Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

391–400 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#391

Post by unscaled »

thewebguyd wrote: post #354
Someone1234 wrote: post #333

Earlier quoted context omitted.

Right; but THAT idea is consumer hostile by design. So your account is now tied to a physical device; great, but the device is dead, or you own a dozen devices, now what? Each vendor has their own idea about what THIS means. Heck I have a couple that allow, max, a single Passkey at a time.

> Right; but THAT idea is consumer hostile by design. No argument from me there, just stating what the design actually calls for. It was never meant to be consumer friendly in the first place, it's an enterprise standard. It was just shoehorned onto consumers with the synced credential compromise to make it easier, instead of coming up with something better, and then just calling it a "Passkey" which now has dual mea…

The FIDO set of standards (UAF, U2F which predated passwords and passkeys) haven't even started as enterprise standards. There are multiple origins for what became FIDO, but the main ones I know are:

1. PayPal was looking for a physical authentication solution for their users, Michael Barrett was their CISO at that point and he became the president of FIDO.

2. Google developed Gnubby (which was internal, and therefore enterprise) and they wanted to push a similar authentication to their end-users, supported directly on Chrome. They wanted this to become a standards, so donated the underpinnings of the Gnubby technology which became FIDO U2F.

I might be wrong but at least these are the two parts I know.

And while the original FIDO could be called dual-use, Webauthn and especially Passkeys were developed to be first and foremost a customer-facing standard.

It doesn't mean they are not confusing, but they are clearly designed with end users in mind.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#393

Post by johngalt »

tossitawayplz wrote: post #277

The first time I got asked by a site if I wanted to use a passkey I immediately googled what they were and... never really found the answer, not in the 5mins I devoted to being distracting from my task at hand anyway. "magic fairy dust to login to apps." is the most accurate description I've seen. Unlike a password or a TOTP token, I know how those work, I know its my responsibility to keep track of them. If my passk…

Think of it like SSH authorized keys but automated for the web. Instead of storing the keys in a file; it stores them in a hardware security module (yubikey, or TPM).

Registration generates an asymmetric key pair between your passkey, and the website. Login is the usual challenge/response process. The biggest step forward is phishing resistance. A fake login page can relay a TOTP code, but not the passkey challenge/response.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#394

Post by Telaneo »

jolmg wrote: post #363
dfabulich wrote: post #299

Earlier quoted context omitted.

Did you try it? That’s not correct. I just logged into GitHub with a password (+ 2FA), on an account that also has a passkey. No major bank revokes your password when you setup a passkey, either.

Is "passkey" only supposed to mean devices that implement specifically U2F, WebAuthn, etc.? I would have thought TOTP and challenge-response hardware tokens to count, including cellphones with apps that implement such. As to > No major bank revokes your password when you setup a passkey, either. If we're talking about requiring 2FA via TOTP or challenge-response hardware tokens or banking apps implementing such, that…

> I would have thought TOTP and challenge-response hardware tokens to count

Those are absolutely not passkeys. Passkeys are just WebAuthn (from what i can tell).

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#395

Post by l11r »

JohnFen wrote: post #372
thewebguyd wrote: post #327

Earlier quoted context omitted.

> Multiple pieces of software vying to be your passkey provider, Which entirely defeats the point of using passkeys. There shouldn't be a passkey provider the "provider" is your device's TPM/secure enclave + your biometric challenge. They are supposed to be mathematically non-exportable, device-bound.

> They are supposed to be mathematically non-exportable, device-bound. Which would make the whole scheme unworkable (at least for me).

I pair of hardware keys (Token2, Yubico, etc) has the benefits from both worlds.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#396

Post by ilchalpenl »

dotancohen wrote: post #373
thewebguyd wrote: post #317

Earlier quoted context omitted.

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey). I have just shy of 2000 site credentials in Keepass. Let's assume that they were all Passkeys. 1) When I buy a new device, how do I create 2000 new Passkeys for that device? 2) Can I still do that if I don't have access to the old device? Maybe it was destroyed…

Apple's keychain or google password manager - can hold 2000 passkeys easily.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#397

Post by Telaneo »

pas wrote: post #361
thyristan wrote: post #279

Earlier quoted context omitted.

> there's. it depends on how the site implemented passkeys. so. no clear explanation.

the same is true of passwords. some sites provide password reset some don't. how is that not clear?

> some sites provide password reset some don't

I'm yet to see a site that doesn't provide a password reset (excluding websites without passwords). What inane webdev though that'd be a good idea?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#398

Post by tonymet »

The fundamental blind spot engineers have had with every authentication protocol for 30 years is forgetting that trust must be mutual. The lone exception has been phishing prevention with user-selected avatars, and that didn't last long.

Every advancement in "security" has assumed the service needs to more strictly identify the customer, without caring about the customer's trust for the service, or experience with performing the identification ritual.

So when your bank asks you for a code or your mom's maiden name, they never offer anything to verify they are who they say they are. whenever I ask they say "of course we're from chase, we just called you", without realizing how absurd that is.

Now Passkeys suffer an even worse dilemma. Now the customer has 4 dimensions of tools to record & use in order to log in. Did I use email, google, facebook, apple ID to log in? Did I save this code via phone, text, authenticator app (which one, there are multiple incompatible ones)? Did I use a passkey ? where is that passkey located? my phone, my browser storage, my authentication extension.

We started with a single dimension of email + password to log in. Now it's an entire decision tree that has to be recorded. How do you even record this?

  disqus :  credential = email, password = "see bitwarden", 2fa = microsoft authenticator, passkey = "on iphone in icloud"

  viator: credential = google sso, password = same, 2fa = symantec, passkey = "edge on windows 11 laptop in office"
This is absolutely absurd!

I thought engineers were tested for scaling during the interview process. This protocol doesn't even scale to a single site.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#399

Post by halJordan »

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

I get your problem, i don't really accept it as valid. Passkeys were always supposed to be fungible. You have one in your iPhone, a different one on your desktop. A third in your significant other's phone. All stored in the hardware tpm equivalent.

You can have 7 passkeys. You can have 14.

The real failure of passkeys (emphasis on the s!) is that people think they must only have one.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#400

Post by arcbyte »

christina97 wrote: post #185

It’s quite the opposite. Passkeys are phenomenal for a lot of consumers. Based on this thread, it’s the engineers who understand authentication in the first place and have their own system (eg password manager) that are confused. Consider a user in the Apple ecosystem: you are already conditioned to just do Touch ID or Face ID when asked. I was on Amazon the other day, it prompted randomly for “want to set up a passk…

The moment my mom needs my help to login to something because she clicked the button but now it's expired / she got a new phone / raison du jur, I will be totally unable to assist her. It's a horrible concept being foisted on unsuspecting victims.
Post reply on HN