Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

201–210 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#201

Post by juancn »

gretch wrote: post #31
juancn wrote: post #26

Earlier quoted context omitted.

What if I lose all my apple devices? House break-in and they steal my mac and my phone? You're basically fucked even if you buy a new one because you need one of the other two to log in.

No technology in the world can protect you against every threat model and unlikely scenario. What if the robber hits you in the head and you get brain damage and forget your password?

A password has the best recovery process. Period. Write it down somewhere. It's up to me, no third party.

I had more trouble with a failed 2FA than with a password.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#203

Post by juancn »

izacus wrote: post #63
juancn wrote: post #21

Earlier quoted context omitted.

Same here, also what if I lose the device? I can safely write down a password on a piece of paper and keep it somewhere phyisically safe. Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.

You do the same as you do when you lose your SSH key. Restore from backup and move on with your life. Why is there so much misinformation nonsense around passkeys?

How? Where are they stored? Which password protects them? How do I back them up? How do you move them to another device? Can I print them out on paper as a last resort measure?

Nobody fucking knows.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#204

Post by tshaddox »

jasode wrote: post #108
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

>This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. The issue isn't what passkeys _are_ (e.g. explaining they are like public/private "ssh keys" and hoping that type of explanation ends the confusion). Instead, it's the workflow around passkeys. The websites show very confusing dialog popups and choices that a lot of normal people will not understand. This is…

You're agreeing precisely with the parent commenter that passkeys are, from a user's perspective, just passwords that require the use of a password manager. The difficulties many people have understanding or using passkeys are valid to point out and criticize, but they're precisely the same difficulties people have moving from the paradigm of "memorizing or writing down all my passwords" to "using a password manager."

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#205

Post by nitwit005 »

ranger207 wrote: post #82

The website for my HSA required me to set up a passkey last time I logged in. I set it up on my work laptop and my work password manager, which means I can now no longer access my account from my personal computer. This is fantastic, just what I wanted

And then you call them up, and they allow you in after asking some identity questions, and you learn there's no real security.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#206

Post by __MatrixMan__ »

dfabulich wrote: post #49
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

> Instead, the password managers each have their own finicky app-to-app mechanism for transferring passkeys from one password manager to another. (I think all the password managers kinda like that lock in.)

It's a nice simplifying step to talk about password managers here, but in the majority of the cases this won't be handled by a password manager, but rather by the device operating system, and the device manufacturers really like that lock in.

They're also in an especially good position to abuse it, because they now know every service that you authenticate and the webauthn "attestation object" field lets them set up a side channel with those services such that they can sell additional information about you.

Some people will tell you that the attestation object is not used in the consumer passkey system, so there's no way for this abuse to occur, but since it's usually going to be the device manufacturer who controls the password-manager-like component here, and they're the ones who stand to profit most from this kind of abuse, I think we need stronger guarantees than "the spec says you shouldn't do this unless the user is your employee and you paid for their device".

Until they fix this, I'm sticking with my mess of TOTP authenticators and yubikeys.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#207

Post by deltoidmaximus »

dwheeler wrote: post #174
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

Wait a sec. My understanding is that passkeys are public/private keypairs. Public is in server, so even breaking into a server does not reveal the private key. The big risk with passkeys is storing the passkey where it will be held hostage. Don't store it in most single-ecosystem devices like Apple. Bitwarden can export, and I think 1Password can as well.

That's where the attestation feature comes in. It allows them to force you into a hostage situations by restricting passkey implementation. There's a reason that was part of the spec from the get go but a passkey transfer system wasn't.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#208

Post by malfist »

no-name-here wrote: post #180
lelandbatey wrote: post #114

Earlier quoted context omitted.

> This makes it impossible to copy and paste your passkey to the wrong person (someone trying to trick you). It also, unfortunately, means it's not possible (via most passkey implementations) to back those passkeys up to paper. Which is quite unfortunate: backing up to paper is one of the most stable and human accessible ways of ensuring redundancy and continuity, an inevitable but also oft-ignored part of credential…

> back those passkeys up to paper Is writing down passwords something people do? I have countless passwords saved over >20 years and I don’t think I’ve ever recorded one to paper. I even checked a couple of popular password management solutions and they don’t seem to have “print” functionality.

The passphrase to my bitwarden database is in my will. And a bitlocker decryption key is right beside it.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#209

Post by c7b »

UX is not the problem with Passkeys. Passkeys were designed to align with the interests of BigTech, who are bent on stopping the abomination that is general computing devices in the hands of consumers and forcing them into their walled gardens. The language that is used for taking away freedoms is the same as always, safety. Where we ended up with Passkeys is an operating model that is suitable for corporate devices, i.e. the user can only do what the owners of the device allow them to. Suboptimal UX is downstream from that problem.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#210

Post by nozzlegear »

cpburns2009 wrote: post #94
izacus wrote: post #63

Earlier quoted context omitted.

You do the same as you do when you lose your SSH key. Restore from backup and move on with your life. Why is there so much misinformation nonsense around passkeys?

How do you use a restored passkey from backup? Aren't they locked to the device?

If you use Safari, they're locked to all of the devices on your iCloud account, not to a single device.
Post reply on HN