Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

271–280 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#271

Post by pas »

juancn wrote: post #203
izacus wrote: post #63

Earlier quoted context omitted.

You do the same as you do when you lose your SSH key. Restore from backup and move on with your life. Why is there so much misinformation nonsense around passkeys?

How? Where are they stored? Which password protects them? How do I back them up? How do you move them to another device? Can I print them out on paper as a last resort measure? Nobody fucking knows.

it depends on which password manager you are using. if you use Google's then it gets backed up to your Google account.

BitWarden, KeePassXC, and probably a bunch of other password managers have very thorough support for import-export, automatic/periodic backup, sync/merge, etc.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#272

Post by fragmede »

jasode wrote: post #108
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

>This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. The issue isn't what passkeys _are_ (e.g. explaining they are like public/private "ssh keys" and hoping that type of explanation ends the confusion). Instead, it's the workflow around passkeys. The websites show very confusing dialog popups and choices that a lot of normal people will not understand. This is…

So you're saying that if you're inside Apple's walled garden, it works really well! Hmm...

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#273

Post by jbombadil »

Another noteworthy annoyance is the increasing number of services that try to aggressively push you towards passkeys, without you ever asking.

Every other time I open the Costco app (needed to walk in to the store, since I don't carry my card and they refuse to provide Apple Wallet integration) I get asked to switch to passkey, without a way of saying "don't ask me again".

If you're in any position to determine this in your company/software, please stop this pattern. Give users the option to say "stop asking me about passkeys".

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#274

Post by thyristan »

NetMageSCW wrote: post #242
otabdeveloper4 wrote: post #188

Earlier quoted context omitted.

WebAuthn is the standard for token authentication. (I.e., Yubikeys and other USB sticks.) It works fine and it a no-brainer to use. The problems start when vendors start trying to shoehorn their shitty cloud auth services into WebAuthn.

How well does that Yubikey work with an iPhone?

iPhones are a lost cause.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#275

Post by cswelin »

dang wrote: post #130

> I run a tech company and I have no idea what a passkey is and at this point I’m too afraid to ask I thought I was the only one!

I find passkeys.. ill say interesting.

I can have the most complex password and create a passkey, but a windows machine could allow a 4 pin digit to access the passkey.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#276

Post by pas »

juancn wrote: post #21
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

Same here, also what if I lose the device? I can safely write down a password on a piece of paper and keep it somewhere phyisically safe. Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.

password managers do the backup for you based on how you set them up (eg. to your google drive, or to a simple SFTP/FTPS/S3 URI)

those that don't have this built-in (eg. KeePassXC) recommend using Dropbox or some external sync mechanism

but the keys are stored in a file, which you can back up.

> all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor

no, not at all. it still gives you better UX, because when you use the passkey you know it's the site you want to log in to. (because there's mutual authentication.)

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#277

Post by tossitawayplz »

The first time I got asked by a site if I wanted to use a passkey I immediately googled what they were and... never really found the answer, not in the 5mins I devoted to being distracting from my task at hand anyway.

"magic fairy dust to login to apps." is the most accurate description I've seen.

Unlike a password or a TOTP token, I know how those work, I know its my responsibility to keep track of them. If my passkey is on my phone what happens if I lose my phone? Do I need a unique passkey per device? How do I rotate them? What if a device gets stolen?

I'm so glad I'm not alone in thinking these are so poorly explained.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#278

Post by AlexandrB »

cpburns2009 wrote: post #126
ranger207 wrote: post #82

The website for my HSA required me to set up a passkey last time I logged in. I set it up on my work laptop and my work password manager, which means I can now no longer access my account from my personal computer. This is fantastic, just what I wanted

This is exactly a scenario that worries me. Proponents of passkeys imply you can setup a bunch of passkeys. Evidently that's not always the case.

"But that's just a bad implementation, many other sites do it right!"

And many sites block paste from password managers. Passkeys have so many ways to do them wrong that we're going to see all kinds of new and exciting failure modes that lock you out of your account in the future.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#279

Post by thyristan »

pas wrote: post #262
cpburns2009 wrote: post #14

Earlier quoted context omitted.

This is the main reason I've avoided passkeys. I have these exact questions and there's no a clear explanation given for these. I don't want to lose access to important accounts.

> there's no a clear explanation there's. it depends on how the site implemented passkeys. I'm using multiple devices and passkeys via keepassXC. I haven't lost access or even got locked out of any accounts. but it's like 2FA, and almost all sites have a clean fallback (backup codes) for 2FA.

> there's. it depends on how the site implemented passkeys.

so. no clear explanation.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#280

Post by pas »

reddalo wrote: post #60
programmertote wrote: post #19

Like some folks already commented here, even as someone who has been working in tech for 20+ years, I find Passkey confusing. I understand the key aspect in computer science term, but I don't know how to use it across devices. Another big worry is that if I tie that to a physical key, then I might lose it (because it's physical) and never get it back.

Exactly, I always refuse to add a passkey because I'm afraid I won't be able to easily login again. Also, I don't want to be locked in to a vendor.

use an open source password manager that supports them.

as others mentioned, there's BitWarden (cross-platform, self-hostable), but if you want something simple there's KeePassXC (and you can put the store file on a dropbox shared folder)

Post reply on HN