Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

671–680 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#671

Post by thrixton »

Reddit_MLP2 wrote: post #187
jasode wrote: post #108

Earlier quoted context omitted.

>This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. The issue isn't what passkeys _are_ (e.g. explaining they are like public/private "ssh keys" and hoping that type of explanation ends the confusion). Instead, it's the workflow around passkeys. The websites show very confusing dialog popups and choices that a lot of normal people will not understand. This is…

sadly it seems like most of the banks I use still enforce antiquated password rules, no MFA and rely on stupid questions most of which can easily be guessed from public records.

No doubt preaching to the Choir here but I just generate a new pass phrase and store it in Bitwarden. If course for the non HN audience, much more confusing and dangerous.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#672

Post by xg15 »

christina97 wrote: post #185

It’s quite the opposite. Passkeys are phenomenal for a lot of consumers. Based on this thread, it’s the engineers who understand authentication in the first place and have their own system (eg password manager) that are confused. Consider a user in the Apple ecosystem: you are already conditioned to just do Touch ID or Face ID when asked. I was on Amazon the other day, it prompted randomly for “want to set up a passk…

Until you want to log in on a non-Apple device.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#673

Post by ilchalpenl »

dotancohen wrote: post #373
thewebguyd wrote: post #317

Earlier quoted context omitted.

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey). I have just shy of 2000 site credentials in Keepass. Let's assume that they were all Passkeys. 1) When I buy a new device, how do I create 2000 new Passkeys for that device? 2) Can I still do that if I don't have access to the old device? Maybe it was destroyed…

> Let's assume that they were all Passkeys.

Lets assume I put all the effort to explain.

I will give you a better example.

- Lets say you have a google account with pixel phone

- You are using it and added 1000 passkeys

- All are synced to your Google account

- Destroy and Get a new phone. Login to your google account with recovery code.

- All your passkeys are in your phone again.

There are plans in fidoalliance.org to make it portable. Pretty sure you are still not going to move to it.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#674

Post by xg15 »

eigenspace wrote: post #285
selicos wrote: post #246

Earlier quoted context omitted.

A password manager let's me use my service specific credential from any device, securely and decentralized. Passkeys lock into a specific device and seem easy until you need to use another device. But instead of being a credential you own and control, across what could even be a local password manager, it's one password to everything. Maybe it is more secure than a regular password in some cases but it largely seems…

Passkeys do *not* do that. I use 1Password to manage my passkeys and they are all synced across all my authenticated devices where I installed 1Password.

How do you move your passkey from Apple's keychain into the password manager?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#675

Post by YetAnotherNick »

thecombjelly wrote: post #217
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

How is it corrupted by vendors and password manager? Why is password manager being passkey so bad or do you believe password manager should have no role there?

How would it look if it wasn't corrupted?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#676

Post by izacus »

juancn wrote: post #203
izacus wrote: post #63

Earlier quoted context omitted.

You do the same as you do when you lose your SSH key. Restore from backup and move on with your life. Why is there so much misinformation nonsense around passkeys?

How? Where are they stored? Which password protects them? How do I back them up? How do you move them to another device? Can I print them out on paper as a last resort measure? Nobody fucking knows.

Why are you making stuff up? Of course people know where they're stored in password managers and how they're synced.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#677

Post by xg15 »

FireInsight wrote: post #431

Okay, I'm a tech nerd I admit it, but for my personal authentication life I find passkeys to make sense. All my passwords and SSH key are already in Bitwarden. When a site starts supporting passkeys, I add that to Bitwarden as well. Now, instead of logging in by auto-filling my username and password, I just press the passkey login button (that hopefully exists) and click on the Bitwarden popup to select the account.…

> Also, I've made one invite-only web app where single-use invite codes and passkeys are the only ways to log in. It was not too hard, it was fun, actually. And I get the peace of mind that account sharing is pretty much impossible were a bad actor able to get their hands on an invite, as is hacking other people's accounts.

It also makes access to the app maximally unrecoverable if someone loses access to the passkey...

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#678

Post by xg15 »

joshstrange wrote: post #291

My biggest issues with Passkeys is how inconsistently they are implemented and how opaque they attempt to be. I understand SSH keys, I've been using them for decades, I know where they live, I know how to secure them. Passkeys are murky as fuck. Is your PW manager supported? Do they sync? Where are they stored? How can I move to another PW manager if I want to in the future? Can I have more than 1 passkey per site? A…

> I _know_ some of you out there can answer some/all of the questions above but it's mostly on a per-site basis.

Yeah, there is a difference between something that is difficult to explain but ultimately explainable, and something where the correct answer is "it depends"...

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#679

Post by ilchalpenl »

gortok wrote: post #402
ilchalpenl wrote: post #266

Earlier quoted context omitted.

> Edit: One final consideration, my spouse and I share user/name passwords for some things (notably Pandora and our Amazon Prime account) since they don’t handle things like family logins well; how do both my wife and I use amazon or Pandora with passkeys? Do we each set up passkeys? How do I get her Pass if that’s not an option? Lets say it is a android phone. Open amazon app. login in the usual user/password + 2FA…

Thanks. One glaring issue I see is that right now police can’t ask you for your password in the USA (a violation of the right against self-incrimination). They can however get a search warrant for your device and your biometrics, and wouldn’t need your password if they can gain access through your pass key.

> I see is that right now police can’t ask you for your password in the USA (a violation of the right against self-incrimination).

Hope they don't see your HN post. It is visible even without login.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#680

Post by sandmn »

ilchalpenl wrote: post #673
dotancohen wrote: post #373

Earlier quoted context omitted.

> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey). I have just shy of 2000 site credentials in Keepass. Let's assume that they were all Passkeys. 1) When I buy a new device, how do I create 2000 new Passkeys for that device? 2) Can I still do that if I don't have access to the old device? Maybe it was destroyed…

> Let's assume that they were all Passkeys. Lets assume I put all the effort to explain. I will give you a better example. - Lets say you have a google account with pixel phone - You are using it and added 1000 passkeys - All are synced to your Google account - Destroy and Get a new phone. Login to your google account with recovery code. - All your passkeys are in your phone again. There are plans in fidoalliance.org…

It works fine until Google suddenly decides that your new device is not you and asks you to confirm login from previous device...
Post reply on HN