Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

121–130 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#121

Post by microflash »

cpburns2009 wrote: post #120
microflash wrote: post #40

Earlier quoted context omitted.

It depends on the app you’re using to save passkeys. Use Keepass and it saves the passkeys into kdbx file (similar to SSH keys).

Aren't they effectively locked in the database of whatever password manager is used? I know you can export them, sort of, but that feature may blacklist your password manager and make it useless. Are they portable? I thought passkeys are locked to the device.

I was answering to the storage part. Blacklisting is the attestation part which is definitely a concern. Again, you can use passkeys as a yet another way to login. You can still use passwords. It doesn’t have to be one or other.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#122

Post by thewebguyd »

helix90 wrote: post #43
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

Listening to Yubikey and OnePassword talk about this, they actually say "One Person, One Device". Which really speaks to their failure to understand their users.

Because the original FIDO/WebAuthn standard was built for device bound credentials. They imagined unique keypairs tied strictly to a specific piece of hardware. Synced passkeys were a compromise, mostly driven by Apple and Google, because per-device credentials are too much friction for general use. It's not that they failed to understand users, it's that they incorrectly assumed the level of inconvenience people are willing to tolerate to be textbook secure (the answer is almost zero inconvenience).

The device bound model also completely falls apart in the enterprise, fails to address shared devices and shift workers where employees share the same PC under the same OS profile, now you're back to needing good old fashioned SSO w/ physical MFA (Yubikey) to attest who the user is in addition to attesting the device itself.

Before synced passkeys, the actual standard is a unique key pair per device. The key pair on my phone shouldn't be synced to my laptop, my laptop should generate it's own key pair.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#123

Post by cpburns2009 »

rsyring wrote: post #37

FWIW: I find passkeys to be a very simple and easy to use concept. Simple: it's like a password that I don't have to type in Easy to use: because I use 1Password and just have it installed on everything. On Android, it can be set as the default passkey provider so, even on mobile, I am using passkeys shared across devices. Is this "less secure" because I'm sharing the keys through 1Password. I suppose, at some level.…

This is a big problem I have with "just works". Everyone is used to services only allowing a single password. I know the answer to this, but it's not clear in the marketing or how it's explained to normie end-users: Won't creating a passkey erase my password? How do you sign in on another device? Won't that change the passkey and lock me out from the first device?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#124

Post by dfabulich »

jasode wrote: post #108
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

>This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. The issue isn't what passkeys _are_ (e.g. explaining they are like public/private "ssh keys" and hoping that type of explanation ends the confusion). Instead, it's the workflow around passkeys. The websites show very confusing dialog popups and choices that a lot of normal people will not understand. This is…

I don't think you're giving those seniors good advice. When the banks ask people to "switch" to passkeys, they're not removing the passwords; they're adding passkeys as an alternate login mechanism.

If you lose your bank passkey, (e.g. if you put it in the wrong password manager and you can't figure out where it is) you can just sign in with your bank password.

In the worst case, banks actually don't make it very hard for seniors to reset your password/passkey; just show up at a branch with photo ID, your bank card, and your PIN, and a teller will help you reset your credentials. They do it all the time.

And, remember, seniors could also put a randomly generated password into the wrong password manager. In that case, they'll either have to reset their password, or they'll have figure out what they did, retrieve their password from the OS password manager, and transfer that password to their preferred password manager.

The exact same story applies to passkeys, except, because passkeys can't be copied and pasted, you'd have to figure out how to use the finicky app-to-app transfer system ("Credential Exchange Protocol"). That's probably too complicated for most seniors, so falling back to a password is almost certainly their best bet.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#125

Post by waffletower »

The cumbersome and poorly designed workflows surrounding passkeys are a significant hindrance to their adoption as well. It surprised me how bad they were when they emerged -- it was as if the UX was intentionally designed to kill passkey adoption.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#126

Post by cpburns2009 »

ranger207 wrote: post #82

The website for my HSA required me to set up a passkey last time I logged in. I set it up on my work laptop and my work password manager, which means I can now no longer access my account from my personal computer. This is fantastic, just what I wanted

This is exactly a scenario that worries me. Proponents of passkeys imply you can setup a bunch of passkeys. Evidently that's not always the case.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#127

Post by [deleted] »

varispeed wrote: post #22

I find it difficult to explain how to use password manager to non-IT person. Whatever I say, they say it is not secure. No amount of explanation will change their mind. They prefer to keep their passwords in their physical note book hidden in the safe (yes, they open the safe etc each time they need to log in somewhere when they get logged out). As someone with ADHD a passkey is something I can lose easily and I don'…

[deleted]

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#128

Post by thewebguyd »

rufo wrote: post #104
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

I recognize the point of your post is more about the lack of clarity and details around passkeys. That's real, and I don't really have an answer for that - other than, I think maybe the quest for making them simple and "just work" has maybe made them nebulous enough that we've wound up in the current situation where a lot of even technically savvy people don't really understand them. But I feel like answering your qu…

> passkeys are intended to sync via your password manager of choice as the primary use case.

The sync was actually a compromise to the standard. The idea was unique, device-bound credentials. One person, one device. The private key/passkey on your phone should not be the same one on your laptop, or your tablet, etc. Each device was supposed to have it' own unique credential.

Allowing sync is a security downgrade to the standard, in terms of threat-model guarantees. Pure WebAuthn credentials should be sealed in hardware (TPM or Secure Enclave or equivalent) and be mathematically non-exportable which guarantees zero remote blast radius, an attacker must physically posses the device.

Allowing sync and storing passkeys in a password manager reintroduces cloud account compromise risk and recovery flow hijacks. You lose non-repudiation.

Still more secure than passphrase + TOTP, but doesn't eliminate account takeover attacks against your cloud credential vault, which purely hardware based, per-device credentials do.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#129

Post by fhdkweig »

cpburns2009 wrote: post #94
izacus wrote: post #63

Earlier quoted context omitted.

You do the same as you do when you lose your SSH key. Restore from backup and move on with your life. Why is there so much misinformation nonsense around passkeys?

How do you use a restored passkey from backup? Aren't they locked to the device?

That's all I want to know. How do I restore from a backup? Specifically, a backup that I make to a medium I control, like a piece of paper or a burned CD-R in a safe deposit box. If I could get a good answer to that, I could be onboard. But from the conversations that I am getting here, it looks like only certain managers allow it, and with device attestation, they could be banned at any moment by any website with no recourse.
Post reply on HN