Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

251–260 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#251

Post by izacus »

malfist wrote: post #199
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

This is not much simpler than they think it is. > But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices That's just wrong. I use android, my partner uses ios. If he creates the passkey in safari, it's not going to get synced over to my phone. And that's just the first of the family sharing passwords issues. Same person i…

> That's just wrong. I use android, my partner uses ios. If he creates the passkey in safari, it's not going to get synced over to my phone. And that's just the first of the family sharing passwords issues. Same person issue is also present if somebody uses an iphone and a windows laptop, or chromebook.

The passkeys sync just fine between iOS and Android on our devices using 1Password.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#252

Post by NetMageSCW »

msandford wrote: post #39
varispeed wrote: post #24

Earlier quoted context omitted.

Sounds like something security services would love people to use. Instead of using wrench to extract the password - and distressed person may lose memory, they can just locate the passkey.

Nobody is safe from a nation-state "attack" they'll just go threaten your providers to give up your data. Passwords written on paper are probably safer than a centralized password manager for almost every circumstance other than a government coming after you.

I’d like to see them threaten Apple or Bank of America.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#253

Post by AlexandrB »

izacus wrote: post #59
juancn wrote: post #28

Earlier quoted context omitted.

I would feel a lot better using SSH keys rather than passkeys. At least those are understandable.

They're literally the same thing, what are you on about?

They might be the same thing cryptographically, but passkeys remove your ability to manage, move, or back them up at will. I can trivially move any single SSH key I want between my Mac, my iPhone, my PC, my Raspberry Pi, and my backup media. Can I do that with passkeys? It seems to depend on which storage mechanism I choose, and even then it's often a matter of dumping the entire password database to plaintext first.

Edit:

Oh yeah, I can also share SSH keys with friends and co-workers. I can freely choose which SSH key to use when authenticating and I can have an arbitrary number of SSH keys for a given server on each machine. Some of this stuff is esoteric, but some is not. Most of the stuff I can do with SSH keys I can also do with passwords but not with passkeys (or at least not always). Finally, as many others have mentioned, the attestation stuff is really ugly and takes control away from the user entirely.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#255

Post by zabzonk »

dfabulich wrote: post #124
jasode wrote: post #108

Earlier quoted context omitted.

>This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. The issue isn't what passkeys _are_ (e.g. explaining they are like public/private "ssh keys" and hoping that type of explanation ends the confusion). Instead, it's the workflow around passkeys. The websites show very confusing dialog popups and choices that a lot of normal people will not understand. This is…

I don't think you're giving those seniors good advice. When the banks ask people to "switch" to passkeys, they're not removing the passwords; they're adding passkeys as an alternate login mechanism. If you lose your bank passkey, (e.g. if you put it in the wrong password manager and you can't figure out where it is) you can just sign in with your bank password. In the worst case, banks actually don't make it very har…

> just show up at a branch

In the UK at least, there are very few brick & mortar branches anymore - banks expect everything to be done online.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#256

Post by giantg2 »

dfabulich wrote: post #49
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

This seems like a consolidation of risk to rely on a password manager, especially software defined, especially if it relies on a password. I like the hardware token idea (yubikey). But even that seems cumbersome because you should be making a copy for safe keeping. And how do you securely do password recovery if most security questions can be obtained via osint or the reset links are sent to a site you are similarly locked out of is compromised?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#257

Post by MattTheRealOne »

hoppp wrote: post #166
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

You can add as many passkeys as you want and you can still have password logins too.

I have come across many websites that limit how many passkeys I can add. Some have only allowed one or two.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#258

Post by readread »

bombcar wrote: post #235
TSiege wrote: post #215

Earlier quoted context omitted.

I've yet to meet a non tech person irl who uses them. I went through the laborious process years ago setting my parents up with 1Password. They find passkeys very confusing addition. I have yet to see the massive UX win. If that were true I don't think we'd be having this conversation. Good UX becomes the natural state of things and we don't even notice. I've had trouble myself setting up passkeys correctly with my 1…

The win for passkeys is login with faceID. That people actually use.

My usernames and passwords auto-fill with faceID already. Lots of forms even (somehow?) auto-submit after that, don't even have to press a button.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#259

Post by deltoidmaximus »

readread wrote: post #224
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

I’ve just been operating under the assumption passkeys are gonna lock me out unrecoverably in some way at some point, and have been avoiding them for anything important while allowing them for low-value accounts so they’ll stop nagging me. I hate that I can’t just put a value in a plain text file somewhere (encrypted, let’s say, to preempt the inevitable and low-value response) and rely on that to work when I need it…

I avoid using them altogether for the same reason. I won't use them for low value accounts because it signals that I think they might be acceptable to eventually require for high value ones. And of course low value accounts have no value so I don't even care about phishing on most of those.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#260

Post by tekla »

NetMageSCW wrote: post #249
tekla wrote: post #230

Earlier quoted context omitted.

It is what the vast majority of people do.

I doubt if that’s true since the vast majority of people no longer have printers. Not even the vast majority of online people.

I was not aware writing down a password required printers.
Post reply on HN