Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

71–80 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#71

Post by giancarlostoro »

moi2388 wrote: post #58
reddalo wrote: post #47

Earlier quoted context omitted.

> Linux is the only oddball here, I had issues getting this flow to work. Take a guess why. Passkeys are just a trick for vendor lock-in disguised as a security practice.

What are you talking about? I can literally export all that data to another OS or password manager. Takes a whopping single click.

I didn't realize this was supported, I'm kind of favoring Apple's Passwords app since you can lockdown your account and they are very on top of someone accessing anything of yours. Any time I power on an iPad I havent used for months they tell me a new device can read my texts type of thing, which is a nice paper trail.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#72

Post by kodt »

dfabulich wrote: post #49
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

I looked up the June 2026 breach and there is no mention of passwords being stolen. Only some PII (Phone, name, email, address) through a third party.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#73

Post by teekert »

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

I use ProtonPass and afaiu it just syncs the passkeys private part everywhere you need it. So it “just works”. This is better than just old fashioned credentials because the passkey only “triggers” on the correct domain, so they can’t be phished by other domains… Right?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#74

Post by Tarq0n »

mullingitover wrote: post #33

You’d think a head of product at a tech company would embrace a “it’s literally impossible to have your password stolen if you use this” technology.

You can still get your session cookies stolen. If you have good password hygiene passkeys only protect you in extremely niche scenarios.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#75

Post by schmichael »

I mostly love passkeys to be honest even though I use multiple browsers across multiple devices and OSes (iOS, Chromebook, Linux, macOS, Xbox, etc). Bitwarden’s support is (finally) pretty good.

My problem is that I manage a lot of accounts for my family which makes passkeys a nightmare. If I’m out and a kid gets chucked into a login flow that happens to require a passkey, I can’t text a password and TOTP code to the adult with them. I know that’s terrible opsec but the reality is people share accounts and passkeys are designed to thwart that.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#76

Post by nlawalker »

rsyring wrote: post #37

FWIW: I find passkeys to be a very simple and easy to use concept. Simple: it's like a password that I don't have to type in Easy to use: because I use 1Password and just have it installed on everything. On Android, it can be set as the default passkey provider so, even on mobile, I am using passkeys shared across devices. Is this "less secure" because I'm sharing the keys through 1Password. I suppose, at some level.…

My problem with passkeys is that "don't have to" is actually "don't have to, and couldn't if I wanted to".

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#77

Post by dfabulich »

juancn wrote: post #26
mingus88 wrote: post #20

Earlier quoted context omitted.

It’s really not that hard. Most of your devices are in the Apple ecosystem and when you are prompted to create a passphrase it will ask you to put it in your iCloud Keychain. Boom, now it is available across all of those This is how it will work for most people who don’t care about security and just casually use their devices. My boomer mom does this. It’s better than the notebook full of handwritten passwords she wa…

What if I lose all my apple devices? House break-in and they steal my mac and my phone? You're basically fucked even if you buy a new one because you need one of the other two to log in.

Then you'll login to your Apple iCloud account using your password.

Passkeys are just passwords that require a password manager; you can't login to a password manager without something outside the password manager, usually a password. (That's why they call it "LassPass" and "1Password"; there's one last password you'll still have to maintain.)

No password manager tries to get you to login with a passkey without setting a password, for precisely that reason. Apple, Google, and Microsoft do invite you to login to their password managers via passkey, because it's convenient and unphishable, but they always also allow you to login via password (or "backup codes", which are just backup passwords).

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#78

Post by SirFatty »

josteink wrote: post #65
SirFatty wrote: post #5

Earlier quoted context omitted.

That's if you're using Authenticator.

Clarification: Microsoft Authenticator. You can’t use any random password-manager with passkey support. I use Bitwarden for everything and have to have MS Authenticator installed just for this 1 login. Super annoying.

I have Duo in our environment. Authenticator not required.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#79

Post by coldpie »

summermusic wrote: post #46
coldpie wrote: post #27

Earlier quoted context omitted.

Proton Pass is on the official Passkey client naughty list[1]. I hope the services you log in to don't choose to ban it because of those big, scary X's. [1] https://passkeys.dev/docs/reference/known-issues/

(I might be wrong, please correct me if I am) What I'm gathering from this page is that the Passkey spec can specify whether the app handling the passkey should prompt the user for biometric scan, PIN code, etc. but some apps simply ignore that flag. This makes sense though. I've already logged into my password manager and it hasn't timed out yet, so why would my password manager prompt me again? I'm glad that they d…

Your understanding is correct and I agree with you. The Passkey spec authors, however, think services should be allowed to ban your client for behaving this way:

> [When UV is required, KeePassXC must request user verification or not handle the request]

> This implementation is not spec compliant and has the potential to be blocked by relying parties.

https://github.com/keepassxreboot/keepassxc/issues/10406

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#80

Post by TeMPOraL »

dfabulich wrote: post #49
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

> Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourself

That's a red flag to me. It's enough that phone backup systems go out of their way to prevent you from accessing your own data, too, for unexplained "sekhurity" reasons.

> P.S. It's past time to move off of LastPass. LastPass lost all of your passwords again last month, just like they did in 2022. The most similar service is 1Password. If you like LastPass, you'll like 1Password about the same, but 1Password hasn't had multiple terrible security breaches.

That's the most annoying thing about password managers, and a major reason I still don't use them: there exists no password manager that is cross-platform (desktop/mobile in particular), local-first, and isn't sketchy or enshittified or otherwise on HN's current "don't use it, use instead" list.

For core security tool class, that doesn't inspire confidence.

Post reply on HN