Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

361–370 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#361

Post by pas »

thyristan wrote: post #279
pas wrote: post #262

Earlier quoted context omitted.

> there's no a clear explanation there's. it depends on how the site implemented passkeys. I'm using multiple devices and passkeys via keepassXC. I haven't lost access or even got locked out of any accounts. but it's like 2FA, and almost all sites have a clean fallback (backup codes) for 2FA.

> there's. it depends on how the site implemented passkeys. so. no clear explanation.

the same is true of passwords. some sites provide password reset some don't. how is that not clear?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#362

Post by sib »

thewebguyd wrote: post #327
smelendez wrote: post #151

Earlier quoted context omitted.

Yes, this is exactly the problem. Multiple pieces of software vying to be your passkey provider, often using dark patterns so you don’t realize you’re making a choice, and not using the term “passkey” so people are using the technology without knowing what it is or how to research it. Kind of reflects the state of the web today, where every company wants to be your intermediary in every interaction, from making a pur…

> Multiple pieces of software vying to be your passkey provider, Which entirely defeats the point of using passkeys. There shouldn't be a passkey provider the "provider" is your device's TPM/secure enclave + your biometric challenge. They are supposed to be mathematically non-exportable, device-bound.

Yeah - and as a user, I don't want my device manufacturer to have that level of influence or control over the authentication that I use for unrelated services.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#363

Post by jolmg »

dfabulich wrote: post #299
jolmg wrote: post #287

Earlier quoted context omitted.

> I've not seen any insist that a passkey _must_ be used, and you can always log in with your password (or worst case, email magic links) as a fallback. With the exception of Github, and banks.

Did you try it? That’s not correct. I just logged into GitHub with a password (+ 2FA), on an account that also has a passkey. No major bank revokes your password when you setup a passkey, either.

Is "passkey" only supposed to mean devices that implement specifically U2F, WebAuthn, etc.? I would have thought TOTP and challenge-response hardware tokens to count, including cellphones with apps that implement such.

As to

> No major bank revokes your password when you setup a passkey, either.

If we're talking about requiring 2FA via TOTP or challenge-response hardware tokens or banking apps implementing such, that depends on the country. It's the status-quo in some places. Some banks even put the input field for the token output as a third input in the login form on their website because all customers have them. The rest separate their login form in multiple steps, but they likely require it of all customers too.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#364

Post by jesseendahl »

juancn wrote: post #21
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

Same here, also what if I lose the device? I can safely write down a password on a piece of paper and keep it somewhere phyisically safe. Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.

>Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.

Most providers continue to offer email-based recovery in the case that the end-user loses access to their primary factor, regardless of whether the primary factor is a password or a passkey.

And email based account recovery does not make the security advantages of passkeys disappear, which are:

- credential that's guaranteed to be unique

- credential that's guaranteed to be strong

- credential that cannot be phished (due to cryptographic binding to the domain at the time of credential creation)

- changes the incentives for compromising servers (they're nothing worth stealing from the server -- only public keys)

- if/when an app/website transitions to retiring password-based authN, then it will entirely eliminates credential stuffing attacks

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#365

Post by sib »

thewebguyd wrote: post #338
Someone1234 wrote: post #200

Earlier quoted context omitted.

Then most of us would never use it. That means either: - Only one specific device can ever login (bad). - It doesn't limit login to one specific device, therefore it does nothing. Linking Passkeys to a physical device was always DoA. At least not without a way to enroll every device you own, and strong recovery strategies. But considering how inconsistent every company's Passkey implementation is (inc. many that only…

> Only one specific device can ever login That's entirely service dependent, and the standard doesn't mandate "Service must not allow multiple passkeys" > It doesn't limit login to one specific device, therefore it does nothing. It's not nothing. It provides an attestation that you the user are in physical possession of the device, and have passed the challenge to release the key form the TPM (biometrics, pin, someth…

>> Only one specific device can ever login

> That's entirely service dependent, and the standard doesn't mandate "Service must not allow multiple passkeys"

Unfortunately, given the laziness, incompetence, and cost-consciousness of organizations like traditional financial institutions, telcos, governments, etc., many of them have & will end up with that implementation.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#366

Post by Saris »

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

>If I accidentally set up a passkey on my phone (let’s say I use Safari one day instead of my go-to, Brave), can I still log in without that passkey on other devices?

Yes, but you can also add the passkey to your password manager so it's available on all your devices.

>Can I add another passkey on another device?

Yes.

>How many passkeys can I set up for a particular site/app?

I haven't really seen a specified limit on any sites, but also if you're using a password manager it's only 1 passkey for all your devices anyways.

> For now, I’m going to stick with LastPass and use Passwords; because no matter whether I lose my device or not or whether I’m on my own devices or not, I can be sure I’ll be able to get into a site/app.

Your passkeys would be in LastPass as well like your passwords, so arguably the same result regardless of which you use.

>Edit: One final consideration, my spouse and I share user/name passwords for some things (notably Pandora and our Amazon Prime account) since they don’t handle things like family logins well; how do both my wife and I use amazon or Pandora with passkeys? Do we each set up passkeys? How do I get her Pass if that’s not an option?

If it was me I'd add a second passkey to my password manager for your wife under a new entry, and share that entry to her lastpass account.

Or if she's not on lastpass, you could just copy the data from the passkey over to whatever she does use.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#367

Post by jesseendahl »

cpburns2009 wrote: post #14
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

This is the main reason I've avoided passkeys. I have these exact questions and there's no a clear explanation given for these. I don't want to lose access to important accounts.

This is the #1 most common misconception I see about passkeys. They do not make it more likely that you will lose access to your accounts. They actually have nothing to do with account recovery. They are just a stronger primary factor than a password.

Most providers continue to offer email-based recovery in the case that the end-user loses access to their primary factor, regardless of whether the primary factor is a password or a passkey.

And email based account recovery does not make the security advantages of passkeys disappear, which are:

- credential that's guaranteed to be unique

- credential that's guaranteed to be strong

- credential that cannot be phished (due to cryptographic binding to the domain at the time of credential creation)

- changes the incentives for compromising servers (there's nothing worth stealing from the server -- only public keys)

- if/when an app/website transitions to retiring password-based authN, then it will entirely eliminates credential stuffing attacks

And if the account recovery scenario in question is your Gmail or Apple account, then you would need to go through their account recovery flows regardless of whether you were using a password or a passkey:

https://support.google.com/accounts/answer/7682439?hl=en https://support.apple.com/en-us/118574

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#368

Post by OkayPhysicist »

rpdillon wrote: post #233
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

Totally in the same boat, passkeys seem to massively increase the risk that I will lose access to my data.

I've taken up the strategy of telling any less-technical person who asks me about passkeys that they are the mark of the beast, intrinsically evil, and should be avoided at all costs, and I encourage all y'all to do the same.

Maybe, at some distant point in the past, there was a plan for a whole system of intercommunicating implementations of passkeys. That is no longer the case. The moment that they decided to include the information necessary to only allow the use of certain passkey vaults in the protocol, and then use that capability to threaten to lock out certain vaults that dared to let users actually be in control of THEIR OWN DAMN CREDENTIALS, it invalidated the entire project in my eyes. Passkeys cannot be trusted, they are designed to let entrenched powers hold your authentication hostage, and should under no circumstances be allowed to take root in the computing ecosystem.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#369

Post by OJFord »

voxic11 wrote: post #311
Tarq0n wrote: post #67

Earlier quoted context omitted.

OK now say you're on a work/library/friend's computer and you want to look up an account in 1password on your phone so you can type in the password. Passkeys don't support this very basic and common workflow. Meanwhile there's no real security benefit over password manager generated complex and not reused passwords.

I use a passkey with discord on my phone. If I want to log in to discord on a computer it shows a QR code on the page/desktop app and I scan it with my phone to log in. I could see this become a pretty common pattern. I like it because I can use discord on even a pretty untrusted computer without providing it any credentials or access to my passkey, and then later when I'm done I can revoke the session.

Ok but now do a service that doesn't support that, whether or not it might in the future 'become a pretty common pattern'.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#370

Post by randomblock1 »

Stop thinking of them as alternatives to passwords. That is something they do, incidentally. Really, they are an alternative to normal TOTP 2FA (and shudders SMS 2FA). Those were already dependent on an app on a single device, or a password manager. And now, you can have the security of that, automatically used with biometrics. It is only because they are so secure, due to being a cryptographic key, that they can replace passwords.

They really should come up with a way to transfer them across devices/password managers though.

Post reply on HN