Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

691–700 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#691

Post by FireInsight »

xg15 wrote: post #677
FireInsight wrote: post #431

Okay, I'm a tech nerd I admit it, but for my personal authentication life I find passkeys to make sense. All my passwords and SSH key are already in Bitwarden. When a site starts supporting passkeys, I add that to Bitwarden as well. Now, instead of logging in by auto-filling my username and password, I just press the passkey login button (that hopefully exists) and click on the Bitwarden popup to select the account.…

> Also, I've made one invite-only web app where single-use invite codes and passkeys are the only ways to log in. It was not too hard, it was fun, actually. And I get the peace of mind that account sharing is pretty much impossible were a bad actor able to get their hands on an invite, as is hacking other people's accounts. It also makes access to the app maximally unrecoverable if someone loses access to the passkey…

The userbase is so tiny they can just ask me or another admin for another invite code. No data is tied to the account that would be lost in the process.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#692

Post by account42 »

packetlost wrote: post #380
thewebguyd wrote: post #317

Earlier quoted context omitted.

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey). This is a misconception. A particular service can choose to enforce those class of passkeys, but most don't need that and shouldn't. Passkeys are primarily meant to replace passwords and be hard (but not necessarily impossible) to exfiltrate. The key difference…

> A particular service can choose to enforce those class of passkeys

And that's exactly why the technology should be rejected while we can. It's no business of a particular service how I use my devices.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#693

Post by spaqin »

reddalo wrote: post #60
programmertote wrote: post #19

Like some folks already commented here, even as someone who has been working in tech for 20+ years, I find Passkey confusing. I understand the key aspect in computer science term, but I don't know how to use it across devices. Another big worry is that if I tie that to a physical key, then I might lose it (because it's physical) and never get it back.

Exactly, I always refuse to add a passkey because I'm afraid I won't be able to easily login again. Also, I don't want to be locked in to a vendor.

Even if I have my Yubikey passkey that's with my house keys, it's annoying to go grab it and connect every time I need to access something. Enabling it on GitHub was a mistake...

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#694

Post by FireInsight »

ab71e5 wrote: post #550
FireInsight wrote: post #431

Okay, I'm a tech nerd I admit it, but for my personal authentication life I find passkeys to make sense. All my passwords and SSH key are already in Bitwarden. When a site starts supporting passkeys, I add that to Bitwarden as well. Now, instead of logging in by auto-filling my username and password, I just press the passkey login button (that hopefully exists) and click on the Bitwarden popup to select the account.…

So what do you use for TOTP? Also bitwarden?

Ente Auth. Obviously not Bitwarden, I don't even know why that's an option. Having your 1st and 2nd factors in the same place seems foolish. I used to use Aegis, which might technically be a bit more secure, but Ente is also on the PrivacyGuides recommendations list (https://www.privacyguides.org/en/multi-factor-authentication...), so I opted to use it for more peace of mind in case my phone breaks.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#695

Post by jjav »

thewebguyd wrote: post #317
thecombjelly wrote: post #217

Earlier quoted context omitted.

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

> supposed to be device-bound

Device bound is horribly broken idea. Credentials must be me-bound, so I and only me fully own and control the credential. I want to access the site from wherever I want to access it.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#696

Post by PennRobotics »

One of the dumbest auth workflows I experienced in recent times: My partner texts me, "Mom lost her phone somewhere in the zoo." I go to log into Google Find My Phone with her password. It sends a mandatory verification SMS... to the lost phone. (It was eventually found, no thanks to Alphabet.)

I would be much more comfortable with passkeys and 2FA if there was almost always the option to log in with just a password as long as an email gets sent to me (perhaps relevant that I have paid email, not Gmail) stating I logged in to site XYZ without 2FA. Not a "click button to confirm you want to log in" email, just a "hey this happened" email containing a Shaggy link, "It wasn't me." Bonus points if that site's account settings (e.g. 2FA) cannot be changed as long as I'm only logged in with a password[+].

The odds of me not having a device to receive the email at the same time someone guesses my password and causes rapid catastrophic damage[++]... I would need to be specifically targeted or unlucky beyond the normal expectations of unluckiness. (Much more likely: I'd occasionally discover which sites have bad security practices or that I need to be more resistant to social engineering or more careful in public spaces; guessing a long generated password in just a few attempts when the password is never shown on the screen would be impressive!)

I've lost count of the number of times I need to enter a password using a unknown machine, log into my Bitwarden server, copy/paste the necessary password, ... "okay now you'll see a popup on your Totally Breakable Losable Connectivity-Unreliable Android phone"

-----

[+]: account info can't be changed w/ only password... unless I provide some verification ranging from personally appearing at an office with ID for money-related accounts to verifying ownership from a backup email address for low-stakes accounts like bulletin boards.

[++]: short of guessing my Bitwarden master password, which is one of the carveouts for "always always 2FA" and "several alternative, secure backup login methods, at least one which does not require technology"

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#697

Post by preisschild »

junaru wrote: post #409
preisschild wrote: post #322

Earlier quoted context omitted.

You can use both hardware bound passkeys (where you may not even be able to read the secret so you probably would want to add multiple device passkeys to a site) or shared passkeys (where the private key can be synced through something like a cloud service across your devices, see Bitwarden, iCloud)

> hardware based Sounds good until you realise theres no way to transfer/back them up and you are limited to 100 [1] (previously 25?). Personally my password manager has almost 4x the entries so hardware passkey solutions are a joke leaving users with single option - upload their keychains to ms/apple/etc clouds where they can be requested by any gov under the sun for x reasons. [1] https://support.yubico.com/s/artic…

That limit is only for a certain Yubikey model, not for all hardware-based fido2 authenticators.

> upload their keychains to ms/apple/etc clouds where they can be requested by any gov under the sun for x reasons.

If a HSM module (TPM, Apple/Android Secure Enclave) is used the private key is impossible to extract (and upload to a cloud) anyways

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#698

Post by BetterThanSober »

thewebguyd wrote: post #317
thecombjelly wrote: post #217

Earlier quoted context omitted.

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

Device bound is a bad idea especially if in the future sites is designed to be fail secure, you might be able to recover your account but not your data. The provider will then have to take a negative PR risk for something they cannot do

People lose their device all the time, there's tons of horror story where people got locked out because they lost their sole method of 2FA and if there is a method to bypass that then it is inherently insecure

For the layman yeah it is probably enough

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#700

Post by junaru »

preisschild wrote: post #697
junaru wrote: post #409

Earlier quoted context omitted.

> hardware based Sounds good until you realise theres no way to transfer/back them up and you are limited to 100 [1] (previously 25?). Personally my password manager has almost 4x the entries so hardware passkey solutions are a joke leaving users with single option - upload their keychains to ms/apple/etc clouds where they can be requested by any gov under the sun for x reasons. [1] https://support.yubico.com/s/artic…

That limit is only for a certain Yubikey model, not for all hardware-based fido2 authenticators. > upload their keychains to ms/apple/etc clouds where they can be requested by any gov under the sun for x reasons. If a HSM module (TPM, Apple/Android Secure Enclave) is used the private key is impossible to extract (and upload to a cloud) anyways

> That limit is only for a certain Yubikey model, not for all hardware-based fido2 authenticators.

Do you know who offers more? I deliberately chose Yubikey as example as their limit was the highest. Others like Nitrokey etc. support even less.

Post reply on HN