Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

321–330 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#321

Post by NetMageSCW »

vinay_ys wrote: post #183
varispeed wrote: post #22

I find it difficult to explain how to use password manager to non-IT person. Whatever I say, they say it is not secure. No amount of explanation will change their mind. They prefer to keep their passwords in their physical note book hidden in the safe (yes, they open the safe etc each time they need to log in somewhere when they get logged out). As someone with ADHD a passkey is something I can lose easily and I don'…

They should buy a Yubikey (a physical key) and keep their passkeys resident on that. Then they can truly keep that physical key locked up in their safe. And it is truly safer than their physical notebook because they are safe from being tricked into entering their password in the wrong place.

How do they tell their significant other how to logon to a shared account when they aren’t together? How do they use the Yubikey with their phone, laptop and tablet conveniently?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#322

Post by preisschild »

tossitawayplz wrote: post #277

The first time I got asked by a site if I wanted to use a passkey I immediately googled what they were and... never really found the answer, not in the 5mins I devoted to being distracting from my task at hand anyway. "magic fairy dust to login to apps." is the most accurate description I've seen. Unlike a password or a TOTP token, I know how those work, I know its my responsibility to keep track of them. If my passk…

You can use both hardware bound passkeys (where you may not even be able to read the secret so you probably would want to add multiple device passkeys to a site)

or shared passkeys (where the private key can be synced through something like a cloud service across your devices, see Bitwarden, iCloud)

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#323

Post by fauigerzigerk »

baby_souffle wrote: post #297
fragmede wrote: post #272

Earlier quoted context omitted.

So you're saying that if you're inside Apple's walled garden, it works really well! Hmm...

> So you're saying that if you're inside Apple's walled garden, it works really well! Hmm... Or google. If you use android and chrome then it all just works. But god help you if you want to use a password manager to keep everything in sync; I haven't yet found a way for a mobile app or web page to explicitly signal to the device that the passkey to be created should live in $password_manager and not whatever built-in…

>I haven't yet found a way for a mobile app or web page to explicitly signal to the device that the passkey to be created should live in $password_manager and not whatever built-in/on-device key-store exists.

On Android 17 (on Pixel) you can select the password service under Settings -> Passwords and passkeys -> Preferred service.

If you have an alternative password manager installed, it will be listed there along with Google's own password manager. iOS has a similar setting but I don't know exactly where off the top of my head.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#324

Post by tekla »

dfabulich wrote: post #196
tetromino_ wrote: post #165

Earlier quoted context omitted.

> you can ask a bank teller to help you At virtually all banks, the bank tellers cannot help you with login problems. You will have to call the bank's tech support and somehow navigate AI-modulated phone menu hell.

Citation needed. Walk in with photo ID, a bank card, and your PIN, and all the major banks will send you a reset-password email.

I help run a non-profit and the only time I have ever been able to get this kind of service is when I visit a bank that has in-person business services. Tellers do not have any ability to do any of this.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#326

Post by preisschild »

eigenspace wrote: post #285
selicos wrote: post #246

Earlier quoted context omitted.

A password manager let's me use my service specific credential from any device, securely and decentralized. Passkeys lock into a specific device and seem easy until you need to use another device. But instead of being a credential you own and control, across what could even be a local password manager, it's one password to everything. Maybe it is more secure than a regular password in some cases but it largely seems…

Passkeys do *not* do that. I use 1Password to manage my passkeys and they are all synced across all my authenticated devices where I installed 1Password.

You can choose either if your password manager supporte Passkeys

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#327

Post by thewebguyd »

smelendez wrote: post #151
sandeepkd wrote: post #118

Earlier quoted context omitted.

I am an engineer and have some insights on the discussions and developments around it. ITS NOT SIMPLE AT ALL 1. The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing). 2. Majority of industry players shared the vision of a credential which is available across the platforms and browsers 3. The vision for collaboration never materialize…

Yes, this is exactly the problem. Multiple pieces of software vying to be your passkey provider, often using dark patterns so you don’t realize you’re making a choice, and not using the term “passkey” so people are using the technology without knowing what it is or how to research it. Kind of reflects the state of the web today, where every company wants to be your intermediary in every interaction, from making a pur…

> Multiple pieces of software vying to be your passkey provider,

Which entirely defeats the point of using passkeys. There shouldn't be a passkey provider the "provider" is your device's TPM/secure enclave + your biometric challenge. They are supposed to be mathematically non-exportable, device-bound.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#328

Post by Telaneo »

juancn wrote: post #21
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

Same here, also what if I lose the device? I can safely write down a password on a piece of paper and keep it somewhere phyisically safe. Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.

2FA secrets can be backed up, and everyone should do that, for the same reason you'd want to do it with passwords.

Passkeys can too, but there it's even more obfuscated than with 2FA.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#329

Post by yandie »

selicos wrote: post #246
christina97 wrote: post #185

It’s quite the opposite. Passkeys are phenomenal for a lot of consumers. Based on this thread, it’s the engineers who understand authentication in the first place and have their own system (eg password manager) that are confused. Consider a user in the Apple ecosystem: you are already conditioned to just do Touch ID or Face ID when asked. I was on Amazon the other day, it prompted randomly for “want to set up a passk…

A password manager let's me use my service specific credential from any device, securely and decentralized. Passkeys lock into a specific device and seem easy until you need to use another device. But instead of being a credential you own and control, across what could even be a local password manager, it's one password to everything. Maybe it is more secure than a regular password in some cases but it largely seems…

I keep all my passkeys in 1 password. So magical

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#330

Post by throwawayffffas »

qlte wrote: post #292
throwawayffffas wrote: post #55

Earlier quoted context omitted.

I think the intended workflow is you login with your phone and that device is now the authority that allows other devices to issue their own passkeys. In my opinion it's a bad plan, because it elevates certain devices to privileged status, if you lose your phone you are hosed. Passkeys should be allowed to be synced between devices and stored on password managers in the cloud. I am making my own password manager for…

> Passkeys should be allowed to be synced between devices and stored on password managers in the cloud. I am making my own password manager for my personal use, but have not delved into passkeys. They are, that’s exactly how I use all my passkeys with Bitwarden. They sync to any device I have Bitwarden installed on when added on one device.

Yeah that's all hackery I think, if you read at the specs there is always a device involved, bitwarden and company just pretend to be a device or have an extension that just ignores the spec.
Post reply on HN