Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

581–590 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#581

Post by tialaramex »

thewebguyd wrote: post #338
Someone1234 wrote: post #200

Earlier quoted context omitted.

Then most of us would never use it. That means either: - Only one specific device can ever login (bad). - It doesn't limit login to one specific device, therefore it does nothing. Linking Passkeys to a physical device was always DoA. At least not without a way to enroll every device you own, and strong recovery strategies. But considering how inconsistent every company's Passkey implementation is (inc. many that only…

> Only one specific device can ever login That's entirely service dependent, and the standard doesn't mandate "Service must not allow multiple passkeys" > It doesn't limit login to one specific device, therefore it does nothing. It's not nothing. It provides an attestation that you the user are in physical possession of the device, and have passed the challenge to release the key form the TPM (biometrics, pin, someth…

> That's entirely service dependent, and the standard doesn't mandate "Service must not allow multiple passkeys"

In fact WebAuthn is explicit that you should allow multiple tokens. But every time I see an HN thread it has people who insist this doesn't work or at least isn't common. When asked for examples, if they give any answers...

1. Most often these are sites where you can't use this technology at all. They'll have TOTP or something and apparently "I don't know anything about this" == "I know everything there is to know about this topic" in the increasingly LLM-crazy world we inhabit.

2. Usually otherwise it's AWS. Which is pretty annoying, but it's one site. I have like a couple of dozen places where I use WebAuthn and in all of those two (or three, or in a few cases four) tokens are enrolled. I don't have an AWS account, my employer is a Microsoft-only shop in this respect.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#582

Post by bigyabai »

flumpcakes wrote: post #567

I can't believe these comments - passkeys are pretty easy to understand and most platforms allow you to add multiple. Not enough for truly one-passkey-per-device, but if you use a password manager that syncs passkeys, or hardware passkeys it's fine - it's easy, quick, and more secure than any password can ever be (mitm resistant). I think the confusion with passkeys comes from that fact that everyone wants to own you…

I have zero passkeys to my name. It's just not covering any serious attack surface in my life or anyone that I can think of.

If technically-motivated individuals can't be assed to switch away from passwords, then imagine how normies feel. I fully understand why most people choose passwords instead.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#583

Post by maxgashkov »

I do have love/hate relationship with passkeys.

Love: I truly have redundancy for most critical accounts, meaning I have 4 separate passkeys assigned, each not tied to one SPoF -- one in 1Password, one in iCloud -- both synced everywhere I logged in and if I'm ever banned/locked out of both of them somehow, I still have two additional USB keys (token2) as a fallback.

Hate: every fucking service seems to have different idea on how to implement them, whether to allow them as the only factor, how many to allow to have in any particular account.

On a separate note, for the hw side of things I'm kinda sad that old yubikey nano approach when the token is just sitting flush on the side of the laptop and I tap it occasionally is just dead, because every vendor moved to mandatory PIN to store passkeys on hardware tokens. I get the rationale but still.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#584

Post by crote »

dfabulich wrote: post #196
tetromino_ wrote: post #165

Earlier quoted context omitted.

> you can ask a bank teller to help you At virtually all banks, the bank tellers cannot help you with login problems. You will have to call the bank's tech support and somehow navigate AI-modulated phone menu hell.

Citation needed. Walk in with photo ID, a bank card, and your PIN, and all the major banks will send you a reset-password email.

Tried this, they weren't even able to verify my ID for KYC reasons. Had to go a second time after they blocked my account with zero warning. I have zero expectation that they will be able to help me with a password reset

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#585

Post by rufo »

thewebguyd wrote: post #128
rufo wrote: post #104

Earlier quoted context omitted.

I recognize the point of your post is more about the lack of clarity and details around passkeys. That's real, and I don't really have an answer for that - other than, I think maybe the quest for making them simple and "just work" has maybe made them nebulous enough that we've wound up in the current situation where a lot of even technically savvy people don't really understand them. But I feel like answering your qu…

> passkeys are intended to sync via your password manager of choice as the primary use case. The sync was actually a compromise to the standard. The idea was unique, device-bound credentials. One person, one device. The private key/passkey on your phone should not be the same one on your laptop, or your tablet, etc. Each device was supposed to have it' own unique credential. Allowing sync is a security downgrade to t…

Ooh, thanks for the insight, I didn’t realize that - though that makes sense given how they work. My initial reaction is, I like the idea of the pure hardware-locked passkey as you describe it, but I feel like the syncing is a reasonable-ish nod towards making them more usable in the real world since it does let you have more flexibility.

I haven’t ever looked at the APIs for passkeys; is there any semblance of those types of keys being an option, or did opening the door to syncing basically let anything happen with the APIs and lose those guarantees?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#586

Post by modeless »

cube00 wrote: post #464
modeless wrote: post #443

Earlier quoted context omitted.

This is very far from the top of the list of risks I should be concerned about. Basing your security decisions on the frequency with which you hear about something bad happening in the news is not a wise strategy. You have to consider that the user base of Google accounts is in the billions.

> You have to consider that the user base of Google accounts is in the billions. Basing your security decisions on "it'll never happen to me" because there are billions of other users who will get burnt first is not a wise strategy either. Why take the chance when there are so many other alternatives that let you own your vault or at least companies that still have some semblance of a support team. Losing a decade of…

> Basing your security decisions on "it'll never happen to me" because there are billions of other users who will get burnt first

That's not my argument. My argument is that your evidence that Google is uniquely bad at locking people out of their accounts is not good evidence. A few stories in the news represents a beyond negligible fraction of billions of user accounts.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#587

Post by crote »

l11r wrote: post #395
JohnFen wrote: post #372

Earlier quoted context omitted.

> They are supposed to be mathematically non-exportable, device-bound. Which would make the whole scheme unworkable (at least for me).

I pair of hardware keys (Token2, Yubico, etc) has the benefits from both worlds.

Except enrollability. Got a new account? You need physical access to both tokens to enroll it. Got a new token? You'll have to individually enroll every website - provided they even support multiple tokens at all...

Yubikey tried to solve this, for obvious reasons. Their proposal was DOA.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#588

Post by dotancohen »

chews wrote: post #462
ilchalpenl wrote: post #396

Earlier quoted context omitted.

Apple's keychain or google password manager - can hold 2000 passkeys easily.

Dunno why the downvotes, if you're willing to trust Apple or Google this is a good method for passkey usage. because your touchID/faceid/opticalid auth gate the keyring's on either of these vendors your passkey works without having to migrate them. EDIT: Also ANY device that you add to your iCloud has access to the passkeys you've made... it's a dream for secure access.

What happens when the user decides to move to an Android device, or even is suspended from Apple for a suspected breach of the terms of service, or Apple decides to not support their country anymore? There are countless reasons to prefer to manage one's own access.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#589

Post by NicuCalcea »

rd07 wrote: post #577
NicuCalcea wrote: post #554

Earlier quoted context omitted.

You can sync your vault between devices, but what's the point if the clients on those devices don't support passkeys? As far as I know, no KeePass app on Android has mature passkey support. That's not even mentioning more niche cases, like what if I want to log into a website in a browser on my TV? The cool thing about passwords is that they work on any device. Also, remember when one of the maintainers of the passke…

KeepassDX has pretty good passkey support I think. At least, it works for me.

I'll give it another go, I found it buggy last time I checked, but that was a while ago.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#590

Post by OkayPhysicist »

SrslyJosh wrote: post #563
OkayPhysicist wrote: post #386

Earlier quoted context omitted.

The cabal of evil behind the passkey project actively have KeePassXC on their naughty list fore deigning to allow users to access their keys, and specifically included in the standard the means to discriminate between different passkey vault providers. It is the opposite of an open system, and cannot, under any circumstances, be trusted. Do not use passkeys, tell other people not to use passkeys, and make sure to not…

This is hard to understand without any references. Can you please share a relevant link or two?

Here's KeePassXC being threatened with blacklisting over granting users control over their own data:

https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

Here's the most readable reference to playing favorites on passkey vaults I could find from the FIDO Alliance (the previously mentioned 'cabal of evil').

See Section 2.2: "Validating FIDO UAF authenticator attestations against the configured authenticator metadata to ensure only trusted authenticators are registered for use. "

And Section 2.3: "Verify attestation assertions made by the FIDO UAF Authenticators to ensure the authenticator is authentic and trusted. Verification occurs using the attestation public key certificates distributed via authenticator metadata. "

https://fidoalliance.org/specs/fido-uaf-v1.2-ps-20201020/fid...

Basically, Relying Parties (the sites you are logging in to) are expected to allow/disallow certain passkey authenticators (the devices or software that hold your passkeys), based on registration and trusted lists. The FIDO Alliance can use entry into those trusted lists as a cudgel to force compliance with the standard. Effectively, the standard is that users must be locked into to proprietary ecosystems, unable to escape.

Post reply on HN