Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

221–230 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#221

Post by selicos »

dfabulich wrote: post #153
pishpash wrote: post #139

Earlier quoted context omitted.

Uh, if you set up a passkey it becomes the default almost always. Then on another device it'll pop up looking for it and look like login failure and you need to "try another way". That's alarming to anyone, not to mention seniors.

Sure, that's alarming, but if you set up a passkey on the "wrong" password manager, you've (temporarily) lost your passkey. You should probably be kinda alarmed about that. You can click "try another way" and use your password, and then you'll have access to your bank. But then, you should try to resolve that problem. If you (or a trusted friend/family member) can figure out how to use settings to remove the passkey…

Even my primary Credit Union is limiting teller roles in branches. There are still people to help, but then you have to go in person. My nearest branch is a day trip away but I can do most banking tasks at any partner CU location.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#222

Post by nozzlegear »

fhdkweig wrote: post #129
cpburns2009 wrote: post #94

Earlier quoted context omitted.

How do you use a restored passkey from backup? Aren't they locked to the device?

That's all I want to know. How do I restore from a backup? Specifically, a backup that I make to a medium I control, like a piece of paper or a burned CD-R in a safe deposit box. If I could get a good answer to that, I could be onboard. But from the conversations that I am getting here, it looks like only certain managers allow it, and with device attestation, they could be banned at any moment by any website with no…

> * and with device attestation, they could be banned at any moment by any website with no recourse.*

Isn't this true of any authentication method? It doesn't seem unique to Passkeys.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#223

Post by alwa »

threecheese wrote: post #186
dfabulich wrote: post #93

Earlier quoted context omitted.

Apple, Google, Microsoft, Mozilla, and 1Password don’t let you export passkeys to a file that you can read and backup, but Bitwarden, Proton Pass, and KeepassXC do. I think Bitwarden is on HN's current happy list. (I just use Apple iCloud myself.) Allowing passkeys to be exported to a plaintext file undermines the phishing protections, at least somewhat. It’s possible to trick you into exporting your passkeys from Bi…

I’ve relied on iCloud as well, but just learned that it allows apps to store persistent data. This data is synced between all devices, and there’s no way for you to view or manage/delete it. Even determining which apps do this requires you to enumerate the apps entitlements, which is nontrivial. And so an app you install on your iPhone can have configuration or credentials persist to each iCloud-connected device, and…

Is this different from the per-app enumeration in Account —> iCloud —> Storage? That provides a means to delete per app

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#224

Post by readread »

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

I’ve just been operating under the assumption passkeys are gonna lock me out unrecoverably in some way at some point, and have been avoiding them for anything important while allowing them for low-value accounts so they’ll stop nagging me.

I hate that I can’t just put a value in a plain text file somewhere (encrypted, let’s say, to preempt the inevitable and low-value response) and rely on that to work when I need it on any device and interface that can accept keyboard input.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#225

Post by Ajedi32 »

malfist wrote: post #199
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

This is not much simpler than they think it is. > But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices That's just wrong. I use android, my partner uses ios. If he creates the passkey in safari, it's not going to get synced over to my phone. And that's just the first of the family sharing passwords issues. Same person i…

> That's just wrong. I use android, my partner uses ios. If he creates the passkey in safari, it's not going to get synced over to my phone

It would, if the people implementing it weren't all so obsessed with pushing their own platform-specific solutions over enabling open standards. LastPass works fine on Android, iOS, Mac, and Windows, but each one of those platforms defaults to saving passkeys in their own platform-specific store unless you jump through hoops to specifically save them somewhere else.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#226

Post by AlexandrB »

mhurron wrote: post #54
summermusic wrote: post #35

Earlier quoted context omitted.

> ...it entirely depends on the service what kind of auth implementation they offer. I think that's exactly the problem. These are all answerable questions, but getting those answers is confusing for most people.

> These are all answerable questions, but getting those answers is confusing for most people. It's the same answer when someone asks 'how am I supposed to have a different password for every site' and 'how am I supposed to remember a password of X+ characters.' Use a password manager. Pretty sure every major one supports passkeys by now.

Password managers for passkeys have a huge problem when dealing with any kind of remote support or working on someone else's hardware - you can't just copy/paste or type in the passkey so you're forced to install the password manager on a family member's/stranger's/employer's PC or do what? I'm not even sure. At least SSH keys have forwarding when you ssh to a remote machine, how do you "forward" a passkey?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#227

Post by AndroTux »

rsyring wrote: post #37

FWIW: I find passkeys to be a very simple and easy to use concept. Simple: it's like a password that I don't have to type in Easy to use: because I use 1Password and just have it installed on everything. On Android, it can be set as the default passkey provider so, even on mobile, I am using passkeys shared across devices. Is this "less secure" because I'm sharing the keys through 1Password. I suppose, at some level.…

This. Honestly, most of the arguments I read against passkeys just sound like “old man yells at cloud.”

It’s not that difficult. Spend 10 minutes researching the topic and you’re fine. Passkeys are so much more convenient than having to use passwords. When implemented right, it’s literally one click from opening the login page to being signed in. On all of my devices.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#228

Post by kingstnap »

throw0101d wrote: post #159
kingstnap wrote: post #138

Earlier quoted context omitted.

Thats because the people behind passkeys are paternalistic and don't trust users. I had an argument with one of them a few months ago. https://github.com/keepassxreboot/keepassxc/issues/10407 https://news.ycombinator.com/item?id=47189749#47193048 My read on it all is that FIDO is stuck in some sort of groupthink. They don't feel the boots on the ground confusion around passkeys being opaque. They only care about phis…

> Thats because the people behind passkeys are paternalistic and don't trust users. To be fair, trusting users with passwords/credentials is how we got into the mess of phishing et al in the first place.

The phishing resistance on fake websites is largely a function of the fact its an ssh key and you can't man in the middle those after first setup because you have known_hosts, which in the case of passkeys gets replaced with the website certificate technology.

The baking in "which authenticator is storing this passkey" and "require user to provide biometrics/pin to verify presence for this passkey" and "don't make it easy or possible to export passkeys" behaviour is more just control.

I guess it sort of helps if the threat model is complete remote code execution inside the victims brain because you got them to export their keys to you, but it seems more useful for websites and governments whitelisting what hardware and software they deem acceptable.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#229

Post by selicos »

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

It makes sense for a work device that is off network/domain, but then it is your primary/only means of interfacing with services. Then you can consolidate under a Windows Hello passkey or something else.

The second you have a second device to log in from they are useless. The second you want or need to share a credential (smart or not) they are more work than a password.

The passkey trend seems lead by platforms that want to make it easier to get or stay logged in, Netflix type companies that want to prevent account sharing, and those that value convenience (if one device) over security.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#230

Post by tekla »

no-name-here wrote: post #180
lelandbatey wrote: post #114

Earlier quoted context omitted.

> This makes it impossible to copy and paste your passkey to the wrong person (someone trying to trick you). It also, unfortunately, means it's not possible (via most passkey implementations) to back those passkeys up to paper. Which is quite unfortunate: backing up to paper is one of the most stable and human accessible ways of ensuring redundancy and continuity, an inevitable but also oft-ignored part of credential…

> back those passkeys up to paper Is writing down passwords something people do? I have countless passwords saved over >20 years and I don’t think I’ve ever recorded one to paper. I even checked a couple of popular password management solutions and they don’t seem to have “print” functionality.

It is what the vast majority of people do.
Post reply on HN