Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

731–740 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#731

Post by marysol5 »

account42 wrote: post #710
Reddit_MLP2 wrote: post #187

Earlier quoted context omitted.

sadly it seems like most of the banks I use still enforce antiquated password rules, no MFA and rely on stupid questions most of which can easily be guessed from public records.

Yet they still work and people generally don't have their accounts stolen. Why? Because security is more than technology. Stealing a bank account is illegal and you will be prosecuted for it.

hahahahahahahahahahahahahahahahahahahahahahahahahaha

Nobody hacks because that's illegal

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#732

Post by emmaexe »

xg15 wrote: post #718
emmaexe wrote: post #712

Earlier quoted context omitted.

There isn't one correct answer because all those things are implementation dependent. Passkeys just define how a website, browser and OS communicate logging you in between eachother. If someone in charge of making a website designs a bad login system on top of that you will get a bad experience. > Do I need a unique passkey per device? If you store it in the device itself (passkey isn't moveable) and not a password m…

> All these answers above depend on the login system being well designed. If the people writing the website don't let you register multiple passkeys or don't make it convenient to register a new one whenever you login on a new device, or don't offer the aforementioned Qr code login system or don't offer good account recovery - you will have a bad experience. But this is one of the points being discussed here. All of…

> Whereas with passwords, implementers don't have to do any of those choices, the basic implementation already supports all those usage scenarios.

Sure, in that sense the usability is better, but now we are dependent on the website makers to make choices on security (offer good 2fa, don't limit passwords to 8 characters and store it on an ancient mainframe, etc.) and even then the usability can take a hit if the website is ignorant of or actively hostile to password managers (breaking autofill and such). Neither system guarantees a good experience.

With my example I tried to paint what a good passkey system would look like for OP, I am aware that leaving the usability part up to the website will result in such a mix.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#733

Post by inigyou »

spaqin wrote: post #687
inigyou wrote: post #638

Earlier quoted context omitted.

One time, before passkeys, I tried SMS 2FA since everyone was saying 2FA was the future, if you didn't have it you'd be hacked, so I set it up. Next day, phone is bootlooping. Had the recovery codes of course. This sort of thing happened to me three times before I said never again 2FA. It seems to be a device to lock you out of your accounts. You know how many of my passworded accounts got hacked in my lifetime? Zero…

At least with an SMS 2FA, you can get the SIM card out and put it in another device. If you happen lose the SIM card, your phone operator will probably get you another with the same number once you identify yourself. With authenticator apps or yubikeys, if you lose them (or get a bootloop, or wipe your phone forgetting to back up everything first), there's no path of recovery at all.

Not if it's a prepaid eSIM

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#734

Post by kotaKat »

simoncion wrote: post #517
kotaKat wrote: post #141

Earlier quoted context omitted.

I still can't even get a physical key anywhere in person. You can certainly get phones just about anywhere, but you can't get any FIDO keys at brick and mortar, last I checked. Until I can tell Grandma to "go down to Walmart and ask the man at the electronics counter for a Yubikey", we still have a few issues. (No. Ordering online is *not* a valid option in this scenario. If I want to order a Yubikey to this address…

> Amazon won't deliver one to me for at least six days at the earliest, based on their rural delivery estimate. That sounds like an Amazon problem. For 40 USD, yubico.com says that it will deliver a shipment on the next business day to this rather rural house I see in the middle of Foothills Road in Newman Lake, Washington. Also: > Replacing a key is basically impossible. If you know that getting next-day delivery is…

> Newman Lake, Washington

You're 21 miles from Spokane. I'm over 120+ north from Syracuse, NY. That's not rural, not one iota. Our Walmart isn't even a Supercenter.

> "If you can reasonably afford it"

I mean, at nearly $40 for shipping and something like $40-50 a key, I'm not sure I can reasonably afford to buy more than one on the average blue collar American IT worker's wage of sub-$30 an hour. If you'd like, I can give you my CashApp for donation purposes?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#735

Post by coffe2mug »

inigyou wrote: post #709
jesseendahl wrote: post #662

Earlier quoted context omitted.

Passwords are still significantly less secure than passkeys even when using a password manager.

Why?

Passkeys cannot be stolen. Yes, don't say that what if someone steals my iPhone, PIN, and adds their fingerprint.

Let's say eBay asks user to login. With passkey. Press and hold fingerprint etc. login done. Even with laptop.

And average Joe doesn't want to maintain a keepassdatabse sync it. Yes, you can always use your own server etc but others have life.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#736

Post by coffe2mug »

Telaneo wrote: post #611
crote wrote: post #570

Earlier quoted context omitted.

Easy: it's the token on your physical keyring, right next to your house key and car key.

I have 7 house keys and 2 car keys. Getting a new house key is a breeze and cheap, and even if I lose them all, a lock smith can make me whole again. Getting a new car key is a bit more expensive, but also largely not a hassle. Having spare Yubikeys is more of a hassle than both of those (and more expensive!), and the worst case scenario of losing them all is much more catastrophic. If I have no house key, I still ge…

No one is forcing you. You can continue to use passwordmanager.

We are talking about the rest the people that want convenience.

In a way that is the reason passkeys synced with Google or Apple just work. No need of hardware keys.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#737

Post by account42 »

marysol5 wrote: post #731
account42 wrote: post #710

Earlier quoted context omitted.

Yet they still work and people generally don't have their accounts stolen. Why? Because security is more than technology. Stealing a bank account is illegal and you will be prosecuted for it.

hahahahahahahahahahahahahahahahahahahahahahahahahaha Nobody hacks because that's illegal

The optimum amount of hacks is not zero.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#738

Post by coffe2mug »

phs318u wrote: post #542
j0057 wrote: post #524

Earlier quoted context omitted.

In the Apple ecosystem, passkeys are stored in your iCloud, and access to the passkeys is device bound. So if I generate a passkey on a MacBook, I can then use it from my iPhone as well, because it's encrypted to all my hardware devices.

Replace the word passkey with password in your comment. What’s the benefit of passkeys again? If you’re not storing the actual private key in the Secure Enclave but only the “access to it” what’s changed from how Apple’s keychain already manages password syncing to iCloud? The only benefit (and it’s still a decent one) is that some random website breach can’t disclose your private key.

A random app cannot eat your passkey. Platform authentication ensures more safety. I am not an expert but definitely it does use secure enclave in some ways(maybe decryption).

UX usability is far better. With password and 2FA you have at least 2 steps. Here

Open the app: device like phone or laptop just asks your fingerprint or facial and done.

That is a great benefit for average Joe. Some one trying to scam remotely cannot access the account. The 89 year old grandma will say - I just give fingerprint. Done.

Yes, it won't cover all situations. Like if there is sim swap or bank employee does fraud.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#739

Post by coffe2mug »

fragmede wrote: post #272
jasode wrote: post #108

Earlier quoted context omitted.

>This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. The issue isn't what passkeys _are_ (e.g. explaining they are like public/private "ssh keys" and hoping that type of explanation ends the confusion). Instead, it's the workflow around passkeys. The websites show very confusing dialog popups and choices that a lot of normal people will not understand. This is…

So you're saying that if you're inside Apple's walled garden, it works really well! Hmm...

No one is convincing you need to use it. If it makes it makes other people's lives easy then ok

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#740

Post by coffe2mug »

baby_souffle wrote: post #379
fauigerzigerk wrote: post #323

Earlier quoted context omitted.

>I haven't yet found a way for a mobile app or web page to explicitly signal to the device that the passkey to be created should live in $password_manager and not whatever built-in/on-device key-store exists. On Android 17 (on Pixel) you can select the password service under Settings -> Passwords and passkeys -> Preferred service. If you have an alternative password manager installed, it will be listed there along wi…

> On Android 17 (on Pixel) you can select the password service under Settings -> Passwords and passkeys -> Preferred service. I have this set to my password manager but I still can't _use_ the pass-keys in my password manager to sign in to most apps.

https://f-droid.org/packages/de.noisruker.openPasskeyAuth

Use this then totally offline

Post reply on HN