Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

351–360 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#351

Post by jesseendahl »

thewebguyd wrote: post #317
thecombjelly wrote: post #217

Earlier quoted context omitted.

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

> Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound

If you watch the original Apple WWDC talk presenting passkeys, you will find that they were always intended to sync, at least for the consumer use-case.

What you are describing is how the WebAuthn standard had been implemented by Yubico and Google up until the point of the introduction of “passkeys” by Apple.

The reason passkeys have their own name and definition is because they are meant to be a phishing-resistant primary factor that competes with the UX of passwords. And a great usability trait of passwords is that they’re convenient to use across all your devices. With a technology involving public/private keypairs, the only possible way to compete with that UX is to sync the private key across the user’s devices.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#352

Post by toyg »

Telaneo wrote: post #289
Marsymars wrote: post #150

Earlier quoted context omitted.

> In the worst case, banks actually don't make it very hard for seniors to reset your password/passkey; just show up at a branch with photo ID, your bank card, and your PIN, and a teller will help you reset your credentials. They do it all the time. Maybe... I just ran into an annoying scenario where the largest bank in Canada made an administrative error where they mislinked an account belonging to me to my wife's p…

> I went to a physical branch to get it fixed and was told that branches don't have that kind of ability so I'd have to call customer support. What are the branches even for if not customer support?

A meeting space to discuss business services, and a terminal for people who insist on depositing cash. They are definitely not a customer support terminal.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#353

Post by brachkow »

Passkeys work well when you have password managers with multi-device sync. While it is indeed trivial to get one, consumers don't like password managers in first place. And it is very hard to make person use password manager, instead of his john1988 type of password

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#354

Post by thewebguyd »

Someone1234 wrote: post #333
thewebguyd wrote: post #317

Earlier quoted context omitted.

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

Right; but THAT idea is consumer hostile by design. So your account is now tied to a physical device; great, but the device is dead, or you own a dozen devices, now what? Each vendor has their own idea about what THIS means. Heck I have a couple that allow, max, a single Passkey at a time.

> Right; but THAT idea is consumer hostile by design.

No argument from me there, just stating what the design actually calls for.

It was never meant to be consumer friendly in the first place, it's an enterprise standard. It was just shoehorned onto consumers with the synced credential compromise to make it easier, instead of coming up with something better, and then just calling it a "Passkey" which now has dual meaning.

But the real solve is difficult. If a system requires a consumer user to manage, remember, or safely store something extra, it will fail.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#355

Post by sib »

TitaRusell wrote: post #336
thewebguyd wrote: post #317

Earlier quoted context omitted.

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

This is exactly all the stuff normal people don't care about. If your system requires any basic intelligence or interest scrap it and go back to the drawing board because you just lost your customers.

Stronger than "don't care about" (at least if I and some friends I've discussed this with count as normal people): this is actively what I don't want! I want control over my authentication and I don't want it bound to device, browser, OS, etc.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#356

Post by hoppp »

MattTheRealOne wrote: post #257
hoppp wrote: post #166

Earlier quoted context omitted.

You can add as many passkeys as you want and you can still have password logins too.

I have come across many websites that limit how many passkeys I can add. Some have only allowed one or two.

Yeah, it's bad implementation on the websites but the protocol doesn't have a limit.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#357

Post by joshuamorton »

kingstnap wrote: post #228
throw0101d wrote: post #159

Earlier quoted context omitted.

> Thats because the people behind passkeys are paternalistic and don't trust users. To be fair, trusting users with passwords/credentials is how we got into the mess of phishing et al in the first place.

The phishing resistance on fake websites is largely a function of the fact its an ssh key and you can't man in the middle those after first setup because you have known_hosts, which in the case of passkeys gets replaced with the website certificate technology. The baking in "which authenticator is storing this passkey" and "require user to provide biometrics/pin to verify presence for this passkey" and "don't make it…

> I guess it sort of helps if the threat model is complete remote code execution inside the victims brain because you got them to export their keys to you, but it seems more useful for websites and governments whitelisting what hardware and software they deem acceptable.

Reminder that Facebook has warnings and prevention mechanisms to avoid users pasting malicious JavaScript into the console on Facebook.com (which would exfiltrate session cookies).

Preventing users from accessing these keys directly makes sense!

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#358

Post by tavavex »

lrvick wrote: post #198

At Caution we -exclusively- allow passkeys. The entire database is user ids and public keys. If it leaks, it would only be mildly annoying. If you are confused about digital passkeys, you can use a physical yubikey or nitrokey and tap it when it blinks. You can treat them like a credit card or house keys. Asking people to keep up with and remember passwords is and always has been the thing that was invented with zero…

> -exclusively- allow passkeys

Isn't that just a euphemism for "we mandate passkeys"? Saying 'exclusively allow' draws the reader's attention to the positive (allowing!) while de-emphasizing what's not permitted.

Regardless, I think it's a lot less of an issue for services exclusively oriented at people in tech instead of just everyone. Even then, there is a barrier to adoption besides just understanding it, which is relying on new software or owning a piece of hardware. It's a lot messier, while text remains universal and has no dependencies.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#359

Post by f30e3dfed1c9 »

My take: (1) I've had passwords handled pretty well for a long time now: same password manager for something like 15 years; (2) companies are pushing pretty hard to get me to use passkeys instead.

From (2) I assume that the companies see benefits to themselves. I don't care about benefits to them. I don't see much in the way of benefits to me, so I'm not changing anything if I don't have to.

I'll admit to not having looked into passkeys all that much. Someday, I might. But for the time being, I don't see much point. I imagine that eventually I'll be more or less forced to deal with passkeys in at least some contexts. Will leave that for later.

For now, it's all a big "no thanks" from me.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#360

Post by raggi »

jasode wrote: post #108
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

>This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. The issue isn't what passkeys _are_ (e.g. explaining they are like public/private "ssh keys" and hoping that type of explanation ends the confusion). Instead, it's the workflow around passkeys. The websites show very confusing dialog popups and choices that a lot of normal people will not understand. This is…

[dead]
Post reply on HN