Passkeys were invented by engineers with zero understanding of consumer brain • Hacker News Board

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#161

Post by floathub » Wed, Jul 22, 2026, 4:37 PM UTC

TeMPOraL wrote: post #80

dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

> Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourself That's a red flag to me. It's enough that phone backup systems go out of their way to prevent you from accessing your own data, too, for unexplained "sekhurity" reasons. > P.S. It's past time to move off of LastPass. LastPass lost all of your passwords again last month, just like they did in 2022. The mo…

Depends on what qualifies as a password "manager", but I've been using pass (https://www.passwordstore.org/) for years on multiple desktops, and have recently added iOS app sepass to my setup (https://sepass.modiot.com/).

Quite complicated to get it all setup (definitely not for non-technical users), but both are GPL and I now have all my passwords available with hardware protection (yubikey on desktop, secure enclave on iOS) in all locations.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#162

Post by xboxnolifes » Wed, Jul 22, 2026, 4:38 PM UTC

exabrial wrote: post #10

With physical U2F key, I could explain to my 78 year-old-parents "this is a physical key needed to access your account. Think of it like the front door key to your house. Don't lose it or lend it to anyone. We should have a couple of backup keys too." And they got completely understood and added it to all of their accounts. This was not hard. People assumed consumers were too stupid to do this without even giving the…

Sure, but i would never want a physical key to something important. Physical keys get lost, so the front door spare is under the flower pot.

And now I have another thing I need to carry everywhere.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#163

Post by gchamonlive » Wed, Jul 22, 2026, 4:40 PM UTC

I really don't get passkeys and how they are supposed to be safer.

Currently I save all login tuples to Bitwarden and store OTP secrets onto Aegis. Could have been 1password and authy, it's irrelevant. The thing is, I only get pwned if both are compromised.

Now with ubiquitous passkeys in Bitwarden if someone has access to my vault unencrypted it's already endgame.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#164

Post by legitster » Wed, Jul 22, 2026, 4:47 PM UTC

I think about this a lot when using our corporate SSO tool.

When I hit the button to log into Slack, there are like, 3 popups in succession - the last one ultimately asking for my fingerprint. Then when I give it, there is a flurry of web pages that get loaded and redirects that happen until finally Slack pops up again.

There isn't any realistic world in which I check each window to make sure everything is happening right and I am not being MitM'd.

I'm a fairly technical person, and I would be unable to perceive the difference between a really tight security environment and my computer being hijacked.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#165

Post by tetromino_ » Wed, Jul 22, 2026, 4:48 PM UTC

dfabulich wrote: post #153

pishpash wrote: post #139

Earlier quoted context omitted.

Uh, if you set up a passkey it becomes the default almost always. Then on another device it'll pop up looking for it and look like login failure and you need to "try another way". That's alarming to anyone, not to mention seniors.

Sure, that's alarming, but if you set up a passkey on the "wrong" password manager, you've (temporarily) lost your passkey. You should probably be kinda alarmed about that. You can click "try another way" and use your password, and then you'll have access to your bank. But then, you should try to resolve that problem. If you (or a trusted friend/family member) can figure out how to use settings to remove the passkey…

> you can ask a bank teller to help you

At virtually all banks, the bank tellers cannot help you with login problems. You will have to call the bank's tech support and somehow navigate AI-modulated phone menu hell.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#166

Post by hoppp » Wed, Jul 22, 2026, 4:49 PM UTC

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

You can add as many passkeys as you want and you can still have password logins too.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#167

Post by ghostly_s » Wed, Jul 22, 2026, 4:49 PM UTC

We've all been through at least a couple rounds now of the security industry pressing us to change how we log in, ostensibly in our best interest: impractical complexity requirements, 2FA, "magic links," ridiculously short session expiry, whatever this bullshit is with the username and password on separate pages that make your password manager less convenient.

The only observable outcome of each of these changes has been making these products less convenient for us to use. At this point I don't think I am alone in being knee-jerk opposed to any further "improvements." I have yet to see a website make a case for a passkey being more convenient than what it is replacing, so I will continue opting out of them as long as I am allowed to.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#168

Post by giancarlostoro » Wed, Jul 22, 2026, 4:50 PM UTC

throwawayffffas wrote: post #64

reddalo wrote: post #47

Earlier quoted context omitted.

> Linux is the only oddball here, I had issues getting this flow to work. Take a guess why. Passkeys are just a trick for vendor lock-in disguised as a security practice.

Unpopular opinion but correct the whole thing has been designed to lock you to devices they make and have themselves be the arbiter of your authentication. If that wasn't the intent they could have make the thing work like ssh keys, encrypted at rest, you can take them wherever you want.

It is not Apple's job to implement Passkey into Linux, that is up to the Linux community to build up and figure out, and then for Firefox to implement it on Linux. On the other hand, Chrome just works with it, so maybe Firefox either implements it for Linux in-house, or figures out an existing initiative they could invest resources towards and help to prop up so they can integrate against it on Linux.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#169

Post by mdavidn » Wed, Jul 22, 2026, 4:50 PM UTC

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

I can't speak to all of your browser combinations, but most desktop browsers can present a QR code when logging in with a passkey. I keep my passkeys in a password manager synced between my phone and personal computers. On my work computer, where the password manager is not installed, I can still use passkeys by scanning the QR code with my iPhone's camera app.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#170

Post by Aerroon » Wed, Jul 22, 2026, 4:51 PM UTC

BadBadJellyBean wrote: post #95

RHSeeger wrote: post #69

Earlier quoted context omitted.

If you store the key in Bitwarden or Keepass, what makes it different from a password?

They are bigger. Not as easy to guess. More like pretty impossible. It's like not letting the user choose the password. That way they can't have a bad password.

But these same services are the reason why my passwords are as short as they are. They made me use 'short passwords' by putting upper limits on them.