Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

481–490 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#481

Post by michaelt »

packetlost wrote: post #380
thewebguyd wrote: post #317

Earlier quoted context omitted.

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey). This is a misconception. A particular service can choose to enforce those class of passkeys, but most don't need that and shouldn't. Passkeys are primarily meant to replace passwords and be hard (but not necessarily impossible) to exfiltrate. The key difference…

> Passkeys are primarily meant to replace passwords

Unfortunately, the designers of passkeys decided they should replace passwords and usernames and second factors.

Also they decided they should be cloud-synchronised, so the something-you-have second factor doesn't impose the burdensome requirement for you to have something, which was apparently a big usability problem.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#483

Post by fugalfervor »

chews wrote: post #462
ilchalpenl wrote: post #396

Earlier quoted context omitted.

Apple's keychain or google password manager - can hold 2000 passkeys easily.

Dunno why the downvotes, if you're willing to trust Apple or Google this is a good method for passkey usage. because your touchID/faceid/opticalid auth gate the keyring's on either of these vendors your passkey works without having to migrate them. EDIT: Also ANY device that you add to your iCloud has access to the passkeys you've made... it's a dream for secure access.

The downvotes are because the commenter did not read or at least did not fully comprehend the meaning of the post they were responding to.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#484

Post by [deleted] »

jesseendahl wrote: post #419
iamnothere wrote: post #376

Earlier quoted context omitted.

I don’t see hardware tokens (like Yubikey) in the list. Those are the only ones that provide a true second factor, to protect against the theft or compromise of your primary device. I’m a little afraid that hardware tokens are getting lost in all the passkey marketing BS. At least they continue to work for now.

> I don’t see hardware tokens (like Yubikey) in the list. Those are the only ones that provide a true second factor passkeys are not meant to be a second factor; they are meant to replace the password as a primary factor. >to protect against the theft or compromise of your primary device. I love Yubikeys, but the only additional protection you get by making the passkey hardware-bound is preventing an attacker who has…

[deleted]

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#485

Post by VCFundedGenYer »

Passkeys bother me because they depend on the availability of another device. That just won't cut it for a lot of folks, especially people that are prone to losing devices. It's also annoying to have to deal with the 50,000 places that are fighting to keep your passkeys, leading to fragmentation and uncertainty as to where these credentials are stored.

Haphazardly implementing passkeys also has big problems - one vendor I use implemented them rather badly and randomly one day, completely removing the previously-solid password/MFA setup they had, replacing it with a "you are required to confirm on your phone with no other alternative" passkey, which was really annoying. I don't like my logins messed with. Passwords/MFA, while not perfect, work very well for most people, myself included. Passkeys still feel like they are in a very immature state.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#486

Post by pibaker »

halJordan wrote: post #438
tsimionescu wrote: post #411

Earlier quoted context omitted.

Again, is this true for all major sites that support passkeys? And how do you set it up? My passwords are automatically synced between my devices, how to I achieve the same thing if I set up an account with a passkey?

Why would you take one passkey and move it between devices? Generate a new one. They're fungible. You set it ask to the exact same way you do today. It's not a problem.

This assumes all services let you generate new passkeys with no hassle, which is not true.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#487

Post by VCFundedGenYer »

ryandrake wrote: post #479
pas wrote: post #280

Earlier quoted context omitted.

use an open source password manager that supports them. as others mentioned, there's BitWarden (cross-platform, self-hostable), but if you want something simple there's KeePassXC (and you can put the store file on a dropbox shared folder)

I resent that I need a special app to "manage" them. I want to know where this key is on my filesystem so I can back it up and edit it myself, not have to use some app to access it. My ssh authorized_keys is just a text file. I can "manage" it with something as simple as vim. Maybe KeePassXC and BitWarden give you that simplicity, if so great!

KeePassXC "supports passkeys" but the website/app that offers the passkey needs to offer it in the correct way for KeePassXC to ingest it. I've found a fair amount of scenarios where they don't correctly let you drop it into them.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#488

Post by bflesch »

vel0city wrote: post #302
deltoidmaximus wrote: post #286

Earlier quoted context omitted.

The service can use the use the attestation feature to block passkey providers that are deemed undesirable for whatever reason. Hard not to see eventually only major providers being accepted, even things like Microsoft services requiring Microsoft Passkeys using the Microsoft Passkey App which you're now required to have on your phone. Or worse you now need Symantec Passkeys to login to Symantec services (using that…

If a service wanted to do that they could already do that, you even point to an example with a platform requiring their specific app to use the account. I've had banks which required me to have their own time-based code physical security tokens to log in, isn't that in the end the same? This thing you're talking about isn't inherently a thing about passkeys. If a service wants to remove your ability to log in to thei…

Unfortunately the US has willfully destroyed a significant amount of goodwill with citizens of their NATO allies. Due to aggressive rhetoric we are forced to look at the risks differently now.

Further centralization on US services for something that already works fine (like 2FA) is unnecessary risk.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#489

Post by [deleted] »

Macha wrote: post #451
jolmg wrote: post #405

Earlier quoted context omitted.

Such a generic word. I imagine there are tons of CLI utilities out there with a --passkey option that refer to simply files with a key inside. Kind of crazy that it's being used to mean specifically devices that implement a specific protocol. Kind of feels like "crypto is a type of currency and not all cryptography", or "SQL Server is a specific product of Microsoft". Wonder if how it happened this time was people re…

Isn't the standard term for what you're referring to a "keyfile"? Google Trends also indicates nobody was caring about "passkey" before 2022.

[deleted]

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#490

Post by edwinjm »

Melatonic wrote: post #450
Reddit_MLP2 wrote: post #187

Earlier quoted context omitted.

sadly it seems like most of the banks I use still enforce antiquated password rules, no MFA and rely on stupid questions most of which can easily be guessed from public records.

You can also just put any answer into the question as long as you will remember it.

It should work for all people and not depend on these “tricks”.
Post reply on HN