Passkeys were invented by engineers with zero understanding of consumer brain • Hacker News Board

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#61

Post by vel0city » Wed, Jul 22, 2026, 3:26 PM UTC

bflesch wrote: post #34

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

Passkeys basically MITM the 2FA process so that they can track and deplatform you with a single click across all your accounts. The biometric verification also allows to confirm that a certain person is holding the device, and they can easily be matched to existing passport/travel databases. Great system if the good guys have it, a bit problematic if it's abused by nepo kids to hide their crimes.

> Passkeys basically MITM the 2FA process so that they can track and deplatform you with a single click across all your accounts.

I use passkeys with a physical authenticator. How do "they" track and deplatform me with a single click? Can you explain?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#62

Post by TeMPOraL » Wed, Jul 22, 2026, 3:26 PM UTC

mhurron wrote: post #54

summermusic wrote: post #35

Earlier quoted context omitted.

> ...it entirely depends on the service what kind of auth implementation they offer. I think that's exactly the problem. These are all answerable questions, but getting those answers is confusing for most people.

> These are all answerable questions, but getting those answers is confusing for most people. It's the same answer when someone asks 'how am I supposed to have a different password for every site' and 'how am I supposed to remember a password of X+ characters.' Use a password manager. Pretty sure every major one supports passkeys by now.

Password managers are themselves cross-device footguns and I could easily write the same headline for them myself. I've been working in tech for 20 years now, and I don't use them.

ETA: Well I do use auto-fill in browsers/mobile, but funny thing about this, I have three running on my phone[0], they all activate at the same time, and they contain mostly non-overlapping set of credentials, and I got tired of trying to sync them together, so I just look up passwords manually one by one in each and use clipboard to transfer the credential once I find it.

And I had to stop using passkeys because they interact with this split-brain system in unpredictable ways.

--

[0] - Specifically: Google Password Manager / Google Autofill / whatever they call it, Samsung Pass / Samsung Wallet (they're sort of but not the same?), and auto-fill built into Firefox.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#63

Post by izacus » Wed, Jul 22, 2026, 3:27 PM UTC

juancn wrote: post #21

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

Same here, also what if I lose the device? I can safely write down a password on a piece of paper and keep it somewhere phyisically safe. Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.

You do the same as you do when you lose your SSH key. Restore from backup and move on with your life.

Why is there so much misinformation nonsense around passkeys?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#64

Post by throwawayffffas » Wed, Jul 22, 2026, 3:27 PM UTC

reddalo wrote: post #47

giancarlostoro wrote: post #41

Earlier quoted context omitted.

If you save it via Passwords app, it'll be iOS / macOS mainly, but you can unlock with any Apple device that supports Passkey / Passwords app (so likely modern + reasonably updated) the easiest. If you want it to work "everywhere" then you CAN use your iOS / MacOS Passkey, it will show you a QR code, some places poorly support this, I believe both devices need bluetooth, and then it will authenticate it. Linux is the…

> Linux is the only oddball here, I had issues getting this flow to work. Take a guess why. Passkeys are just a trick for vendor lock-in disguised as a security practice.

Unpopular opinion but correct the whole thing has been designed to lock you to devices they make and have themselves be the arbiter of your authentication.

If that wasn't the intent they could have make the thing work like ssh keys, encrypted at rest, you can take them wherever you want.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#65

Post by josteink » Wed, Jul 22, 2026, 3:27 PM UTC

SirFatty wrote: post #5

voidmain0001 wrote: post #2

It just so happened that Microsoft sent an email today to our M365 tenant administrators that SMS and voice for 2FA is being removed 1-Feb-2027 and that automatic enrollment to passkeys starts 1-Sep-2026. Bring on the passkey overlords. Although, LLMs say that passkeys are superior to passwords since it includes a public/private key setup with the private key saved to a device that requires a PIN or biometric to acce…

That's if you're using Authenticator.

Clarification: Microsoft Authenticator.

You can’t use any random password-manager with passkey support.

I use Bitwarden for everything and have to have MS Authenticator installed just for this 1 login.

Super annoying.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#66

Post by usernametaken29 » Wed, Jul 22, 2026, 3:27 PM UTC

I don’t understand this point at all. I think the author has himself confused with the average consumer. For the first time in a decade or so you can buy a PHYSICAL key and use it to sign into websites. I can explain this to any grandma out there. Likewise, I’m an Apple user. Once you’re in Apple universe passkeys are extremely easy. Tap your thumb on the scanner, done. Now we can put on the tinfoil hat and say how this fosters vendor lock in yadda yadda but the last thing I would say is that it has terrible user ergonomics. LOL

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#67

Post by Tarq0n » Wed, Jul 22, 2026, 3:28 PM UTC

rsyring wrote: post #37

FWIW: I find passkeys to be a very simple and easy to use concept. Simple: it's like a password that I don't have to type in Easy to use: because I use 1Password and just have it installed on everything. On Android, it can be set as the default passkey provider so, even on mobile, I am using passkeys shared across devices. Is this "less secure" because I'm sharing the keys through 1Password. I suppose, at some level.…

OK now say you're on a work/library/friend's computer and you want to look up an account in 1password on your phone so you can type in the password. Passkeys don't support this very basic and common workflow. Meanwhile there's no real security benefit over password manager generated complex and not reused passwords.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#68

Post by cpburns2009 » Wed, Jul 22, 2026, 3:28 PM UTC

notatoad wrote: post #38

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

these questions all have easy answers that could be quite easily discovered by simply trying to use passkeys, instead of trying to find reasons not to use them.

You shouldn't be forced to discover what capabilities exist by brute force. Just freaking explain it.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#69

Post by RHSeeger » Wed, Jul 22, 2026, 3:28 PM UTC

microflash wrote: post #29

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

You can store your passkeys in Bitwarden or Keepass vault. Then you can use them through Bitwarden or Keepass apps on any other device. Been using passkeys like this for several years, and it works pretty seamlessly. With Keepass vault, I even have an offline copy as backup.

If you store the key in Bitwarden or Keepass, what makes it different from a password?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#70

Post by odux » Wed, Jul 22, 2026, 3:28 PM UTC

msandford wrote: post #39

varispeed wrote: post #24

Earlier quoted context omitted.

Sounds like something security services would love people to use. Instead of using wrench to extract the password - and distressed person may lose memory, they can just locate the passkey.

Nobody is safe from a nation-state "attack" they'll just go threaten your providers to give up your data. Passwords written on paper are probably safer than a centralized password manager for almost every circumstance other than a government coming after you.

Papers: Safe - yes. Easy to lose/misplace: also yes.