Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

531–540 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#531

Post by merb »

thewebguyd wrote: post #317
thecombjelly wrote: post #217

Earlier quoted context omitted.

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

Wouldn’t it be better to use envelope encryption and sync the passkeys? I mean with envelope encryption somebody would probably be able to create a rfc that would support cross browser/password manager sync a passkey by using a encrypted envelope that would be able to be deceptively wither via tpm or by using credentials so when syncing it would ask for upn/password of the original device or something so it can even be e2e encrypted, so some kind of federation protocol for password managers that you own

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#532

Post by tzs »

VertanaNinjai wrote: post #461
eigenspace wrote: post #432

Earlier quoted context omitted.

Of course. I was just pointing out that their claim about the lack of portability across devices was untrue.

Perhaps they should’ve said platforms. Because if you wanted to migrate those passkeys off your password manager and into a different platform like Apple Pass or Google how is that accomplished?

There's a protocol, FIDO Credential Exchange Protocol (CXP) which is currently at proposed standard status. It is supported by Apple and Google and some third party password managers (1Password, Bitwarden, and Dashlane). (1Password is kind of annoying though as its CXP export only supports exporting everything. There is no way as far as I can tell to export just a single item yet).

Once 1Password supports proper single export when I make a new passkey I'll store it there and later export it to Apple.

Meanwhile I simply make two passkeys. I've only run into I think two sites that supported passkeys but would not let me make two.

On most sites making a second passkey is as simply as going to your security settings, finding the passkey settings there, hitting the "add another passkey" link, and pointing your phone at the QR code it shows, and then on those phone choosing the password manager that you did not use for the first passkey.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#533

Post by nozzlegear »

fhdkweig wrote: post #236
nozzlegear wrote: post #222

Earlier quoted context omitted.

> * and with device attestation, they could be banned at any moment by any website with no recourse.* Isn't this true of any authentication method? It doesn't seem unique to Passkeys.

Now that I think about it, you are right. But if they could ban my use of written passwords as easily as banning my use of a particular passkey device, why go through all the extra hoops to just be as vulnerable as before? This seems like a whole lot of extra work to do that gains me nothing.

I don't think the goal of passkeys was ever about making it easier to back them up or protecting you from websites that could ban you. I think (correct me if I'm wrong) the goal was always to make it nigh impossible for attackers to phish your credentials.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#534

Post by phs318u »

jesseendahl wrote: post #351
thewebguyd wrote: post #317

Earlier quoted context omitted.

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

> Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound If you watch the original Apple WWDC talk presenting passkeys, you will find that they were always intended to sync, at least for the consumer use-case. What you are describing is how the WebAuthn standard had been implemented by Yubico and Google up until the point of the introduction of “passkeys” by Apple.…

> the only possible way to compete with that UX is to sync the private key across the user’s devices

This is my issue with passkeys. Either we lessen security to improve UX (syncing across devices implies extracting private keys from secure enclaves, at which point it’s no different to password syncing), or we have a proliferation of different keys per website across devices (assuming the website supports multiple passkeys).

Perhaps this trade off is not resolvable in a way that happily satisfies both the security constraint and the UX requirement.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#535

Post by beAbU »

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

I store my passkeys in Bitwarden. Can you not do the same in LastPass?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#536

Post by aPoCoMiLogin »

datakan wrote: post #6

Passkeys are just SSH keys in how they work. We've been doing this since the 90's. The only people that use SSH keys are the Linux savvy users and those who are forced to via an enterprise solution for vaulting. The average person doesn't know anything about this stuff nor do they care. I also have yet to see a Passkey solution that didn't also have a password on it and a nice little box letting people choose to use…

this is false equivalency. in poland we have similar to passkey implementation in government issued application - mobywatel [0] that allows to login to government websites. in 2022 according to published data it had almost 9m installations [1] and a lot of them are old ppl, so its not like only neckbeards would know this ancient technology

sure there are some issues sometimes (outages and others), but most of the time they work like charm and solve a lot of issues with login+password issues.

- [0] https://play.google.com/store/apps/details?id=pl.nask.mobywa...

- [1] https://dane.gov.pl/en/dataset/2919/resource/43845,mobywatel...

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#537

Post by pseudalopex »

dfabulich wrote: post #49
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

> Passkeys are just passwords that require a password manager.

Passkeys are passwords which allow a relying party to control what password manager you can use.[1]

[1] https://news.ycombinator.com/item?id=46305566

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#538

Post by thewebguyd »

akdev1l wrote: post #504
jimbokun wrote: post #472

Earlier quoted context omitted.

Seems like the flow should be: 1. All passwords stored in password manager. 2. Login with password manager when logging in for the first time on a device. 3. Combination of OS and site/app notice that no passkey has been created for this account and offers to create one. This is presented to the user as “setting up the current device for password-less log ins.” 4. OS negotiates with site/app to install the passkey an…

By still having the password the user can still be attacked via phishing

The user can always be attacked via phishing so long as account recovery methods exist (and they need to exist for obvious reasons). Use passkeys, but so long as you can also log in via password, or SMS code, etc., it's phishable, you can get sim swapped.

Your master password to your cloud PW manager's vault is also phishable (hence why passkeys were ideally device specific, non-exportable).

Its phishing resistant not phishing proof

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#539

Post by Itoldmyselfso »

pseudalopex wrote: post #519
Itoldmyselfso wrote: post #466

Earlier quoted context omitted.

Passkey comprises of public key that the website you created it on holds, and the private key you store on your pw manager or in the TPM/secure element. As long as you can copy the private key to the new device, you don't need to recreate the whole passkey. In your case, you would just need access to a backup of the Keepass database in case you lose the device. The biggest point of confusion in my opinion comes from…

People who say users should not be able to export keys are not confused. They believe users should not be able to export keys.

I was referring to confusion experienced by people new to the passkeys creating passkeys for the first time ("Where am I saving this to?", "How do I store this in my password manager?").

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#540

Post by timmyc123 »

josteink wrote: post #65
SirFatty wrote: post #5

Earlier quoted context omitted.

That's if you're using Authenticator.

Clarification: Microsoft Authenticator. You can’t use any random password-manager with passkey support. I use Bitwarden for everything and have to have MS Authenticator installed just for this 1 login. Super annoying.

You can use any credential manager you choose for Microsoft Account passkey.
Post reply on HN