Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

681–690 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#681

Post by ilchalpenl »

sandmn wrote: post #680
ilchalpenl wrote: post #673

Earlier quoted context omitted.

> Let's assume that they were all Passkeys. Lets assume I put all the effort to explain. I will give you a better example. - Lets say you have a google account with pixel phone - You are using it and added 1000 passkeys - All are synced to your Google account - Destroy and Get a new phone. Login to your google account with recovery code. - All your passkeys are in your phone again. There are plans in fidoalliance.org…

It works fine until Google suddenly decides that your new device is not you and asks you to confirm login from previous device...

See.. the sad thing for doomsayers like you is that if even 1% of users were affected then there would be mass exodus from Gmail. It does not.

Yes, you don't use Gmail so it does not matter. You may be don't know. And often even average Joe some how has a oldphone or iPad that has oldgmail account there or logged into wife's phone or phone based SMS whatever.

it is ok to hate passkeys or google or love only self-hosted but let others do what they want.

I have been user of solokeys (since the first one) - only opensource hardware keys. works for me...

But if you go to the local highstreet then there are tons of people doing this screenrepair etc just to recover the account. Average Joe doesnot mind paying for that. Even will give the repair guy full password to transfer all data from old to new phone.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#682

Post by xg15 »

Another point I haven't seen discussed here yet: It's nice that Google or Apple or 1Password or whoever else can sync your passkeys to all your devices, but what happens if they ban you? It can happen for sometimes ridiculous reasons, as demonstrated by Google. Does that mean you instantly lose access to all passkeys as well?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#683

Post by jeroenhd »

bcye wrote: post #555
jeroenhd wrote: post #501

Earlier quoted context omitted.

On most websites logging in through QR codes works out of the box for passkeys. You usually click "log in with device" or something like that with every desktop OS. You scan the QR code, click the confirmation button, and you're signed in. It's part of the standard UI of normal operating systems. Might not work (well) if you're on an old computer without decent Bluetooth but everything has Bluetooth these days.

I don’t think this ever works with passkeys stored in pw managers though, only Face ID/whatever Android is doing?

It works perfectly for passkeys stored in Bitwarden on Android. Don't know what iOS is doing.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#684

Post by eviks »

boarsofcanada wrote: post #568
eviks wrote: post #548

Earlier quoted context omitted.

Would be helpful if you provided at least 1 example

https://www.aarp.org/personal-technology/passkeys-future/

If you don't understand how an article wasting more words on describing corporate alliances than on how things work, and the latter is needlessly repetitive while also wrong, you are likely to stay on that floor of befuddlement for a long time

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#685

Post by spaqin »

jesseendahl wrote: post #364
juancn wrote: post #21

Earlier quoted context omitted.

Same here, also what if I lose the device? I can safely write down a password on a piece of paper and keep it somewhere phyisically safe. Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.

>Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor. Most providers continue to offer email-based recovery in the case that the end-user loses access to their primary factor, regardless of whether the primary factor is a password or a passkey. And email based account recovery does not make the secur…

Hopefully your e-mail is not tied to the passkey that you just lost.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#686

Post by jeroenhd »

HelloUsername wrote: post #547
jeroenhd wrote: post #501

Earlier quoted context omitted.

On most websites logging in through QR codes works out of the box for passkeys. You usually click "log in with device" or something like that with every desktop OS. You scan the QR code, click the confirmation button, and you're signed in. It's part of the standard UI of normal operating systems. Might not work (well) if you're on an old computer without decent Bluetooth but everything has Bluetooth these days.

Why does a passkey need bluetooth? For what? Isn't that another vulnerability?

A "passkey" is a bunch of metadata and a public/private keypair. It doesn't do anything by itself, of course. A physical device, like a Yubikey or a Titan, doesn't have Bluetooth. For phones and tablets these keys do support NFC but that's a whole different story.

The Bluetooth connection is how your phone exchanges the key and authenticates you through the computer. In its most secure phone, the key never leaves the dedicated security hardware/trusted execution environment that protects your key from snooping, the same way you cannot get a physical U2F key to give you the private key bits.

You scan a QR code to set up the pairing/connection process (if you haven't already), then a Bluetooth Low Energy exchange happens. You confirm you want to sign in on your phone (so you don't get tricked into scanning a QR code), then the cryptography happens that authenticates you.

You can find the protocol here: https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-cl...

It should be noted that, at least on Android, any credential manager app will support this exchange. The passkeys in the Bitwarden app on my phone work just like the native Android key store when scanning a QR code, for instance, and other apps will also work. You can switch authenticator apps in the pop-up, or set a dialog in the Android settings if you want to switch the default.

Furthermore, there are also CTAP2 implementations for smartwatches (at least for Android smartwatches) that let you authenticate with a tap on the watch. That flow doesn't use a QR code for obvious reasons, you would need to manually connect your computer to the watch before it works. I believe https://github.com/fmeum/WearAuthn is the prime open source example of this feature.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#687

Post by spaqin »

inigyou wrote: post #638
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

One time, before passkeys, I tried SMS 2FA since everyone was saying 2FA was the future, if you didn't have it you'd be hacked, so I set it up. Next day, phone is bootlooping. Had the recovery codes of course. This sort of thing happened to me three times before I said never again 2FA. It seems to be a device to lock you out of your accounts. You know how many of my passworded accounts got hacked in my lifetime? Zero…

At least with an SMS 2FA, you can get the SIM card out and put it in another device. If you happen lose the SIM card, your phone operator will probably get you another with the same number once you identify yourself. With authenticator apps or yubikeys, if you lose them (or get a bootloop, or wipe your phone forgetting to back up everything first), there's no path of recovery at all.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#688

Post by account42 »

thewebguyd wrote: post #317
thecombjelly wrote: post #217

Earlier quoted context omitted.

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

Good. Device bound keys are a mistake.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#689

Post by omnifischer »

crote wrote: post #556
dotancohen wrote: post #373

Earlier quoted context omitted.

> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey). I have just shy of 2000 site credentials in Keepass. Let's assume that they were all Passkeys. 1) When I buy a new device, how do I create 2000 new Passkeys for that device? 2) Can I still do that if I don't have access to the old device? Maybe it was destroyed…

The original U2F tokens didn't suffer from this problem that much. It contained one secret, it relied on the website to store and return an opaque website-and-account-specific blob, which was decrypted by the token and used to sign the login request. It would be reasonably easy to expand this in a way where the server also stores a backup credential for use by your second/third/whatever hardware token, encrypted with…

This. I would have loved if this original u2f existed. Google has even removed this from their accounts.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#690

Post by account42 »

sandmn wrote: post #680
ilchalpenl wrote: post #673

Earlier quoted context omitted.

> Let's assume that they were all Passkeys. Lets assume I put all the effort to explain. I will give you a better example. - Lets say you have a google account with pixel phone - You are using it and added 1000 passkeys - All are synced to your Google account - Destroy and Get a new phone. Login to your google account with recovery code. - All your passkeys are in your phone again. There are plans in fidoalliance.org…

It works fine until Google suddenly decides that your new device is not you and asks you to confirm login from previous device...

Or until Google decides that you did a wrongthink and bans your account, including locking you out of your old phone.
Post reply on HN