Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

631–640 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#631

Post by [deleted] »

eigenspace wrote: post #285
selicos wrote: post #246

Earlier quoted context omitted.

A password manager let's me use my service specific credential from any device, securely and decentralized. Passkeys lock into a specific device and seem easy until you need to use another device. But instead of being a credential you own and control, across what could even be a local password manager, it's one password to everything. Maybe it is more secure than a regular password in some cases but it largely seems…

Passkeys do *not* do that. I use 1Password to manage my passkeys and they are all synced across all my authenticated devices where I installed 1Password.

[deleted]

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#632

Post by baby_souffle »

dfabulich wrote: post #453
baby_souffle wrote: post #379

Earlier quoted context omitted.

> On Android 17 (on Pixel) you can select the password service under Settings -> Passwords and passkeys -> Preferred service. I have this set to my password manager but I still can't _use_ the pass-keys in my password manager to sign in to most apps.

"Most" apps? So it works in some apps, but not others? Setting your preferred password/passkey manager on Android 17 to 1Password works fine in Chrome and Firefox to log in to any site, presenting passkeys managed in 1Password. It also works in all of Meta's native apps. (I'm pretty sure it works the same in Bitwarden.) Whatever issue you're having, it's not an inherent limitation of Android passkeys. It might be a b…

> Setting your preferred password/passkey manager on Android 17 to 1Password works fine in Chrome and Firefox to log in to any site, presenting passkeys managed in 1Password

I went to `github.com` in chrome (not my default browser) and firefox and tried to sign in with pass key. I never even got a prompt from 1password to unlock to use the pass key, just a "no pass keys available" message from what looks like the system UI.

When I go to passwords & passkeys, 1password is the only item listed under preferred service. Google shows up under additional services but I have the toggle set to off.

so yeah, I just auto-fill my username and password like it's 2018.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#634

Post by MBCook »

readread wrote: post #258
bombcar wrote: post #235

Earlier quoted context omitted.

The win for passkeys is login with faceID. That people actually use.

My usernames and passwords auto-fill with faceID already. Lots of forms even (somehow?) auto-submit after that, don't even have to press a button.

The forms don’t. The browser does. There’s a set of heuristics.

The problem with autofill is it doesn’t help if the person keeps screwing up their passwords, changing them, or ends up with 5 different passwords in the password manager for the same site.

All of which I’ve seen.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#635

Post by MBCook »

bombcar wrote: post #235
TSiege wrote: post #215

Earlier quoted context omitted.

I've yet to meet a non tech person irl who uses them. I went through the laborious process years ago setting my parents up with 1Password. They find passkeys very confusing addition. I have yet to see the massive UX win. If that were true I don't think we'd be having this conversation. Good UX becomes the natural state of things and we don't even notice. I've had trouble myself setting up passkeys correctly with my 1…

The win for passkeys is login with faceID. That people actually use.

There’s far more than that.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#636

Post by MBCook »

AlexandrB wrote: post #241
MBCook wrote: post #176

I will never understand how a small group of tech savvy people are heavily confused and against a simple and more secure system. You want anecdotes? Ok. I’ve had elderly adult relatives who aren’t good with their devices tell me unprompted they’re using them and like them when I mentioned the word out loud to myself using my phone around them. These are people who don’t know the difference between apps and the web. W…

My elderly mother accidentally created a passkey (in Chrome) for one of her accounts. Normally, I try to keep a copy of her accounts and passwords in case she forgets them so I can help her out. With the passkey, this is impossible. She doesn't know how she created one, she doesn't know what it is, and I don't know how to explain to her that if her PC dies I won't be able to help her log back into her account. I'm no…

Any decent password manager can handle all of those. Apple does. I’d expect the same of Chrome, Edge, Firefox and 1Password but don’t personally use any of them.

Why not just set yourself up to be able to access her password vault? Why is copying magic strings a better solution? You could have done that to get password access without passkeys existing. So they change nothing.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#637

Post by ivlad »

Itoldmyselfso wrote: post #539
pseudalopex wrote: post #519

Earlier quoted context omitted.

People who say users should not be able to export keys are not confused. They believe users should not be able to export keys.

I was referring to confusion experienced by people new to the passkeys creating passkeys for the first time ("Where am I saving this to?", "How do I store this in my password manager?").

You don’t. You don’t store anything at all.

On registration, a keypair is generated, then the private key is encrypted with the long-term key burned into your security key fob or hardware. The encrypted blob is sent to the server and stored there.

On authentication, after you enter your login, the server sends the encrypted blob and your security key tries to decrypt it with the long-term key it has. If it succeeds, it then request a challenge from the servers, signs it along with the server name and timestamp and sends back to the server. Server validates the signature and if it’s good, log you in.

Expanded: As long you as the user has the security key fob, you can login. You should have 2.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#638

Post by inigyou »

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

One time, before passkeys, I tried SMS 2FA since everyone was saying 2FA was the future, if you didn't have it you'd be hacked, so I set it up. Next day, phone is bootlooping. Had the recovery codes of course. This sort of thing happened to me three times before I said never again 2FA. It seems to be a device to lock you out of your accounts.

You know how many of my passworded accounts got hacked in my lifetime? Zero.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#639

Post by inigyou »

thecombjelly wrote: post #217
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

If a good idea falls apart when confronted with reality, it's a bad idea.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#640

Post by inigyou »

Ajedi32 wrote: post #559
phs318u wrote: post #534

Earlier quoted context omitted.

> the only possible way to compete with that UX is to sync the private key across the user’s devices This is my issue with passkeys. Either we lessen security to improve UX (syncing across devices implies extracting private keys from secure enclaves, at which point it’s no different to password syncing), or we have a proliferation of different keys per website across devices (assuming the website supports multiple pa…

"A better version of password syncing" is exactly what Passkeys are and ought to be. Just like passwords, but unphishable, unguessable, not reusable across sites, not vulnerable to data breaches, and with better UX. Stranding private keys in clone resistant secure enclaves has unacceptably bad UX for the average user, which is why very few implementations try to do that.

So just a password manager?
Post reply on HN