Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

611–620 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#611

Post by Telaneo »

crote wrote: post #570
richstokes wrote: post #427

Earlier quoted context omitted.

Device-bound would be a nightmare. I don’t want to have to think about different credential for phone vs. laptop, etc.

Easy: it's the token on your physical keyring, right next to your house key and car key.

I have 7 house keys and 2 car keys. Getting a new house key is a breeze and cheap, and even if I lose them all, a lock smith can make me whole again. Getting a new car key is a bit more expensive, but also largely not a hassle.

Having spare Yubikeys is more of a hassle than both of those (and more expensive!), and the worst case scenario of losing them all is much more catastrophic. If I have no house key, I still get into my house. If I have no car key, I still get into my car (after a fair bit of hassle). If I have no Yubikey, I have permanently lost access to the accounts it was tied to.

If physical hardware tokens were as cheap as house keys and not much more difficult to set up and copy, then it would be kind of reasonable. As it is, it's unworkable. Even password managers manage to make this work. You can throw your database on every storage device you have and write the master password down on paper, and the chances of you not being able to have access to it are pretty darn close to zero.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#612

Post by packetlost »

michaelt wrote: post #481
packetlost wrote: post #380

Earlier quoted context omitted.

> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey). This is a misconception. A particular service can choose to enforce those class of passkeys, but most don't need that and shouldn't. Passkeys are primarily meant to replace passwords and be hard (but not necessarily impossible) to exfiltrate. The key difference…

> Passkeys are primarily meant to replace passwords Unfortunately, the designers of passkeys decided they should replace passwords and usernames and second factors. Also they decided they should be cloud-synchronised, so the something-you-have second factor doesn't impose the burdensome requirement for you to have something, which was apparently a big usability problem.

> Unfortunately, the designers of passkeys decided they should replace passwords and usernames and second factors.

They obviate the need for a user identifier as the key is itself unique, but removing the 2nd factor is a choice of the service, not the designers of the Webauthn standard.

> Also they decided they should be cloud-synchronised

The earlier versions of the spec required that the keys be resident in hardware, but it was updated to allow "roaming" keys. The important part is it's up to the service to decide on whether they want to require hardware resident keys (which cannot be synced via the cloud). Most do not.

The usability problems are actually larger than that, see sibling comments for why. Passkeys, even when cloud synced, are still better than cloud synced passwords and still give the option of hardware backed keys for those whose threat model warrants it.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#613

Post by tgsovlerkhgsel »

Passkeys are a nightmare for techies that want to understand and manage their stuff. They were optimized for people who neither can nor want to understand, they just press the button that the screen tells them to press and live inside someone's closed ecosystem.

For that use case, they work fine, and they create enormous lock-in, because now moving out of that ecosystem breaks everything. One might argue that that means they're perfectly engineered for what they are meant to do...

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#614

Post by archargelod »

realityking wrote: post #468
xboxnolifes wrote: post #158

Earlier quoted context omitted.

So to login using a public PC, you need either USB access (and carry around your password manager) or you need to install the password manager on the PC to log into a website?

There’s a process to scan a QR code with your phone and your phone then authenticates with the passkey.

Discord has an option to login with qr code. And it's very often used maliciously to steal accounts.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#615

Post by xg15 »

sandeepkd wrote: post #118
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

I am an engineer and have some insights on the discussions and developments around it. ITS NOT SIMPLE AT ALL 1. The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing). 2. Majority of industry players shared the vision of a credential which is available across the platforms and browsers 3. The vision for collaboration never materialize…

> The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing).

Honest question: If the main issue is phishing, why wasn't something like Yubikey adopted more widely - or dongles, or the venerable chip cards we have since the 80s?

Everyone knows what a key is - I mean the thing you open doors with. Most people know the basic security implications as well as what to do if you lose one.

The simplest way to translate that to "electronic keys" would be a dongle or chip card - that lets a device use its identity as long as its plugged in, but is not physically locked to that device. A user can unplug it, take it home with them or plug it into a different device. What a user can't do is copy them, so the same phishing protections as with passkeys are provided.

But for some reason, this never caught on except for niche solutions. Instead, the industry is increasingly moving to systems where the keys are fused with the devices themselves, using TPMs or similar technologies that can't be removed from the device. Which gives you all the well-kniwn hassles if keys have to be moved or devices get lost or stolen.

But I don't understand why this is done.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#616

Post by [deleted] »

pseudalopex wrote: post #497
preisschild wrote: post #301

Earlier quoted context omitted.

> This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. This is not true. There are device bound passkeys where the private key is stored in a HSM (TPM2.0, Android SE, or apple SE) instead of a hosted service (iCloud, Bitwarden.com). You can just add multiple Passkeys to a single site to have another backup device should your other one be unavailable.

Just have the 2nd device when you create any account. But have it away from the 1st device always. Just update 10s or 100s of accounts for every new device. Just never use sites which allows 1 Passkey.

[deleted]

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#617

Post by winstonwinston »

raron wrote: post #598
winstonwinston wrote: post #541

Earlier quoted context omitted.

> How can I do that, if Passkeys are the only option to log in? It is not feasible to remove password login or some other recovery login method. > If I can just use a password to log into a website without Passkeys, then Passkey is useless and doesn't add any security benefit. It isn’t useless, point is you don’t get to type in your password on a device that has passkey generated already, or get phished on a fake web…

> It is not feasible to remove password login or some other recovery login method. Then passkeys doesn't provide any real value if you have other less secure recovery option. Let's say I have a bank account, going to the branch and doing an in person ID check is a valid recovery option, but nobody would want to do that just to log in from a new device. > It isn’t useless, point is you don’t get to type in your passwo…

Using strong password as you suggested is a solved problem for your use case, but that is not universal. Passkeys provide universal security for all.

Also PIN or biometrics verification to access passkey from device bound TPM or security enclave solved the problem you implied might happen, such as losing your device. How do you protect your password manager, if any?

> even those can have vulnerabilities.

We shouldn’t just give up because everything is inherently insecure.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#618

Post by mingus88 »

coldpie wrote: post #27
mingus88 wrote: post #20

Earlier quoted context omitted.

It’s really not that hard. Most of your devices are in the Apple ecosystem and when you are prompted to create a passphrase it will ask you to put it in your iCloud Keychain. Boom, now it is available across all of those This is how it will work for most people who don’t care about security and just casually use their devices. My boomer mom does this. It’s better than the notebook full of handwritten passwords she wa…

Proton Pass is on the official Passkey client naughty list[1]. I hope the services you log in to don't choose to ban it because of those big, scary X's. [1] https://passkeys.dev/docs/reference/known-issues/

If they do, oh well.

Passkeys are a convenience and as I stated above I always have a password as a fallback

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#619

Post by modeless »

cube00 wrote: post #604
modeless wrote: post #586

Earlier quoted context omitted.

> Basing your security decisions on "it'll never happen to me" because there are billions of other users who will get burnt first That's not my argument. My argument is that your evidence that Google is uniquely bad at locking people out of their accounts is not good evidence. A few stories in the news represents a beyond negligible fraction of billions of user accounts.

> A few stories in the news represents a beyond negligible fraction of billions of user accounts. https://support.google.com/accounts/threads?thread_filter=(c... How many times do you have to click "View more" to reach a post from last week? It's a problem. The repeated advice from the "diamond product experts" says it all: If you can't recover your account using Google's automated recovery process, the account is lo…

Those complaints aren't Google arbitrarily or maliciously locking accounts. They are mostly people who forgot their password and also simultaneously lost their sim card and phone number and recovery email and backup codes etc etc. Google provides excellent features to prevent this from happening and I have already taken advantage so that I won't simultaneously lose access to all my recovery options. You also have no way of knowing how many of those complaints are from scammers trying to compromise accounts, and if you think that isn't a gigantic problem in support forums you are fooling yourself.

You don't have any accurate data to support your suspicion that Google is worse than others, only anecdotes and vibes. The true source of your fear is a generalized mistrust of big tech relative to other institutions, which while common and popular these days is not a sentiment I share.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#620

Post by tzs »

juancn wrote: post #498
pas wrote: post #271

Earlier quoted context omitted.

it depends on which password manager you are using. if you use Google's then it gets backed up to your Google account. BitWarden, KeePassXC, and probably a bunch of other password managers have very thorough support for import-export, automatic/periodic backup, sync/merge, etc.

And that's a HUGE issue. SSH keys are easy to manage in comparison to PassKeys.

Are they easier to manage if you have a few hundred SSH keys?
Post reply on HN