Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

551–560 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#551

Post by fhdkweig »

nozzlegear wrote: post #530
fhdkweig wrote: post #433

Earlier quoted context omitted.

I think it is important to explain why I and others are so reluctant to this. In security, you identify reasonable threats. You can't protect against all of them, and some may even be contradictory. When I get a call on my phone that says "Potential Spam", I have never even once in my life decided to run over to my list of passwords and hand them over to the President of the Spanish National Lottery. Not even once. B…

It should go without saying that, while you've never given your passwords over to the President of the Spanish National Lottery, there people who do get duped into doing exactly that all the time.

I don't like the default option being to treat everyone like they are a moron. I don't like being treated like a moron.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#552

Post by thewebguyd »

jknoepfler wrote: post #510
thewebguyd wrote: post #317

Earlier quoted context omitted.

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

I do not want my identity to be device-bound. I want it to be me-bound.

That's self sovereign identity. But you still need someones that can issue those verifiable credentials, and we (as a global society) can't decide who that should be in the web of trust? Our banks? Governments? Schools? Doctors at time of birth?

Arguably, that's the only way forward. SSI is also nice because you get to fully control what you share and don't share (e.g., age verification, you get to only share "I am over 21" and no other information).

Passkeys were (are?) supposed to be just a password replacement though. That services are using them to replace a username AND a password AND 2FA is a problem that's turning the device into your identity, instead of keeping the identity as three parts (What you know, what you have, who you are (biometrics)). Now we've just turned the "something you have" into the entire identity stack.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#553

Post by nightski »

blochist wrote: post #417
ilchalpenl wrote: post #396

Earlier quoted context omitted.

Apple's keychain or google password manager - can hold 2000 passkeys easily.

Nothing in the post you're replying to is about "is 2000 passkeys storable", it's about "if I have 2000 passkeys and I need to move between an Apple device and an Android device, do I need to establish a second set of 2000 passkeys"?

No you don't. I use the same passkeys for all my devices sync'd with bitwarden.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#554

Post by NicuCalcea »

eigenspace wrote: post #439
ekjhgkejhgk wrote: post #332

Earlier quoted context omitted.

I refuse to be part of an "ecosystem".

KeepassXC is free, open source, and supports passkeys. You can locally store your encrypted password vault wherever you like, and transport it between devices using physical media if you like (or self host your own personal storage synchronization server and sync your passkeys between devices like that). No need to be a part of an 'ecosystem' to use a password manager or passkeys.

You can sync your vault between devices, but what's the point if the clients on those devices don't support passkeys? As far as I know, no KeePass app on Android has mature passkey support. That's not even mentioning more niche cases, like what if I want to log into a website in a browser on my TV? The cool thing about passwords is that they work on any device.

Also, remember when one of the maintainers of the passkey standard warned that KeePassXC users would get blocked by relying parties [0]? Would you allow tech companies to determine what password manager you are allowed to use?

0: https://news.ycombinator.com/item?id=39698502

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#555

Post by bcye »

jeroenhd wrote: post #501
OJFord wrote: post #369

Earlier quoted context omitted.

Ok but now do a service that doesn't support that, whether or not it might in the future 'become a pretty common pattern'.

On most websites logging in through QR codes works out of the box for passkeys. You usually click "log in with device" or something like that with every desktop OS. You scan the QR code, click the confirmation button, and you're signed in. It's part of the standard UI of normal operating systems. Might not work (well) if you're on an old computer without decent Bluetooth but everything has Bluetooth these days.

I don’t think this ever works with passkeys stored in pw managers though, only Face ID/whatever Android is doing?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#556

Post by crote »

dotancohen wrote: post #373
thewebguyd wrote: post #317

Earlier quoted context omitted.

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey). I have just shy of 2000 site credentials in Keepass. Let's assume that they were all Passkeys. 1) When I buy a new device, how do I create 2000 new Passkeys for that device? 2) Can I still do that if I don't have access to the old device? Maybe it was destroyed…

The original U2F tokens didn't suffer from this problem that much. It contained one secret, it relied on the website to store and return an opaque website-and-account-specific blob, which was decrypted by the token and used to sign the login request. It would be reasonably easy to expand this in a way where the server also stores a backup credential for use by your second/third/whatever hardware token, encrypted with an asymmetric key during the enrollment of the primary token.

But this went out of the window when some genius decided that usernames were too complicated, so Passkeys had to be discoverable, which means they have to be fully stored token-side. Which of course has the nice side benefit of essentially killing hardware tokens and forcing people into using their Android/iOS/Windows device for it.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#557

Post by krferriter »

phs318u wrote: post #542
j0057 wrote: post #524

Earlier quoted context omitted.

In the Apple ecosystem, passkeys are stored in your iCloud, and access to the passkeys is device bound. So if I generate a passkey on a MacBook, I can then use it from my iPhone as well, because it's encrypted to all my hardware devices.

Replace the word passkey with password in your comment. What’s the benefit of passkeys again? If you’re not storing the actual private key in the Secure Enclave but only the “access to it” what’s changed from how Apple’s keychain already manages password syncing to iCloud? The only benefit (and it’s still a decent one) is that some random website breach can’t disclose your private key.

A random website breach can't disclose your password either, assuming you use random high-entropy passwords and the website only stores a hash of it. I haven't really seen the benefit to passkeys over passwords. Pretty much everyone is using a password management service that securely syncs both passwords and passkeys across devices. In that context I don't see the difference.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#558

Post by [deleted] »

phs318u wrote: post #542
j0057 wrote: post #524

Earlier quoted context omitted.

In the Apple ecosystem, passkeys are stored in your iCloud, and access to the passkeys is device bound. So if I generate a passkey on a MacBook, I can then use it from my iPhone as well, because it's encrypted to all my hardware devices.

Replace the word passkey with password in your comment. What’s the benefit of passkeys again? If you’re not storing the actual private key in the Secure Enclave but only the “access to it” what’s changed from how Apple’s keychain already manages password syncing to iCloud? The only benefit (and it’s still a decent one) is that some random website breach can’t disclose your private key.

[deleted]

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#559

Post by Ajedi32 »

phs318u wrote: post #534
jesseendahl wrote: post #351

Earlier quoted context omitted.

> Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound If you watch the original Apple WWDC talk presenting passkeys, you will find that they were always intended to sync, at least for the consumer use-case. What you are describing is how the WebAuthn standard had been implemented by Yubico and Google up until the point of the introduction of “passkeys” by Apple.…

> the only possible way to compete with that UX is to sync the private key across the user’s devices This is my issue with passkeys. Either we lessen security to improve UX (syncing across devices implies extracting private keys from secure enclaves, at which point it’s no different to password syncing), or we have a proliferation of different keys per website across devices (assuming the website supports multiple pa…

"A better version of password syncing" is exactly what Passkeys are and ought to be. Just like passwords, but unphishable, unguessable, not reusable across sites, not vulnerable to data breaches, and with better UX.

Stranding private keys in clone resistant secure enclaves has unacceptably bad UX for the average user, which is why very few implementations try to do that.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#560

Post by crote »

nightski wrote: post #553
blochist wrote: post #417

Earlier quoted context omitted.

Nothing in the post you're replying to is about "is 2000 passkeys storable", it's about "if I have 2000 passkeys and I need to move between an Apple device and an Android device, do I need to establish a second set of 2000 passkeys"?

No you don't. I use the same passkeys for all my devices sync'd with bitwarden.

Exactly. Bitwarden, not the Apple/Google/Microsoft keychain. That's the problem.
Post reply on HN