Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

181–190 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#181

Post by PaulDavisThe1st »

giancarlostoro wrote: post #51
reddalo wrote: post #47

Earlier quoted context omitted.

> Linux is the only oddball here, I had issues getting this flow to work. Take a guess why. Passkeys are just a trick for vendor lock-in disguised as a security practice.

Firefox just didn't support it cleanly, I think Chrome did, I don't remember. Apparently it's just due to Linux not having a native passkey implementation. Dang. Edit: Apparently BitWarden should work, but my particular passkey was not on there.

> Apparently it's just due to Linux not having a native passkey implementation.

Excuse me? The infrastructure for "an apps is trying to login with a private/public key pair, and right now it needs the private key to encrypt some part of the transaction" has existed on Linux since it began.

The problem, as best as I can understand it, is that some/all browsers are not treating passkeys as an extension of the key system that began with ssh(1), even though technically speaking, they are.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#182

Post by shinryuu »

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

(small parenthesis, please consider to _not_ use lastpass given they have had so many security incidents https://en.wikipedia.org/wiki/LastPass#Security_incidents )

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#183

Post by vinay_ys »

varispeed wrote: post #22

I find it difficult to explain how to use password manager to non-IT person. Whatever I say, they say it is not secure. No amount of explanation will change their mind. They prefer to keep their passwords in their physical note book hidden in the safe (yes, they open the safe etc each time they need to log in somewhere when they get logged out). As someone with ADHD a passkey is something I can lose easily and I don'…

They should buy a Yubikey (a physical key) and keep their passkeys resident on that. Then they can truly keep that physical key locked up in their safe. And it is truly safer than their physical notebook because they are safe from being tricked into entering their password in the wrong place.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#184

Post by epistasis »

I think the problem was that there wasn't a "Best Practices" way of using them when they were launched, which really prevented describing them in a consumer-friendly way.

And web site implementors couldn't follow that golden path, or describe the golden path, so there's fragmentation in usage and meanings and practices, making it far more confusing.

I love passkeys, I want to eliminate any and all password-based logins and switch entirely to passkeys. It's such a better experience, it's a "physical" key that can be backed up to multiple devices, and thinking of it like a key for a physical lock really gets at the core of its capabilities. But locks can be used in many many ways! Maybe you need to open the lock and still tell the guard a password, which is weird, but how most websites still operate.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#185

Post by christina97 »

It’s quite the opposite. Passkeys are phenomenal for a lot of consumers. Based on this thread, it’s the engineers who understand authentication in the first place and have their own system (eg password manager) that are confused.

Consider a user in the Apple ecosystem: you are already conditioned to just do Touch ID or Face ID when asked. I was on Amazon the other day, it prompted randomly for “want to set up a passkey to sign in easier”? I set it up and now I can easily sign in to Amazon on my mac or iphone with zero friction.

For the normal consumer this is not a replacement for “dig out my password manager and copy-paste/autofill my password”, it’s a replacement for “oh it’s prompting for my password again” -> proceed to type your shared password for all sites.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#186

Post by threecheese »

dfabulich wrote: post #93
TeMPOraL wrote: post #80

Earlier quoted context omitted.

> Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourself That's a red flag to me. It's enough that phone backup systems go out of their way to prevent you from accessing your own data, too, for unexplained "sekhurity" reasons. > P.S. It's past time to move off of LastPass. LastPass lost all of your passwords again last month, just like they did in 2022. The mo…

Apple, Google, Microsoft, Mozilla, and 1Password don’t let you export passkeys to a file that you can read and backup, but Bitwarden, Proton Pass, and KeepassXC do. I think Bitwarden is on HN's current happy list. (I just use Apple iCloud myself.) Allowing passkeys to be exported to a plaintext file undermines the phishing protections, at least somewhat. It’s possible to trick you into exporting your passkeys from Bi…

I’ve relied on iCloud as well, but just learned that it allows apps to store persistent data. This data is synced between all devices, and there’s no way for you to view or manage/delete it. Even determining which apps do this requires you to enumerate the apps entitlements, which is nontrivial. And so an app you install on your iPhone can have configuration or credentials persist to each iCloud-connected device, and you have no control over it. This is certainly convenient, if that’s the behavior you want; if not, there’s no visibility or control.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#187

Post by Reddit_MLP2 »

jasode wrote: post #108
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

>This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. The issue isn't what passkeys _are_ (e.g. explaining they are like public/private "ssh keys" and hoping that type of explanation ends the confusion). Instead, it's the workflow around passkeys. The websites show very confusing dialog popups and choices that a lot of normal people will not understand. This is…

sadly it seems like most of the banks I use still enforce antiquated password rules, no MFA and rely on stupid questions most of which can easily be guessed from public records.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#188

Post by otabdeveloper4 »

sandeepkd wrote: post #118
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

I am an engineer and have some insights on the discussions and developments around it. ITS NOT SIMPLE AT ALL 1. The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing). 2. Majority of industry players shared the vision of a credential which is available across the platforms and browsers 3. The vision for collaboration never materialize…

WebAuthn is the standard for token authentication.

(I.e., Yubikeys and other USB sticks.)

It works fine and it a no-brainer to use.

The problems start when vendors start trying to shoehorn their shitty cloud auth services into WebAuthn.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#189

Post by TechRemarker »

Yes, a bit of a mess. As the only practical way for most to use is with a password manager. So essentially, all your accounts still have a real password, just you enter that into your password manager app. So if your device is every compromised and someone has your master password then you are screwed.

And of course, passkeys on most all sites don't really improve security since someone can just choose to login with user/pass instead since presumably very few sites allow you to have just passkey.

Also if you use a password manager you may get locked into using that platform. Or ideally using a third party one but then having to pay a subscription, or using an open source option that is not ideal for the average person.

If one uses a passkey as intended and without a password manager and the site truly only supports logging in via your passkey, for all the touted benefits of passkeys, that would be a nightmare if a person loses access to their device, etc.

Post reply on HN