Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

171–180 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#171

Post by SpaceManNabs »

cpburns2009 wrote: post #123
rsyring wrote: post #37

FWIW: I find passkeys to be a very simple and easy to use concept. Simple: it's like a password that I don't have to type in Easy to use: because I use 1Password and just have it installed on everything. On Android, it can be set as the default passkey provider so, even on mobile, I am using passkeys shared across devices. Is this "less secure" because I'm sharing the keys through 1Password. I suppose, at some level.…

This is a big problem I have with "just works". Everyone is used to services only allowing a single password. I know the answer to this, but it's not clear in the marketing or how it's explained to normie end-users: Won't creating a passkey erase my password? How do you sign in on another device? Won't that change the passkey and lock me out from the first device?

it just a lot of complexity and i don't want to deal with it but i have to because of all these dark patterns. sometimes i enable pass key and don't even notice.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#174

Post by dwheeler »

dfabulich wrote: post #49
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

Wait a sec. My understanding is that passkeys are public/private keypairs. Public is in server, so even breaking into a server does not reveal the private key.

The big risk with passkeys is storing the passkey where it will be held hostage. Don't store it in most single-ecosystem devices like Apple. Bitwarden can export, and I think 1Password can as well.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#175

Post by Aerroon »

thewebguyd wrote: post #128
rufo wrote: post #104

Earlier quoted context omitted.

I recognize the point of your post is more about the lack of clarity and details around passkeys. That's real, and I don't really have an answer for that - other than, I think maybe the quest for making them simple and "just work" has maybe made them nebulous enough that we've wound up in the current situation where a lot of even technically savvy people don't really understand them. But I feel like answering your qu…

> passkeys are intended to sync via your password manager of choice as the primary use case. The sync was actually a compromise to the standard. The idea was unique, device-bound credentials. One person, one device. The private key/passkey on your phone should not be the same one on your laptop, or your tablet, etc. Each device was supposed to have it' own unique credential. Allowing sync is a security downgrade to t…

I don't get it. How does every device combo having a unique key pair help with security? They can all log in, right? So all you need is to compromise their session and you're in, whether they share the same passkey or not.

And if you're compromised in such a way that an attacker could steal your password then wouldn't they be able to just hijack your session instead?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#176

Post by MBCook »

I will never understand how a small group of tech savvy people are heavily confused and against a simple and more secure system.

You want anecdotes? Ok. I’ve had elderly adult relatives who aren’t good with their devices tell me unprompted they’re using them and like them when I mentioned the word out loud to myself using my phone around them.

These are people who don’t know the difference between apps and the web. Who have 200 tabs open because they don’t know what tabs are so a new one just gets opened automatically all the time. Can’t tell some websites apart. Who change their passwords on every login to some sites because they can’t get sign in right.

Yeah if you want to write them down or refuse to save passwords outside text files or demand they live on a security key on your keychain you’ll have a hard time. You’re being 0.0000001% of the user population. You’re not representative.

They are a MASSIVE UX win. A MASSIVE security win.

I’ve logged into my work computer with a passkey on my personal phone, no issue. It’s fine. They’re backed up locally. It’s fine.

The biggest problem, which is getting better and somewhat a transition problem, is sites using terrible UX to trigger the workflow. Those that follow the suggestions or close to it are great.

I love passkeys. I just don’t get the confusion.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#177

Post by avh02 »

rib3ye wrote: post #140
reddalo wrote: post #60

Earlier quoted context omitted.

Exactly, I always refuse to add a passkey because I'm afraid I won't be able to easily login again. Also, I don't want to be locked in to a vendor.

You can use a passkey that's tied to a Yubikey.

The problem here is i want to have more than 1 yubikey, so if i lose it, all is not lost... I can't do that with the current implementations unless i present N yubikeys to every new account i make. Which makes an off-site backup yubikey impossible. With my current yubikey usage with password store, my "offline" yubikey can be brought in whenever i want to decrypt the passwords, including ones inserted while the key was in storage.

Also yubikeys have limited passkey slots (100, 25 with old firmware)

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#178

Post by throwawayffffas »

giancarlostoro wrote: post #168
throwawayffffas wrote: post #64

Earlier quoted context omitted.

Unpopular opinion but correct the whole thing has been designed to lock you to devices they make and have themselves be the arbiter of your authentication. If that wasn't the intent they could have make the thing work like ssh keys, encrypted at rest, you can take them wherever you want.

It is not Apple's job to implement Passkey into Linux, that is up to the Linux community to build up and figure out, and then for Firefox to implement it on Linux. On the other hand, Chrome just works with it, so maybe Firefox either implements it for Linux in-house, or figures out an existing initiative they could invest resources towards and help to prop up so they can integrate against it on Linux.

My issue is not the lack of Linux support, my issue is the dependence on hardware components, that are distributed by a small group of incumbents, that is pretty much baked into the spec.

What they want is to lock your identity to your android and/or iphone devices.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#179

Post by modeless »

I find Google Password Manager makes passkeys pretty easy to use. As long as you don't accidentally create a passkey some other way. Hopefully websites will adapt to the reality of how people use passkeys in practice and some of the UX weirdness around them will disappear over time.

One annoying thing though is that while they recently added password sharing, they don't allow sharing passkeys. Basic passkey sharing would be nice, but it also seems possible to implement fancy sharing features that wouldn't be possible with password sharing. Things like sharing one time use passkeys or time limited passkeys or limited access passkeys or secure revocation of shared passkeys. I hope people are thinking about this.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#180

Post by no-name-here »

lelandbatey wrote: post #114
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

> This makes it impossible to copy and paste your passkey to the wrong person (someone trying to trick you). It also, unfortunately, means it's not possible (via most passkey implementations) to back those passkeys up to paper. Which is quite unfortunate: backing up to paper is one of the most stable and human accessible ways of ensuring redundancy and continuity, an inevitable but also oft-ignored part of credential…

> back those passkeys up to paper

Is writing down passwords something people do? I have countless passwords saved over >20 years and I don’t think I’ve ever recorded one to paper. I even checked a couple of popular password management solutions and they don’t seem to have “print” functionality.

Post reply on HN