Passkeys were invented by engineers with zero understanding of consumer brain • Hacker News Board

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#761

Post by packetlost » Thu, Jul 23, 2026, 3:07 PM UTC

ivlad wrote: post #647

packetlost wrote: post #612

Earlier quoted context omitted.

> Unfortunately, the designers of passkeys decided they should replace passwords and usernames and second factors. They obviate the need for a user identifier as the key is itself unique, but removing the 2nd factor is a choice of the service, not the designers of the Webauthn standard. > Also they decided they should be cloud-synchronised The earlier versions of the spec required that the keys be resident in hardwar…

> The important part is it's up to the service to decide on whether they want to require hardware resident keys (which cannot be synced via the cloud). From what I know, Apple ignores `platform` and `ResidentKeyRequirement` claims and always creates cloud-synced key pairs. Moreover, the strongest claim value allowed for the `ResidentKeyRequirement` is “discouraged”, which per spec is treated as SHOULD in RFC 2119 sin…

Sure, but you can still use a Titan T3 or recent Yubikey model on an iPhone. If I had the threat model to justify it, I would not set up the passkey in Apple's infrastructure.

It is too bad they ignore that though. That's really disappointing.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#762

Post by 7402 » Thu, Jul 23, 2026, 3:11 PM UTC

no-name-here wrote: post #180

lelandbatey wrote: post #114

Earlier quoted context omitted.

> This makes it impossible to copy and paste your passkey to the wrong person (someone trying to trick you). It also, unfortunately, means it's not possible (via most passkey implementations) to back those passkeys up to paper. Which is quite unfortunate: backing up to paper is one of the most stable and human accessible ways of ensuring redundancy and continuity, an inevitable but also oft-ignored part of credential…

> back those passkeys up to paper Is writing down passwords something people do? I have countless passwords saved over >20 years and I don’t think I’ve ever recorded one to paper. I even checked a couple of popular password management solutions and they don’t seem to have “print” functionality.

Yes:

  Paranoid password printing with a Raspberry Pi
  https://7402.org/blog/2020/paranoid-password-printing-pi.html

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#763

Post by lazide » Thu, Jul 23, 2026, 3:52 PM UTC

thewebguyd wrote: post #317

thecombjelly wrote: post #217

Earlier quoted context omitted.

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

Except I literally never want to have auth tied to a device. That’s ridiculous.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#764

Post by lazide » Thu, Jul 23, 2026, 3:53 PM UTC

TeMPOraL wrote: post #750

phs318u wrote: post #534

Earlier quoted context omitted.

> the only possible way to compete with that UX is to sync the private key across the user’s devices This is my issue with passkeys. Either we lessen security to improve UX (syncing across devices implies extracting private keys from secure enclaves, at which point it’s no different to password syncing), or we have a proliferation of different keys per website across devices (assuming the website supports multiple pa…

It's still ignoring one of the main features of passwords for regular people, which is authority delegation via password sharing , aka. "could you please log in to my ${service} and do ${something}, my password is ${password}...". Yes, that is a feature and a normal use case that has equivalents in meat space, that security aficionados refuse to recognize even exists, much less support.

Not only that, they don’t need to worry if they lose their phone they’re locked out of their accounts too!

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#765

Post by zdp7 » Thu, Jul 23, 2026, 4:05 PM UTC

fhdkweig wrote: post #433

fhdkweig wrote: post #236

Earlier quoted context omitted.

Now that I think about it, you are right. But if they could ban my use of written passwords as easily as banning my use of a particular passkey device, why go through all the extra hoops to just be as vulnerable as before? This seems like a whole lot of extra work to do that gains me nothing.

I think it is important to explain why I and others are so reluctant to this. In security, you identify reasonable threats. You can't protect against all of them, and some may even be contradictory. When I get a call on my phone that says "Potential Spam", I have never even once in my life decided to run over to my list of passwords and hand them over to the President of the Spanish National Lottery. Not even once. B…

You aren't considering all the advantages of passkeys.

Passkeys only work on the domain they were created for. Password managers usually default to providing the password of the current website, but nothing stops you from pasting that in at any site.

There is no danger to the credential db being stolen. The website only has your public key.

A website using passkeys can support cross device authentication which allows you to login to on a computer without it ever seeing your credentials.

I'm sure that isn't a complete list. My last point, despite all the comments here, there is no vendor lock in. Bitwarden provides an open source self hostable option. On both Android and Windows 11, you can change your passkey provider to Bitwarden. A proper passkey implementation, should allow multiple passkeys to provide access. My bank does exactly that.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#766

Post by duskdozer » Thu, Jul 23, 2026, 4:07 PM UTC

mlfreeman wrote: post #743

duskdozer wrote: post #703

Earlier quoted context omitted.

>I proudly print my entire KDBX file including passkey private keys and I encourage my elderly parents to do so too. Do you mean you print the raw values to paper or some encoding that would let you reconstitute the file (some giant QR code or something?)?

I print a nice HTML document - each entry has each field/value in a HTML table and each group gets its own header. On macOS I use Strongbox's Print Database capability. On Windows, I'm testing a KeePass plugin I created that does the same thing and more (not quite ready for public release). If I'm still around and coherent, I can re-type it into a KDBX-supporting app by hand (or maybe if I'm lucky only enough entries…

>EDIT: My current printout is 46 pages long.

Wow. Roughly how many entries do you have and how do you handle updates? I'm often being asked to change passwords and of course create new login entries.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#767

Post by ptman » Thu, Jul 23, 2026, 4:24 PM UTC

inigyou wrote: post #642

mwwaters wrote: post #624

Earlier quoted context omitted.

The far bigger benefit is phishing resistance (with hardware-contained keys themselves being phishing-proof on a non-compromised system). It moves to the account recovery flows, but that can be much more difficult to phish.

Why would a key need to be "hardware-contained" to be difficult to phish? My SSH private key is unphishable and it's right there in a file. It's unphishable because I know there's never ever a reason to send it to someone - in a scenario where that would be needed, I'd generate a new key just for that situation.

Desktop operating systems don't have very good separation between programs. If some malware gets access, it will be looking for e.g. ssh keys and using a keylogger to get the passphrase if you encrypted your ssh keys. Tpm protected passkeys are much better protected

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#768

Post by zdp7 » Thu, Jul 23, 2026, 4:29 PM UTC

dotancohen wrote: post #373

thewebguyd wrote: post #317

Earlier quoted context omitted.

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey). I have just shy of 2000 site credentials in Keepass. Let's assume that they were all Passkeys. 1) When I buy a new device, how do I create 2000 new Passkeys for that device? 2) Can I still do that if I don't have access to the old device? Maybe it was destroyed…

1) Install a keepass client and use it for passkeys.

2) See #1

3) See #1

KeepassXC supports passkeys. They suggest a couple mobile apps that also do.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#769

Post by abustamam » Thu, Jul 23, 2026, 5:01 PM UTC

I signed into my Playstation account on a new phone. It told me to make a passkey. Its safe. So i said ok.

Later I tried to sign into my Playstation account on my computer and I couldn't. It said I needed to use my passkey.

I went back on my phone and deleted my passkey.

FWIW, Nintendo seems to have nailed the concept of passkey. I can sign in anywhere. If I'm on a new device, i just use my email password and 2FA.

I dont know why so many vendors find the need to complicate this. A secure solution implemented poorly can potentially be worse than an insecure solution.

One more anecdote on that front — I worked the help desk at a medical school during college. The IT department had their fun password requirements (number, special character, blood of a virgin, change every month, etc). Every single person who came to the help desk had their password written down on a sticky note on their laptops. These were med students , doctors, staff... everyone.

At some point these admins have to ask themselves whether they're actually helping people be more secure or if you're just making them jump through hoops.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#770

Post by tshaddox » Thu, Jul 23, 2026, 5:19 PM UTC

TeMPOraL wrote: post #755

tshaddox wrote: post #629

Earlier quoted context omitted.

That’s a fair point. My thinking was that, once you’re using a password manager, you’ll A) use it to generate random passwords that would be unwieldy to memorize and B) have passwords synced to all your devices such that you will never deal with the plain text password directly. Of course it is conceivable to want to directly access the plain text password for reasons you mention, although that would be exceedingly r…

> Of course it is conceivable to want to directly access the plain text password for reasons you mention, although that would be exceedingly rare (at least for me). It's a daily occurrence for me, because especially because of going through steps A) and B), step C) which is copy-paste is needed to actually transfer the unwieldy, unmemorizable password from the password manager that stores it, into the app that requir…

But that sounds like precisely what standardized passkey integration in the browser and website solves! This is honestly how I think about passkeys: they're a standard API for browsers and websites to integrate with password managers without needing a browser extension to manually look for and fill out text inputs on the page.