Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

601–610 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#601

Post by pseudalopex »

ryandrake wrote: post #479
pas wrote: post #280

Earlier quoted context omitted.

use an open source password manager that supports them. as others mentioned, there's BitWarden (cross-platform, self-hostable), but if you want something simple there's KeePassXC (and you can put the store file on a dropbox shared folder)

I resent that I need a special app to "manage" them. I want to know where this key is on my filesystem so I can back it up and edit it myself, not have to use some app to access it. My ssh authorized_keys is just a text file. I can "manage" it with something as simple as vim. Maybe KeePassXC and BitWarden give you that simplicity, if so great!

KeepassXC gave users this choice. And was threatened to be blocked for it.[1]

[1] https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#602

Post by raron »

TheBicPen wrote: post #502
raron wrote: post #423

Earlier quoted context omitted.

I don't think that would work either. Let's say I have a new account and a single Passkey in the TPM of PC1. I want to log in from PC2, too. How can I do that? (I know there is some trickery with Bluetooth, but I haven't seen anything supporting it, and desktop PCs usually doesn't have Bluetooth connectivity.) AFAIK some browsers can do some magic to use a Passkey from your smartphone on a PC, but you need to log in…

Can these services not use the same fallback mechanism that already exists for non-passkey logins? i.e. an email with a 1-time code or similar. Yes that somewhat defeats the purpose of passkeys but that option is going to exist for a long time regardless of passkey adoption. If you don't want to downgrade security, how about requiring confirmation from another session that is already logged in using a passkey? e.g. Y…

That could work, but then the service needs to implement complex non standardized authentication mechanism outside of Passkeys. You will have 14 different services with 15 different options. I don't think that's really user-friendly.

Also it could be vulnerable to MFA fatigue attack, if people would constantly get new "confirm this login" popups, they would press anything to make it go away.

So you would need something that is explicitly initialized from a trusted session, then you need something to connect the trusted session to the new login. If you want that to be user friendly you need some short codes and can't rely on QR code / Bluetooth, or two-way interaction. And that brings up the phishing / MitM attacks again.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#603

Post by jhhh »

dfabulich wrote: post #49
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

I am not happy about a trade-off which involves me having to cede control of my digital identity to 'providers' who will not give me access to it, in exchange for maybe not getting phished. If passwords continue to exist for a long time then this entire exercise is pointless as they can still get phished. If passwords go away and we can only use passkeys then you're only entry point to any kind of digital account is through one of the designated providers. If you don't have a provider that spans all of your platforms then you're screwed or have to manage multiple pass keys which is also stupid. Even the current crop of online providers as you illustrated in your post are unsecure and unreliable. No thanks.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#604

Post by cube00 »

modeless wrote: post #586
cube00 wrote: post #464

Earlier quoted context omitted.

> You have to consider that the user base of Google accounts is in the billions. Basing your security decisions on "it'll never happen to me" because there are billions of other users who will get burnt first is not a wise strategy either. Why take the chance when there are so many other alternatives that let you own your vault or at least companies that still have some semblance of a support team. Losing a decade of…

> Basing your security decisions on "it'll never happen to me" because there are billions of other users who will get burnt first That's not my argument. My argument is that your evidence that Google is uniquely bad at locking people out of their accounts is not good evidence. A few stories in the news represents a beyond negligible fraction of billions of user accounts.

> A few stories in the news represents a beyond negligible fraction of billions of user accounts.

https://support.google.com/accounts/threads?thread_filter=(c...

How many times do you have to click "View more" to reach a post from last week? It's a problem.

The repeated advice from the "diamond product experts" says it all:

If you can't recover your account using Google's automated recovery process, the account is lost. [1]

Personally I thought I was OK because I had a recovery email set but what Google doesn't tell you is they outright refuse to even send a recovery email if you don't use a device, browser and same wifi they've seen before. [2]. At the time I was all in on Gmail so it was an especially sobering experience.

I accept it's a hard problem to protect that many accounts, but to dismiss it as a "few stories" is understating the problem and diminishes the terrifying experience all these users are having.

[1]: https://support.google.com/accounts/thread/453660883/locked-...

[2]: https://www.reddit.com/r/GoogleSupport/comments/1ps28fn/coul...

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#605

Post by ryandrake »

pseudalopex wrote: post #601
ryandrake wrote: post #479

Earlier quoted context omitted.

I resent that I need a special app to "manage" them. I want to know where this key is on my filesystem so I can back it up and edit it myself, not have to use some app to access it. My ssh authorized_keys is just a text file. I can "manage" it with something as simple as vim. Maybe KeePassXC and BitWarden give you that simplicity, if so great!

KeepassXC gave users this choice. And was threatened to be blocked for it.[1] [1] https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

Yuck. Look closely at the wording: He is trying to counter a "user choice" feature by saying it doesn't have "protection". "File protection." "Protection of the key." Protection from who? From the user, that's who!

This mentality that the user is an attacker, and the software must protect its data from the user. Isn't a passkey ultimately supposed to be my data?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#606

Post by bigyabai »

boarsofcanada wrote: post #568
eviks wrote: post #548

Earlier quoted context omitted.

Would be helpful if you provided at least 1 example

https://www.aarp.org/personal-technology/passkeys-future/

I pity the grandpa that has to read all of this and determine if Passkeys are right for them:

> According to Google, you’ll need the following to sign in with a passkey:

> A laptop or desktop that runs Windows 10, macOS Ventura or ChromeOS 109 or later

> A mobile device that runs iOS 16 or Android 9 or later

> A hardware security key that supports the FIDO2 protocol

> Google adds that your computer or mobile device will also need a supported browser, including Chrome 109, Edge 109 or Safari 16 or later.

> [...] Do not create a passkey for a shared device if you don’t want other users to access your account, Google warns.

So much information, so many warnings. I feel nostalgic for passwords just sifting through this stuff.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#607

Post by Lammy »

thewebguyd wrote: post #317
thecombjelly wrote: post #217

Earlier quoted context omitted.

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

I don't want my computer to be able to decide I'm not allowed to access something. I'll never use these.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#608

Post by rustcleaner »

NetMageSCW wrote: post #307
account42 wrote: post #9

Earlier quoted context omitted.

SMS 2FA was also optional everywhere until it wasn't.

It is still optional most places.

Not for Chase, not for Schwab, not for my DOCSIS provider, not for my cellular provider, etc. They don't offer TOTP either, just SMS for 2FA.

It's going to require a law: if you require 2FA, then TOTP or HOTP must be offered as an option.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#609

Post by kuekacang »

Marsymars wrote: post #150
dfabulich wrote: post #124

Earlier quoted context omitted.

I don't think you're giving those seniors good advice. When the banks ask people to "switch" to passkeys, they're not removing the passwords; they're adding passkeys as an alternate login mechanism. If you lose your bank passkey, (e.g. if you put it in the wrong password manager and you can't figure out where it is) you can just sign in with your bank password. In the worst case, banks actually don't make it very har…

> In the worst case, banks actually don't make it very hard for seniors to reset your password/passkey; just show up at a branch with photo ID, your bank card, and your PIN, and a teller will help you reset your credentials. They do it all the time. Maybe... I just ran into an annoying scenario where the largest bank in Canada made an administrative error where they mislinked an account belonging to me to my wife's p…

With advent of ai-based impersonation, I wonder why in-person reset is not the priority right now

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#610

Post by rustcleaner »

I don't need your stinkin' passkeys! I have KeePassXC on Qubes OS and KeePassDX on GrapheneOS. No I will not buy into your proprietary cloud prison, with FISA/NSA/court-order backdoor access to my data! No I will not rely on KeePassXC/DX for storing them, when I can wake up tomorrow and find the paternalistic tyrants who maintain the provider attestation/trust lists have blacklisted my KeePasses! TOTP/HOTP-everywhere is a much better idea than freakin' passkeys! We need a law that forces any service provider that requires (hell, even offers) SMS 2FA to also offer TOTP or HOTP as additional options to substitute for SMS!

Whoever makes these boneheaded decisions (SMS 2FA only, hardware/cloud passkeys only) should not be allowed around engineering authentication for the public!

Yeah, I went there! Back off! Get off your high horses and eat some humble pie!

Post reply on HN