Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

651–660 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#651

Post by pishpash »

Someone1234 wrote: post #200
pishpash wrote: post #147

Earlier quoted context omitted.

It should have never been a cloud password manager play. It should be hardware device only, and tied to the device. One passkey on each hardware device.

Then most of us would never use it. That means either: - Only one specific device can ever login (bad). - It doesn't limit login to one specific device, therefore it does nothing. Linking Passkeys to a physical device was always DoA. At least not without a way to enroll every device you own, and strong recovery strategies. But considering how inconsistent every company's Passkey implementation is (inc. many that only…

Why? The "one device" can be something portable like a Yubikey-like USB key, or for that matter, a smart phone, because people are already forced to use phones to do authentication codes, so it is kind of assumed a phone is always with you. In fact there is an existing workflow for this, where you use the phone to scan a QR code and pass the challenge back.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#652

Post by porridgeraisin »

Ajedi32 wrote: post #225
malfist wrote: post #199

Earlier quoted context omitted.

This is not much simpler than they think it is. > But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices That's just wrong. I use android, my partner uses ios. If he creates the passkey in safari, it's not going to get synced over to my phone. And that's just the first of the family sharing passwords issues. Same person i…

> That's just wrong. I use android, my partner uses ios. If he creates the passkey in safari, it's not going to get synced over to my phone It would, if the people implementing it weren't all so obsessed with pushing their own platform-specific solutions over enabling open standards. LastPass works fine on Android, iOS, Mac, and Windows, but each one of those platforms defaults to saving passkeys in their own platfor…

But this is well established behaviour in the real world. That the passkey design doesn't take this into account only proves even more that it was designed in a vacuum.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#653

Post by choo-t »

crote wrote: post #561
phs318u wrote: post #534

Earlier quoted context omitted.

> the only possible way to compete with that UX is to sync the private key across the user’s devices This is my issue with passkeys. Either we lessen security to improve UX (syncing across devices implies extracting private keys from secure enclaves, at which point it’s no different to password syncing), or we have a proliferation of different keys per website across devices (assuming the website supports multiple pa…

> at which point it’s no different to password syncing You still get the phishing resistance, though!

Password managers prevent phishing as they check for the domain name before inputing the password.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#654

Post by dizhn »

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

I didn't know the answer to any of these either and don't have a hardware key (I thought this was required for a long time) but one day I just clicked add a passkey on a site and the Bitwarden extension picked up the flow and everything was ridiculously easy. Now I also do get how it works, having used it on a few sites. Highly recommend.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#655

Post by anticensor »

richstokes wrote: post #427
thewebguyd wrote: post #317

Earlier quoted context omitted.

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

Device-bound would be a nightmare. I don’t want to have to think about different credential for phone vs. laptop, etc.

It's not a nightmare, in fact different sessions of the same user could be used to grant different capability levels across sessions depending on the trust level.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#656

Post by raron »

winstonwinston wrote: post #617
raron wrote: post #598

Earlier quoted context omitted.

> It is not feasible to remove password login or some other recovery login method. Then passkeys doesn't provide any real value if you have other less secure recovery option. Let's say I have a bank account, going to the branch and doing an in person ID check is a valid recovery option, but nobody would want to do that just to log in from a new device. > It isn’t useless, point is you don’t get to type in your passwo…

Using strong password as you suggested is a solved problem for your use case, but that is not universal. Passkeys provide universal security for all. Also PIN or biometrics verification to access passkey from device bound TPM or security enclave solved the problem you implied might happen, such as losing your device. How do you protect your password manager, if any? > even those can have vulnerabilities. We shouldn’t…

> We shouldn’t just give up because everything is inherently insecure.

True, but no sane way to mass revoke Passkeys from stolen / lost device is just bad design.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#657

Post by vitorgrs »

Reddit_MLP2 wrote: post #187
jasode wrote: post #108

Earlier quoted context omitted.

>This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. The issue isn't what passkeys _are_ (e.g. explaining they are like public/private "ssh keys" and hoping that type of explanation ends the confusion). Instead, it's the workflow around passkeys. The websites show very confusing dialog popups and choices that a lot of normal people will not understand. This is…

sadly it seems like most of the banks I use still enforce antiquated password rules, no MFA and rely on stupid questions most of which can easily be guessed from public records.

That might change on the country. At least here in Brazil, all logins require some sorth of MFA.

This changes by banks, some send code to our phone number (thought WhatsApp or SMS), others send SMS+email + face ID. All of them require at least the face ID. Some biggest banks requires you to go to ATM to authorize app access. You insert your card, password and authorize there.

There's Mercado Pago, which supports passkeys and standard MFA too. So you can store on bitwarden even.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#658

Post by baybal2 »

dotancohen wrote: post #373
thewebguyd wrote: post #317

Earlier quoted context omitted.

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey). I have just shy of 2000 site credentials in Keepass. Let's assume that they were all Passkeys. 1) When I buy a new device, how do I create 2000 new Passkeys for that device? 2) Can I still do that if I don't have access to the old device? Maybe it was destroyed…

[dead]

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#659

Post by jesseendahl »

benlivengood wrote: post #623
jesseendahl wrote: post #351

Earlier quoted context omitted.

> Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound If you watch the original Apple WWDC talk presenting passkeys, you will find that they were always intended to sync, at least for the consumer use-case. What you are describing is how the WebAuthn standard had been implemented by Yubico and Google up until the point of the introduction of “passkeys” by Apple.…

> The reason passkeys have their own name and definition is because they are meant to be a phishing-resistant primary factor that competes with the UX of passwords. And a great usability trait of passwords is that they’re convenient to use across all your devices. With a technology involving public/private keypairs, the only possible way to compete with that UX is to sync the private key across the user’s devices. An…

I like it.

The high level UX of this idea feels very compelling to me as a "yes and" -- aka a world where vendors continue to offer end-to-end encrypted syncing within an ecosystem, but then this idea gets layered on to solve the cross-ecosystem problem. I think the trickiest part would be how to do it in a privacy-preserving way, but that's solvable.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#660

Post by [deleted] »

Ajedi32 wrote: post #559
phs318u wrote: post #534

Earlier quoted context omitted.

> the only possible way to compete with that UX is to sync the private key across the user’s devices This is my issue with passkeys. Either we lessen security to improve UX (syncing across devices implies extracting private keys from secure enclaves, at which point it’s no different to password syncing), or we have a proliferation of different keys per website across devices (assuming the website supports multiple pa…

"A better version of password syncing" is exactly what Passkeys are and ought to be. Just like passwords, but unphishable, unguessable, not reusable across sites, not vulnerable to data breaches, and with better UX. Stranding private keys in clone resistant secure enclaves has unacceptably bad UX for the average user, which is why very few implementations try to do that.

[deleted]
Post reply on HN