Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

801–810 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#801

Post by coffe2mug »

someguydave wrote: post #800
coffe2mug wrote: post #735

Earlier quoted context omitted.

Passkeys cannot be stolen. Yes, don't say that what if someone steals my iPhone, PIN, and adds their fingerprint. Let's say eBay asks user to login. With passkey. Press and hold fingerprint etc. login done. Even with laptop. And average Joe doesn't want to maintain a keepassdatabse sync it. Yes, you can always use your own server etc but others have life.

Hiding the underlying exchange of data from the user does not mean the data is unstealable

With your logic nothing is unstealable. Go and watch film inception.

The main point is the average Joe it works seamless. And average Joe won't have to remember things.

Yes, it does. Not everyone wants to maintain password database.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#802

Post by coffe2mug »

inigyou wrote: post #792
coffe2mug wrote: post #744

Earlier quoted context omitted.

Buy a new iPhone. Sign into it. Everything is now available. That is the reason: for the average Joe not having exportable passkeys is good. Average Joe doesn't have to do backup. It is all automatic.

So I just have to get the victim to sign into my iPhone?

Yes. If you are such a person then do it.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#804

Post by vinay_ys »

NetMageSCW wrote: post #321
vinay_ys wrote: post #183

Earlier quoted context omitted.

They should buy a Yubikey (a physical key) and keep their passkeys resident on that. Then they can truly keep that physical key locked up in their safe. And it is truly safer than their physical notebook because they are safe from being tricked into entering their password in the wrong place.

How do they tell their significant other how to logon to a shared account when they aren’t together? How do they use the Yubikey with their phone, laptop and tablet conveniently?

Their partner can use the same key. or they also register their own yubikey and keep it safe elsewhere.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#805

Post by inquirerGeneral »

jjav wrote: post #695
thewebguyd wrote: post #317

Earlier quoted context omitted.

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

> supposed to be device-bound Device bound is horribly broken idea. Credentials must be me-bound, so I and only me fully own and control the credential. I want to access the site from wherever I want to access it.

[dead]

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#806

Post by inquirerGeneral »

thewebguyd wrote: post #344
TitaRusell wrote: post #336

Earlier quoted context omitted.

This is exactly all the stuff normal people don't care about. If your system requires any basic intelligence or interest scrap it and go back to the drawing board because you just lost your customers.

I mean, no one ever said it was a good design. But the original FIDO2 standard wasn't made with consumers in mind in the first place, it was driven by enterprises that wanted high-assurance security. It works in that environment because, well, a big IT department controls it, can support the employees, and you can mandate and control its use. It was just sort of haphazardly shoehorned onto general users/consumers, pr…

[dead]

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#807

Post by Slackwise »

epistasis wrote: post #455
Slackwise wrote: post #446

I recently logged into my CVS.com account after not touching it for years, and I couldn't find the password reset..... turns out they no longer use passwords at all; only Passkeys and tokens via email/SMS. Aside from email accounts potentially being compromised or SMS interception, this is honestly the way all sites should be going now. But more seriously, there should be a way to use only Passkeys with a backup iden…

I agree with your anti-password take, 100%. But all my passkeys have biometrics attached to them, mostly so that I know that they are being used, when they are being used. Silent release of authentication credentials is a scary security mode. A YubiKey with a press mechanism is enough, I just happened to buy the biometric version. Or use the biometric lock on iCloud Keychain passkeys.

I was trying to say, nobody should be using Passkeys via browsers because they all fail to secure them. You need a password manager of some sort. But this is also true of passwords. My ultimate point was, passwords are a burden because unless you use a password manager and unique passwords for every single account, then passwords are strictly a burden. The average user doesn't use a password manager outside of the junk in Chrome, so... they're really just creating a security disaster for themselves.

So, therefore: passwords shouldn't exist, and you should create sessions via email links/tokens. Then also offer Passkeys as a faster login.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#808

Post by [deleted] »

coffe2mug wrote: post #801
someguydave wrote: post #800

Earlier quoted context omitted.

Hiding the underlying exchange of data from the user does not mean the data is unstealable

With your logic nothing is unstealable. Go and watch film inception. The main point is the average Joe it works seamless. And average Joe won't have to remember things. Yes, it does. Not everyone wants to maintain password database.

[deleted]

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#809

Post by zdp7 »

samrus wrote: post #798
zdp7 wrote: post #768

Earlier quoted context omitted.

1) Install a keepass client and use it for passkeys. 2) See #1 3) See #1 KeepassXC supports passkeys. They suggest a couple mobile apps that also do.

How easy is it to switch off keepass? And how easy is it to export off whatever you imported to? Passwords are simple, just remember the text. Passkeys have alot of uncertainty around this

To switch off, just stop using Keepass. If you want want delete the entry on the site. You don't need to, since your Keepass file should be secure and passkeys are designed allow multiple for a site. Passwords are not equal to passkeys and not difficult to add. Everyone seems to think you need to create new passkeys for all your websites. You don't, add them as you go. The hassle of adding it should be less than using a password to login.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#810

Post by selicos »

eigenspace wrote: post #432
preisschild wrote: post #326

Earlier quoted context omitted.

You can choose either if your password manager supporte Passkeys

Of course. I was just pointing out that their claim about the lack of portability across devices was untrue.

On my PC I don't have a manager set up. The browser has the passkey saved, if I accidentally set one up by mistake, but it's not accessible on my other devices.

How do I log in to my account if I don't have the specific device the account exists on?

Post reply on HN