth, and then it will authenticate it. Linux is the…

> Linux is the only oddball here, I had issues getting this flow to work. Take a guess why. Passkeys are just a trick for vendor lock-in disguised as a security practice.

What are you talking about? I can literally export all that data to another OS or password manager. Takes a whopping single click.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#59

Post by izacus »

juancn wrote: post #28
datakan wrote: post #6

Passkeys are just SSH keys in how they work. We've been doing this since the 90's. The only people that use SSH keys are the Linux savvy users and those who are forced to via an enterprise solution for vaulting. The average person doesn't know anything about this stuff nor do they care. I also have yet to see a Passkey solution that didn't also have a password on it and a nice little box letting people choose to use…

I would feel a lot better using SSH keys rather than passkeys. At least those are understandable.

They're literally the same thing, what are you on about?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#60

Post by reddalo »

programmertote wrote: post #19

Like some folks already commented here, even as someone who has been working in tech for 20+ years, I find Passkey confusing. I understand the key aspect in computer science term, but I don't know how to use it across devices. Another big worry is that if I tie that to a physical key, then I might lose it (because it's physical) and never get it back.

Exactly, I always refuse to add a passkey because I'm afraid I won't be able to easily login again. Also, I don't want to be locked in to a vendor.
Post reply on HN