Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

491–500 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#491

Post by raron »

halJordan wrote: post #435
raron wrote: post #423

Earlier quoted context omitted.

I don't think that would work either. Let's say I have a new account and a single Passkey in the TPM of PC1. I want to log in from PC2, too. How can I do that? (I know there is some trickery with Bluetooth, but I haven't seen anything supporting it, and desktop PCs usually doesn't have Bluetooth connectivity.) AFAIK some browsers can do some magic to use a Passkey from your smartphone on a PC, but you need to log in…

You generate another passkey is your answer. How do you do that? The exact same way you do today. Why would you need to delete invalid passkeys? You wouldn't.

> You generate another passkey is your answer. How do you do that? The exact same way you do today.

How can I do that, if Passkeys are the only option to log in?

If I can just use a password to log into a website without Passkeys, then Passkey is useless and doesn't add any security benefit.

> Why would you need to delete invalid passkeys? You wouldn't.

I sell my old (and no longer updated) phone or PC and don't want someone to get access to my account by getting access to the secret keys.

An non-revocable authentication mechanism is just stupid.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#492

Post by kbelder »

OkayPhysicist wrote: post #368
rpdillon wrote: post #233

Earlier quoted context omitted.

Totally in the same boat, passkeys seem to massively increase the risk that I will lose access to my data.

I've taken up the strategy of telling any less-technical person who asks me about passkeys that they are the mark of the beast, intrinsically evil, and should be avoided at all costs, and I encourage all y'all to do the same. Maybe, at some distant point in the past, there was a plan for a whole system of intercommunicating implementations of passkeys. That is no longer the case. The moment that they decided to inclu…

>...they are the mark of the beast, intrinsically evil, and should be avoided at all costs

That's basically my recommendations to people.

1. Avoid using them if possible.

2. If you have to use them, make sure you have a password login to fall back on.

3. If the site forces you to use them, make sure you don't use it for any thing you rely on.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#493

Post by pibaker »

QGQBGdeZREunxLe wrote: post #403
selicos wrote: post #246

Earlier quoted context omitted.

A password manager let's me use my service specific credential from any device, securely and decentralized. Passkeys lock into a specific device and seem easy until you need to use another device. But instead of being a credential you own and control, across what could even be a local password manager, it's one password to everything. Maybe it is more secure than a regular password in some cases but it largely seems…

1password and KeypassXC both support passkey syncing across devices and operating systems.

Until service providers ban them for being insecure — "if you can send your passkey to any other device, you can also send it to a phisher."

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#495

Post by QGQBGdeZREunxLe »

pibaker wrote: post #493
QGQBGdeZREunxLe wrote: post #403

Earlier quoted context omitted.

1password and KeypassXC both support passkey syncing across devices and operating systems.

Until service providers ban them for being insecure — "if you can send your passkey to any other device, you can also send it to a phisher."

Passkeys have preventive measures for phishing.

https://bitwarden.com/resources/passkeys-are-phishing-resist...

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#496

Post by YuccaGloriosa »

andy99 wrote: post #316
Marsymars wrote: post #150

Earlier quoted context omitted.

> In the worst case, banks actually don't make it very hard for seniors to reset your password/passkey; just show up at a branch with photo ID, your bank card, and your PIN, and a teller will help you reset your credentials. They do it all the time. Maybe... I just ran into an annoying scenario where the largest bank in Canada made an administrative error where they mislinked an account belonging to me to my wife's p…

This is more a statement of how awful Canadian banks are than anything else. For anyone unaware we have an oligopoly of five identical banks all of which treat their customers like shit and effectively extract tax from the Canadian population while providing nothing.

Ironic given the prime minister's former employment

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#497

Post by pseudalopex »

preisschild wrote: post #301
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

> This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. This is not true. There are device bound passkeys where the private key is stored in a HSM (TPM2.0, Android SE, or apple SE) instead of a hosted service (iCloud, Bitwarden.com). You can just add multiple Passkeys to a single site to have another backup device should your other one be unavailable.

Just have the 2nd device when you create any account. But have it away from the 1st device always. Just update 10s or 100s of accounts for every new device. Just never use sites which allows 1 Passkey.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#498

Post by juancn »

pas wrote: post #271
juancn wrote: post #203

Earlier quoted context omitted.

How? Where are they stored? Which password protects them? How do I back them up? How do you move them to another device? Can I print them out on paper as a last resort measure? Nobody fucking knows.

it depends on which password manager you are using. if you use Google's then it gets backed up to your Google account. BitWarden, KeePassXC, and probably a bunch of other password managers have very thorough support for import-export, automatic/periodic backup, sync/merge, etc.

And that's a HUGE issue. SSH keys are easy to manage in comparison to PassKeys.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#499

Post by ghostly_s »

giancarlostoro wrote: post #51
reddalo wrote: post #47

Earlier quoted context omitted.

> Linux is the only oddball here, I had issues getting this flow to work. Take a guess why. Passkeys are just a trick for vendor lock-in disguised as a security practice.

Firefox just didn't support it cleanly, I think Chrome did, I don't remember. Apparently it's just due to Linux not having a native passkey implementation. Dang. Edit: Apparently BitWarden should work, but my particular passkey was not on there.

I use Bitwarden on Linux. There is no option to do anything with a passkey I have stored there except delete it.
Post reply on HN