Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

191–200 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#191

Post by jotaen »

usernametaken29 wrote: post #66

I don’t understand this point at all. I think the author has himself confused with the average consumer. For the first time in a decade or so you can buy a PHYSICAL key and use it to sign into websites. I can explain this to any grandma out there. Likewise, I’m an Apple user. Once you’re in Apple universe passkeys are extremely easy. Tap your thumb on the scanner, done. Now we can put on the tinfoil hat and say how t…

> For the first time in a decade or so you can buy a PHYSICAL key and use it to sign into websites. I can explain this to any grandma out there.

What would you answer if grandma asked you what happens if she loses her physical key?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#193

Post by doctoboggan »

vel0city wrote: post #96
Tarq0n wrote: post #67

Earlier quoted context omitted.

OK now say you're on a work/library/friend's computer and you want to look up an account in 1password on your phone so you can type in the password. Passkeys don't support this very basic and common workflow. Meanwhile there's no real security benefit over password manager generated complex and not reused passwords.

If I'm on someone else's computer and I want to use a passkey on my phone, the computer will display a QR code. I scan the QR code with my phone, the phone signs the login request and posts it to the service's callback. Then I'm logged in on that new device. If my phone's camera is broken but both devices have bluetooth, it can do the handshake over bluetooth. If I'm on someone else's computer and I want to use a pas…

Does the apple passwords app work this way (log in to a public machine by scanning a QR code?)

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#194

Post by cwillu »

no-name-here wrote: post #180
lelandbatey wrote: post #114

Earlier quoted context omitted.

> This makes it impossible to copy and paste your passkey to the wrong person (someone trying to trick you). It also, unfortunately, means it's not possible (via most passkey implementations) to back those passkeys up to paper. Which is quite unfortunate: backing up to paper is one of the most stable and human accessible ways of ensuring redundancy and continuity, an inevitable but also oft-ignored part of credential…

> back those passkeys up to paper Is writing down passwords something people do? I have countless passwords saved over >20 years and I don’t think I’ve ever recorded one to paper. I even checked a couple of popular password management solutions and they don’t seem to have “print” functionality.

It is absolutely a thing people do. Google even offers a convenient printout as a way to provide account recovery.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#195

Post by pjsg »

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

For me, it is "how many passkeys can I have for the same site?", and "how do I revoke them?"

Worse, I'm still using LastPass -- but migrating over to Chrome password storage as it syncs between phone and laptop. LastPass doesn't give you the option to not use it for passkeys. It might be the thing that causes me to finish the migration away from it.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#196

Post by dfabulich »

tetromino_ wrote: post #165
dfabulich wrote: post #153

Earlier quoted context omitted.

Sure, that's alarming, but if you set up a passkey on the "wrong" password manager, you've (temporarily) lost your passkey. You should probably be kinda alarmed about that. You can click "try another way" and use your password, and then you'll have access to your bank. But then, you should try to resolve that problem. If you (or a trusted friend/family member) can figure out how to use settings to remove the passkey…

> you can ask a bank teller to help you At virtually all banks, the bank tellers cannot help you with login problems. You will have to call the bank's tech support and somehow navigate AI-modulated phone menu hell.

Citation needed. Walk in with photo ID, a bank card, and your PIN, and all the major banks will send you a reset-password email.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#197

Post by syntheticnature »

no-name-here wrote: post #180
lelandbatey wrote: post #114

Earlier quoted context omitted.

> This makes it impossible to copy and paste your passkey to the wrong person (someone trying to trick you). It also, unfortunately, means it's not possible (via most passkey implementations) to back those passkeys up to paper. Which is quite unfortunate: backing up to paper is one of the most stable and human accessible ways of ensuring redundancy and continuity, an inevitable but also oft-ignored part of credential…

> back those passkeys up to paper Is writing down passwords something people do? I have countless passwords saved over >20 years and I don’t think I’ve ever recorded one to paper. I even checked a couple of popular password management solutions and they don’t seem to have “print” functionality.

Yes, this is extremely common, both as a continuity means and/or as a localized password manager. Know someone who uses a Rolodex for hers, which is funny and yet it works.

Doesn't work well in office environments, but at home the local threat model is largely fine with this.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#198

Post by lrvick »

At Caution we -exclusively- allow passkeys. The entire database is user ids and public keys. If it leaks, it would only be mildly annoying.

If you are confused about digital passkeys, you can use a physical yubikey or nitrokey and tap it when it blinks. You can treat them like a credit card or house keys.

Asking people to keep up with and remember passwords is and always has been the thing that was invented with zero understanding of the consumer brain.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#199

Post by malfist »

dfabulich wrote: post #49
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

This is not much simpler than they think it is.

> But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices

That's just wrong. I use android, my partner uses ios. If he creates the passkey in safari, it's not going to get synced over to my phone. And that's just the first of the family sharing passwords issues. Same person issue is also present if somebody uses an iphone and a windows laptop, or chromebook.

It doesn't help that all modern browsers eagerly try to step in and offer their implementation of passkeys for logins, and they're not featured enough to support the type of shared access or synced access many people would expect from a password manager. How useful is your firefox passwords on an iphone? Or Mac OS's keychain I use as a daily driver on my windows gaming desktop?

> Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourself

This is wrong. Every single major password manager supports export. Lastpass, 1password and bitwarden all do that.

> It's past time to move off of LastPass. LastPass lost all of your passwords again last month

That just isn't true. Last month, their third party customer support portal was breached. That did not involve passwords.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#200

Post by Someone1234 »

pishpash wrote: post #147
sandeepkd wrote: post #118

Earlier quoted context omitted.

I am an engineer and have some insights on the discussions and developments around it. ITS NOT SIMPLE AT ALL 1. The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing). 2. Majority of industry players shared the vision of a credential which is available across the platforms and browsers 3. The vision for collaboration never materialize…

It should have never been a cloud password manager play. It should be hardware device only, and tied to the device. One passkey on each hardware device.

Then most of us would never use it. That means either:

- Only one specific device can ever login (bad).

- It doesn't limit login to one specific device, therefore it does nothing.

Linking Passkeys to a physical device was always DoA. At least not without a way to enroll every device you own, and strong recovery strategies. But considering how inconsistent every company's Passkey implementation is (inc. many that only allow ONE TOTAL!), it is DoA.

Post reply on HN