Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

301–310 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#301

Post by preisschild »

dfabulich wrote: post #49
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

> This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager.

This is not true. There are device bound passkeys where the private key is stored in a HSM (TPM2.0, Android SE, or apple SE) instead of a hosted service (iCloud, Bitwarden.com). You can just add multiple Passkeys to a single site to have another backup device should your other one be unavailable.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#302

Post by vel0city »

deltoidmaximus wrote: post #286
vel0city wrote: post #61

Earlier quoted context omitted.

> Passkeys basically MITM the 2FA process so that they can track and deplatform you with a single click across all your accounts. I use passkeys with a physical authenticator. How do "they" track and deplatform me with a single click? Can you explain?

The service can use the use the attestation feature to block passkey providers that are deemed undesirable for whatever reason. Hard not to see eventually only major providers being accepted, even things like Microsoft services requiring Microsoft Passkeys using the Microsoft Passkey App which you're now required to have on your phone. Or worse you now need Symantec Passkeys to login to Symantec services (using that…

If a service wanted to do that they could already do that, you even point to an example with a platform requiring their specific app to use the account. I've had banks which required me to have their own time-based code physical security tokens to log in, isn't that in the end the same?

This thing you're talking about isn't inherently a thing about passkeys. If a service wants to remove your ability to log in to their service they can do it in a million different ways.

Also, the above poster said:

> deplatform you with a single click across all your accounts

"They" could do it across all your accounts with a single click. If service A decides to require attestation, how is that now affecting all my accounts?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#303

Post by thewebguyd »

Aerroon wrote: post #175
thewebguyd wrote: post #128

Earlier quoted context omitted.

> passkeys are intended to sync via your password manager of choice as the primary use case. The sync was actually a compromise to the standard. The idea was unique, device-bound credentials. One person, one device. The private key/passkey on your phone should not be the same one on your laptop, or your tablet, etc. Each device was supposed to have it' own unique credential. Allowing sync is a security downgrade to t…

I don't get it. How does every device combo having a unique key pair help with security? They can all log in, right? So all you need is to compromise their session and you're in, whether they share the same passkey or not. And if you're compromised in such a way that an attacker could steal your password then wouldn't they be able to just hijack your session instead?

Passkeys protect against credential theft, not session hijacking, two different parts of the stack. Passkey's only concern is initial authentication, it was never meant to provide any sort of protection against session theft. RFC 9449 Proof of Possession is how you prevent session hijacking, or session binding with a client-side TLS certificate.

Device-bound passkeys take care of non-repudiation. With synced keys (e.g., 1password), an account compromise of your vault hands the attacker all your credentials, the private keys are in the vault.

Device-bound keeps the private key sealed in the TPM (or secure enclave), the key cannot be exported, so it cannot be extracted remotely. Even malware on the machine, can hijack your session, but it cannot exfiltrate your private key, TPM won't release it to the service without user verification via biometrics, yubikey, or a PIN. There's also an attestation chain that breaks with synced passkeys. The attacker has no way to get your private key, so the only way to compromise the account is, yes, session hijacking, or physical access to the device with the user present to pass the biometrics check.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#304

Post by Telaneo »

robertlagrant wrote: post #245
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

> The weird part is that password managers provide no way for you to copy and paste your passkeys. The main feature of passkeys is that they can't be pasted into a website they shouldn't be pasted in to. That means you can't copy them, by design.

They're just text behind the scenes, so you can copy them if you really want to. KeepassX lets you do it, and got into a kerfuffle about it.[1]

It's an impossible design. It's all just obfuscation, most of which is confusing to users.

[1] https://github.com/keepassxreboot/keepassxc/issues/10407

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#305

Post by baby_souffle »

Telaneo wrote: post #289
Marsymars wrote: post #150

Earlier quoted context omitted.

> In the worst case, banks actually don't make it very hard for seniors to reset your password/passkey; just show up at a branch with photo ID, your bank card, and your PIN, and a teller will help you reset your credentials. They do it all the time. Maybe... I just ran into an annoying scenario where the largest bank in Canada made an administrative error where they mislinked an account belonging to me to my wife's p…

> I went to a physical branch to get it fixed and was told that branches don't have that kind of ability so I'd have to call customer support. What are the branches even for if not customer support?

> What are the branches even for if not customer support?

Lots of physical locations make the bank seem big/safe/reputable.

Beyond that, it's sales and a place to have ATMs. I have sometimes been able to get a replacement card issued at a branch instead of waiting for one to show up in the mail.

Some branches will accommodate special requests like "can I withdraw $200... in two dollar bills" / take coin deposits but that's been increasingly rare.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#306

Post by rcxdude »

baby_souffle wrote: post #297
fragmede wrote: post #272

Earlier quoted context omitted.

So you're saying that if you're inside Apple's walled garden, it works really well! Hmm...

> So you're saying that if you're inside Apple's walled garden, it works really well! Hmm... Or google. If you use android and chrome then it all just works. But god help you if you want to use a password manager to keep everything in sync; I haven't yet found a way for a mobile app or web page to explicitly signal to the device that the passkey to be created should live in $password_manager and not whatever built-in…

It's probably not something the app or web page should have any visibility or control over. It's more something the browsers and OS should allow a straightforward selection of where you want your passkeys stored (ideally something you can configure the default for globally). But of course the OS and browser vendors are trying to compete to do it, so they're not incentivised to make it obvious or fair.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#307

Post by NetMageSCW »

account42 wrote: post #9
datakan wrote: post #6

Passkeys are just SSH keys in how they work. We've been doing this since the 90's. The only people that use SSH keys are the Linux savvy users and those who are forced to via an enterprise solution for vaulting. The average person doesn't know anything about this stuff nor do they care. I also have yet to see a Passkey solution that didn't also have a password on it and a nice little box letting people choose to use…

SMS 2FA was also optional everywhere until it wasn't.

It is still optional most places.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#308

Post by voxic11 »

selicos wrote: post #246
christina97 wrote: post #185

It’s quite the opposite. Passkeys are phenomenal for a lot of consumers. Based on this thread, it’s the engineers who understand authentication in the first place and have their own system (eg password manager) that are confused. Consider a user in the Apple ecosystem: you are already conditioned to just do Touch ID or Face ID when asked. I was on Amazon the other day, it prompted randomly for “want to set up a passk…

A password manager let's me use my service specific credential from any device, securely and decentralized. Passkeys lock into a specific device and seem easy until you need to use another device. But instead of being a credential you own and control, across what could even be a local password manager, it's one password to everything. Maybe it is more secure than a regular password in some cases but it largely seems…

I put my passkeys in my password manager and it works fine.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#309

Post by zdp7 »

skybrian wrote: post #117
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

Copying / syncing passkeys between password managers is still work in progress, but you can usually work around it by making multiple keys. For important websites, I recommend saving additional passkeys to Keychain, etc, as backup, assuming the website allows that. (It should, but some websites might not have a good implementation.) Also, nothing says you have to delete passwords (or alternate means of logging in) if…

Unfortunately probably implementation specific, but you don't always need to have multiple passkeys. There is cross device passkey login. I had this occur in the last couple weeks. Evidently I had created a passkey on my phone. Logging into that site on my PC, it identified that I had a passkey and allowed me to authenticate using my phone.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#310

Post by [deleted] »

lrvick wrote: post #198

At Caution we -exclusively- allow passkeys. The entire database is user ids and public keys. If it leaks, it would only be mildly annoying. If you are confused about digital passkeys, you can use a physical yubikey or nitrokey and tap it when it blinks. You can treat them like a credit card or house keys. Asking people to keep up with and remember passwords is and always has been the thing that was invented with zero…

[deleted]
Post reply on HN