Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

131–140 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#131

Post by astrospective »

helix90 wrote: post #43
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

Listening to Yubikey and OnePassword talk about this, they actually say "One Person, One Device". Which really speaks to their failure to understand their users.

That is odd, I regularly use my Yubikey on multiple devices, that was the biggest draw.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#132

Post by ryandrake »

TeMPOraL wrote: post #80
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

> Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourself That's a red flag to me. It's enough that phone backup systems go out of their way to prevent you from accessing your own data, too, for unexplained "sekhurity" reasons. > P.S. It's past time to move off of LastPass. LastPass lost all of your passwords again last month, just like they did in 2022. The mo…

> That's the most annoying thing about password managers, and a major reason I still don't use them: there exists no password manager that is cross-platform (desktop/mobile in particular), local-first, and isn't sketchy or enshittified or otherwise on HN's current "don't use it, use instead" list.

I've used pwsafe for years now. I think it checks off all your boxes. Works on desktop and mobile. Local-first but allows cloud if you really want to. No ads or enshittification. Bonus: Open Source. Other Bonus: Not owned by BigTech or LittleTechThatValuesMonetizationOverSecurity

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#133

Post by justSAYnooo »

Consumer passkeys are just an extension of the OMB Policy Memorandum M-19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access Management (dated May 21, 2019). It is ultimately part of anti terrorism efforts with regard to banking and fraud. Think of this as consumer computer version of the scene in the movie The Baader Meinhof Complex when the cops are discussing a proposal for electronic data processing. "According to a poll by the Allensbach Institute, one in four Germans under 30 sympathizes with the RAF. That's nearly 7 million people. That amounts to an enormous pool of sympathizers, which makes the search for perpetrators extremely difficult." It signals the end of publicly available general computing. This was always inevitable, the mob cannot be trusted with weapons of mass destruction. Computers = Guns

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#134

Post by gretch »

deejaaymac wrote: post #44
gretch wrote: post #31

Earlier quoted context omitted.

No technology in the world can protect you against every threat model and unlikely scenario. What if the robber hits you in the head and you get brain damage and forget your password?

Master password to password vault stored on metal, buried in my backyard and I tell a family member where it is in case I ever get brain damage

Family member gossips "that crazy [deejaaymac] always burying secrets in the backyard..."

Or straight up betrays you (you slighted them at some family event)

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#135

Post by corndoge »

duskdozer wrote: post #102
corndoge wrote: post #36

Earlier quoted context omitted.

The fact that services can ban passkey providers is a major red flag in the protocol and the real issue that nobody talks about well, people are talking about it but it's not making a difference https://lucumr.pocoo.org/2025/9/2/passkeys/

This is why I am so concerned about passkeys. They could be a good improvement, but in practice I already see how it's going to result in Google/Apple/Microsoft/whoever seizing even more control. The document there is laughable too, because KeepassXC is listed as "not performing User Verification" when it demands manual authorization per request. But this isn't good enough for the passkey people. Ultimately, I see an…

Yeah they're really trying to solve problems that should be solved at a technical level with soft solutions in porcelain. See also this issue asking keepassxc to disable plaintext exports, which is completely technically feasible

https://github.com/keepassxreboot/keepassxc/issues/10407

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#136

Post by cpburns2009 »

datakan wrote: post #85
cpburns2009 wrote: post #17

Earlier quoted context omitted.

I can find my ssh keys in `~/.ssh`. No such place exists for passkeys.

I can pull up all my passkeys in 1Password or Bitwarden without issue.

I thought your "with issue" typo was quite pertinent to the whole discussion lol

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#137

Post by saratogacx »

TeMPOraL wrote: post #80
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

> Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourself That's a red flag to me. It's enough that phone backup systems go out of their way to prevent you from accessing your own data, too, for unexplained "sekhurity" reasons. > P.S. It's past time to move off of LastPass. LastPass lost all of your passwords again last month, just like they did in 2022. The mo…

> That's the most annoying thing about password managers, and a major reason I still don't use them: there exists no password manager that is cross-platform (desktop/mobile in particular), local-first, and isn't sketchy or enshittified or otherwise on HN's current "don't use it, use instead" list.

I had the same frustration, I ended up with Keepass, the store is a open spec db[0] that has several clients, I use it across windows, android, and Linux without any issue and just sync with your favorite file sync tool.

0 - https://keepass.info/help/kb/kdbx.html

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#138

Post by kingstnap »

cpburns2009 wrote: post #17
datakan wrote: post #6

Passkeys are just SSH keys in how they work. We've been doing this since the 90's. The only people that use SSH keys are the Linux savvy users and those who are forced to via an enterprise solution for vaulting. The average person doesn't know anything about this stuff nor do they care. I also have yet to see a Passkey solution that didn't also have a password on it and a nice little box letting people choose to use…

I can find my ssh keys in `~/.ssh`. No such place exists for passkeys.

Thats because the people behind passkeys are paternalistic and don't trust users. I had an argument with one of them a few months ago.

https://github.com/keepassxreboot/keepassxc/issues/10407

https://news.ycombinator.com/item?id=47189749#47193048

My read on it all is that FIDO is stuck in some sort of groupthink. They don't feel the boots on the ground confusion around passkeys being opaque. They only care about phishing and being called "insecure" and don't care about anything else. Hence why WebAuthn has additional weird anti features like AAGUID for provider authentication.

Another one of those ridiculous threads is saying you gotta have support for nonsense like user presence verification.

https://github.com/keepassxreboot/keepassxc/issues/10406

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#139

Post by pishpash »

dfabulich wrote: post #124
jasode wrote: post #108

Earlier quoted context omitted.

>This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. The issue isn't what passkeys _are_ (e.g. explaining they are like public/private "ssh keys" and hoping that type of explanation ends the confusion). Instead, it's the workflow around passkeys. The websites show very confusing dialog popups and choices that a lot of normal people will not understand. This is…

I don't think you're giving those seniors good advice. When the banks ask people to "switch" to passkeys, they're not removing the passwords; they're adding passkeys as an alternate login mechanism. If you lose your bank passkey, (e.g. if you put it in the wrong password manager and you can't figure out where it is) you can just sign in with your bank password. In the worst case, banks actually don't make it very har…

Uh, if you set up a passkey it becomes the default almost always. Then on another device it'll pop up looking for it and look like login failure and you need to "try another way". That's alarming to anyone, not to mention seniors.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#140

Post by rib3ye »

reddalo wrote: post #60
programmertote wrote: post #19

Like some folks already commented here, even as someone who has been working in tech for 20+ years, I find Passkey confusing. I understand the key aspect in computer science term, but I don't know how to use it across devices. Another big worry is that if I tie that to a physical key, then I might lose it (because it's physical) and never get it back.

Exactly, I always refuse to add a passkey because I'm afraid I won't be able to easily login again. Also, I don't want to be locked in to a vendor.

You can use a passkey that's tied to a Yubikey.
Post reply on HN