Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

751–760 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#751

Post by TeMPOraL »

crote wrote: post #561
phs318u wrote: post #534

Earlier quoted context omitted.

> the only possible way to compete with that UX is to sync the private key across the user’s devices This is my issue with passkeys. Either we lessen security to improve UX (syncing across devices implies extracting private keys from secure enclaves, at which point it’s no different to password syncing), or we have a proliferation of different keys per website across devices (assuming the website supports multiple pa…

> at which point it’s no different to password syncing You still get the phishing resistance, though!

Is the "phishing resistance" just inability to view and manage your own data? That's a bug, not a feature then.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#752

Post by Ajedi32 »

inigyou wrote: post #709
jesseendahl wrote: post #662

Earlier quoted context omitted.

Passwords are still significantly less secure than passkeys even when using a password manager.

Why?

Because as I just outlined, passwords, even when stored in a password manager, can be misused. (Phished, set to something weak/guessable, reused on multiple sites, leaked in a database breach, etc.)

Password managers make it easier to avoid those pitfalls, but passkeys make it nearly impossible to fall into them.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#753

Post by TeMPOraL »

thewebguyd wrote: post #552
jknoepfler wrote: post #510

Earlier quoted context omitted.

I do not want my identity to be device-bound. I want it to be me-bound.

That's self sovereign identity. But you still need someones that can issue those verifiable credentials, and we (as a global society) can't decide who that should be in the web of trust? Our banks? Governments? Schools? Doctors at time of birth? Arguably, that's the only way forward. SSI is also nice because you get to fully control what you share and don't share (e.g., age verification, you get to only share "I am o…

> we (as a global society) can't decide who that should be in the web of trust? Our banks? Governments? Schools? Doctors at time of birth?

Yes? I mean, that's what literally is there by default in every country. They're not either/or either, they're part of a chain.

Most importantly, none of that is device-bound. Or even person-bound. Which allows for delegation, which is a feature that cybersecurity people keep insisting is not real.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#754

Post by Ajedi32 »

porridgeraisin wrote: post #652
Ajedi32 wrote: post #225

Earlier quoted context omitted.

> That's just wrong. I use android, my partner uses ios. If he creates the passkey in safari, it's not going to get synced over to my phone It would, if the people implementing it weren't all so obsessed with pushing their own platform-specific solutions over enabling open standards. LastPass works fine on Android, iOS, Mac, and Windows, but each one of those platforms defaults to saving passkeys in their own platfor…

But this is well established behaviour in the real world. That the passkey design doesn't take this into account only proves even more that it was designed in a vacuum.

The passkey design does take this into account, it's only the implementations that don't.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#755

Post by TeMPOraL »

tshaddox wrote: post #629
rstuart4133 wrote: post #566

Earlier quoted context omitted.

> they're precisely the same difficulties people have moving from the paradigm of "memorizing or writing down all my passwords" to "using a password manager." Errr, no. You can transfer a password from one manager to another. Those very same password managers won't let you transfer a passkey they hold. And if you know the password, you can use it anywhere by just typing it in - no complex technology or protocols invo…

That’s a fair point. My thinking was that, once you’re using a password manager, you’ll A) use it to generate random passwords that would be unwieldy to memorize and B) have passwords synced to all your devices such that you will never deal with the plain text password directly. Of course it is conceivable to want to directly access the plain text password for reasons you mention, although that would be exceedingly r…

> Of course it is conceivable to want to directly access the plain text password for reasons you mention, although that would be exceedingly rare (at least for me).

It's a daily occurrence for me, because especially because of going through steps A) and B), step C) which is copy-paste is needed to actually transfer the unwieldy, unmemorizable password from the password manager that stores it, into the app that requires it, when the autofill service refuses to communicate between the two.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#756

Post by TeMPOraL »

dfabulich wrote: post #453
baby_souffle wrote: post #379

Earlier quoted context omitted.

> On Android 17 (on Pixel) you can select the password service under Settings -> Passwords and passkeys -> Preferred service. I have this set to my password manager but I still can't _use_ the pass-keys in my password manager to sign in to most apps.

"Most" apps? So it works in some apps, but not others? Setting your preferred password/passkey manager on Android 17 to 1Password works fine in Chrome and Firefox to log in to any site, presenting passkeys managed in 1Password. It also works in all of Meta's native apps. (I'm pretty sure it works the same in Bitwarden.) Whatever issue you're having, it's not an inherent limitation of Android passkeys. It might be a b…

> Setting your preferred password/passkey manager on Android 17

Which approximately no one is using yet. Maybe in two weeks, when the new Samsung flagships roll out, to two months, when they start updating current generation devices...

> to 1Password works fine in Chrome and Firefox to log in to any site, presenting passkeys managed in 1Password.

Perhaps. But does it work with System Web UI, which I imagine is Chrome but have no clue how it's accessed?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#757

Post by coffe2mug »

TeMPOraL wrote: post #751
crote wrote: post #561

Earlier quoted context omitted.

> at which point it’s no different to password syncing You still get the phishing resistance, though!

Is the "phishing resistance" just inability to view and manage your own data? That's a bug, not a feature then.

Downloading and keeping safe local data is a bug for others

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#758

Post by HackerThemAll »

Rather: passkeys are great, but the way Microsoft implemented them in their login flow it disastrous.

I store passkeys in a device-independent way, in KeePass using the great actively developed KeePassPasskey extension, because my threat model allows storing password and 2FA for the same site in the same place (or 1st factor when an account is passkey-only, i.e. passwordless). And I sync that between my primary computer and the phone.

I have backups of my KeePass database in a few places (that don't require a passkey to log in) so I am able to regain access to core services in case both my devices fail at the same time. Although it's easy to trap yourself in a circular dependency.

https://github.com/yusei36/KeePassPasskey/

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#759

Post by l11r »

crote wrote: post #587
l11r wrote: post #395

Earlier quoted context omitted.

I pair of hardware keys (Token2, Yubico, etc) has the benefits from both worlds.

Except enrollability. Got a new account? You need physical access to both tokens to enroll it. Got a new token? You'll have to individually enroll every website - provided they even support multiple tokens at all... Yubikey tried to solve this, for obvious reasons. Their proposal was DOA.

I believe it was DOA because it defeated the main idea of tokens.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#760

Post by chimeracoder »

crote wrote: post #556
dotancohen wrote: post #373

Earlier quoted context omitted.

> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey). I have just shy of 2000 site credentials in Keepass. Let's assume that they were all Passkeys. 1) When I buy a new device, how do I create 2000 new Passkeys for that device? 2) Can I still do that if I don't have access to the old device? Maybe it was destroyed…

The original U2F tokens didn't suffer from this problem that much. It contained one secret, it relied on the website to store and return an opaque website-and-account-specific blob, which was decrypted by the token and used to sign the login request. It would be reasonably easy to expand this in a way where the server also stores a backup credential for use by your second/third/whatever hardware token, encrypted with…

> But this went out of the window when some genius decided that usernames were too complicated, so Passkeys had to be discoverable, which means they have to be fully stored token-side. Which of course has the nice side benefit of essentially killing hardware tokens and forcing people into using their Android/iOS/Windows device for it.

This part of your comment is incorrect. Discoverable Webauthn absolutely can be used with hardware tokens like Yubikeys.

Post reply on HN