Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

151–160 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#151

Post by smelendez »

sandeepkd wrote: post #118
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

I am an engineer and have some insights on the discussions and developments around it. ITS NOT SIMPLE AT ALL 1. The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing). 2. Majority of industry players shared the vision of a credential which is available across the platforms and browsers 3. The vision for collaboration never materialize…

Yes, this is exactly the problem.

Multiple pieces of software vying to be your passkey provider, often using dark patterns so you don’t realize you’re making a choice, and not using the term “passkey” so people are using the technology without knowing what it is or how to research it.

Kind of reflects the state of the web today, where every company wants to be your intermediary in every interaction, from making a purchase to transcribing a meeting.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#152

Post by throw0101d »

giancarlostoro wrote: post #41
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

If you save it via Passwords app, it'll be iOS / macOS mainly, but you can unlock with any Apple device that supports Passkey / Passwords app (so likely modern + reasonably updated) the easiest. If you want it to work "everywhere" then you CAN use your iOS / MacOS Passkey, it will show you a QR code, some places poorly support this, I believe both devices need bluetooth, and then it will authenticate it. Linux is the…

Also note this from the spec:

> A Public Key Credential Source’s generating authenticator determines at creation time whether the public key credential source is allowed to be backed up. Backup eligibility is signaled in authenticator data’s flags along with the current backup state. Backup eligibility is a credential property and is permanent for a given public key credential source. A backup eligible public key credential source is referred to as a multi-device credential whereas one that is not backup eligible is referred to as a single-device credential. See also § 6.1.3 Credential Backup State.

* https://www.w3.org/TR/webauthn-3/#backup-eligible

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#153

Post by dfabulich »

pishpash wrote: post #139
dfabulich wrote: post #124

Earlier quoted context omitted.

I don't think you're giving those seniors good advice. When the banks ask people to "switch" to passkeys, they're not removing the passwords; they're adding passkeys as an alternate login mechanism. If you lose your bank passkey, (e.g. if you put it in the wrong password manager and you can't figure out where it is) you can just sign in with your bank password. In the worst case, banks actually don't make it very har…

Uh, if you set up a passkey it becomes the default almost always. Then on another device it'll pop up looking for it and look like login failure and you need to "try another way". That's alarming to anyone, not to mention seniors.

Sure, that's alarming, but if you set up a passkey on the "wrong" password manager, you've (temporarily) lost your passkey. You should probably be kinda alarmed about that.

You can click "try another way" and use your password, and then you'll have access to your bank. But then, you should try to resolve that problem. If you (or a trusted friend/family member) can figure out how to use settings to remove the passkey from your bank's account settings, you can do that, or you can ask a bank teller to help you, instead.

(And, luckily, you won't need a bank teller, because you'll still have access to your account.)

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#154

Post by MattTheRealOne »

pkulak wrote: post #112
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

I think the point is that Passkeys are not supposed to be as precious as passwords. You're supposed to have a brand new one for every device/application combination. So they are just login cookies at this point, and haven't even come close to replacing passwords because you need to know your password to get a new passkey every time you log in. Now, is that the official stance? I don't know; but it's _absolutely_ what…

There are a couple of problems I have with that. 1) Many websites limit the number of passkeys I can link to my account. Some only allow 2 or 3. I have more devices than that. 2) If I am supposed to create a new passkey for every device, how do I login in the first place? Most websites currently fallback to password login which defeats the security benefit of using passkeys in the first place.

I currently only use passkeys for a few websites that have awkward password login workflows or do not autofill properly from my password manager. I just have a single passkey for each that is synced via Bitwarden. Currently, I see passkeys as using an electronic biometric lock on the front door while passwords are still regular locks on the backdoor. The biometric lock on the front door does not do much for security when the backdoor still exists and I have come across very few websites that support only allowing passkeys. And those that do still run into problem 2 listed above.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#155

Post by Marsymars »

RHSeeger wrote: post #69
microflash wrote: post #29

Earlier quoted context omitted.

You can store your passkeys in Bitwarden or Keepass vault. Then you can use them through Bitwarden or Keepass apps on any other device. Been using passkeys like this for several years, and it works pretty seamlessly. With Keepass vault, I even have an offline copy as backup.

If you store the key in Bitwarden or Keepass, what makes it different from a password?

Main difference is that my banking website doesn't make me use SMS 2FA if I use a passkey to log in.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#156

Post by beaker52 »

Passkeys are a political play aimed at bolstering government support. They’re the privacy sabotaging arm of Digital ID. They go hand in hand with “age” verification. It’s all the same play. Get your identity, get your access credentials, give it to the prying eyes.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#157

Post by EPWN3D »

I don't know everything there is to know about passkeys or anything, but my reaction to most of these comments is "You're passing yourself off as someone who has relevant opinions about security, and you can't possibly imagine how these things work or how they're useful? Come the fuck on."

Passkeys are basically session cookies that are signed by a secure element in one of your devices at the time you log in. That's it. They cannot be phished because there is no password to steal. If I had to guess, the basic flow is something like this:

1. When the passkey is created, the device's secure element coughs up a public key or something to the server representing itself as a trusted device

2. When a user logs in, the server issues a challenge (basically a random number) to the device and says "sign this with a private key that corresponds to one of the trusted public keys I have"

3. The secure element signs the challenge and sends it back

4. The server goes through its list of trusted device public keys until it finds one that verifies the challenge response. If it finds one, it logs you in. If it doesn't, you don't log in

Step (1) is probably bootstrapped with a username/password and second factor like SMS 2FA, OTP, or email 2FA.

Even if this isn't exactly how they work, it's a plausible implementation. Nothing about this requires vendor lock-in. The various secure elements that can produce passkeys come from many different places, so I'm sure sufficiently motivated open source people could create a firmware TPM that is certified for use with passkeys or something if they cared enough.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#158

Post by xboxnolifes »

dfabulich wrote: post #49
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

So to login using a public PC, you need either USB access (and carry around your password manager) or you need to install the password manager on the PC to log into a website?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#159

Post by throw0101d »

kingstnap wrote: post #138
cpburns2009 wrote: post #17

Earlier quoted context omitted.

I can find my ssh keys in `~/.ssh`. No such place exists for passkeys.

Thats because the people behind passkeys are paternalistic and don't trust users. I had an argument with one of them a few months ago. https://github.com/keepassxreboot/keepassxc/issues/10407 https://news.ycombinator.com/item?id=47189749#47193048 My read on it all is that FIDO is stuck in some sort of groupthink. They don't feel the boots on the ground confusion around passkeys being opaque. They only care about phis…

> Thats because the people behind passkeys are paternalistic and don't trust users.

To be fair, trusting users with passwords/credentials is how we got into the mess of phishing et al in the first place.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#160

Post by jallmann »

pishpash wrote: post #147
sandeepkd wrote: post #118

Earlier quoted context omitted.

I am an engineer and have some insights on the discussions and developments around it. ITS NOT SIMPLE AT ALL 1. The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing). 2. Majority of industry players shared the vision of a credential which is available across the platforms and browsers 3. The vision for collaboration never materialize…

It should have never been a cloud password manager play. It should be hardware device only, and tied to the device. One passkey on each hardware device.

That leads to the cross-device usability issues from the original post. Even for an experienced engineer, it's a headache to manage multiple devices across multiple sites.

With the "cloud password manager" angle there is some hope of being user friendly, although we're certainly not there yet for most folks.

Post reply on HN