Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

311–320 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#311

Post by voxic11 »

Tarq0n wrote: post #67
rsyring wrote: post #37

FWIW: I find passkeys to be a very simple and easy to use concept. Simple: it's like a password that I don't have to type in Easy to use: because I use 1Password and just have it installed on everything. On Android, it can be set as the default passkey provider so, even on mobile, I am using passkeys shared across devices. Is this "less secure" because I'm sharing the keys through 1Password. I suppose, at some level.…

OK now say you're on a work/library/friend's computer and you want to look up an account in 1password on your phone so you can type in the password. Passkeys don't support this very basic and common workflow. Meanwhile there's no real security benefit over password manager generated complex and not reused passwords.

I use a passkey with discord on my phone. If I want to log in to discord on a computer it shows a QR code on the page/desktop app and I scan it with my phone to log in. I could see this become a pretty common pattern.

I like it because I can use discord on even a pretty untrusted computer without providing it any credentials or access to my passkey, and then later when I'm done I can revoke the session.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#312

Post by johngalt »

If you want a consistent, and seamless authentication experience, then one party has to own that experience. Go federation/SSO. Sign into everything with microsoft, or google as your identity provider, and live with the privacy implications.

Passkeys are great, and they take a significant amount of work away from the user, and make them much less prone to phishing attacks while also not turning their entire online identity into the property of google. I've had much more luck with onboarding non-technical people into a yubikey vs a password manager. Platform authenticators tend to trip people up. However, the process of adding a new key is getting much more consistent, and legible to people over time, and things will settle on platform authenticators rather than external physical keys for most use cases.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#313

Post by NetMageSCW »

usernametaken29 wrote: post #113
RHSeeger wrote: post #99

Earlier quoted context omitted.

> Once you’re in Apple universe And there's your blocker. Being limited to only devices from a single vendor is horrible, and a firm no from a lot of people. > Now we can put on the tinfoil hat and say how this fosters vendor lock The fact that you call it a tinfoil hat type issue is just insane to me. Literally every person in my household has some apple devices and some other ones (android, windows, etc). And some…

I literally presented you with the solution in the sentence before. Buy a usb c dongle key. You pay 20 euros to NEVER have to remember a single password ever again. Seems like an ok trade off to me. Likewise you can register multiple passkeys for multiple devices, so long as you do it in sequence (first Apple, then Android) etc. Really it takes very little getting used to. Ever tried to fill out a crap password form…

How does that USB-C dongle work on my corporate computer that has USB blocked? How does it work with my iPhone or my iPad or my Kindle?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#314

Post by AJRF »

I keep seeing people working on Passkeys get real defensive when told they don't make sense to people.

I've worked in tech 12+ years and I _hate_ when a Passkey prompt comes up, its only ever slowed me down.

But the devs who work on them are quite rabid, and keep dismissing real criticism of their implementation.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#315

Post by thyristan »

ectoloph wrote: post #119

Passkeys are a mitigation against users being bad at password hygiene and phishing being a real issue to users. You can't phish a passkey, and you don't rely on the user providing you 'hunter2' on every site. As for vendor lock in? No. The specs are open. You can run the code on a microcontroller, or, you can keep it in your arm with something like the Vivokey Apex. Note that the FIDO2 for the Apex is an open source…

> As for vendor lock in? No. The specs are open. You can run the code on a microcontroller, or, you can keep it in your arm with something like the Vivokey Apex. Note that the FIDO2 for the Apex is an open source Javacard applet.

That is not true. Passkeys support device attestation, enabling websites to lock you out if you don't use their approved devices. Which is happening with all the big platforms right now.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#316

Post by andy99 »

Marsymars wrote: post #150
dfabulich wrote: post #124

Earlier quoted context omitted.

I don't think you're giving those seniors good advice. When the banks ask people to "switch" to passkeys, they're not removing the passwords; they're adding passkeys as an alternate login mechanism. If you lose your bank passkey, (e.g. if you put it in the wrong password manager and you can't figure out where it is) you can just sign in with your bank password. In the worst case, banks actually don't make it very har…

> In the worst case, banks actually don't make it very hard for seniors to reset your password/passkey; just show up at a branch with photo ID, your bank card, and your PIN, and a teller will help you reset your credentials. They do it all the time. Maybe... I just ran into an annoying scenario where the largest bank in Canada made an administrative error where they mislinked an account belonging to me to my wife's p…

This is more a statement of how awful Canadian banks are than anything else. For anyone unaware we have an oligopoly of five identical banks all of which treat their customers like shit and effectively extract tax from the Canadian population while providing nothing.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#317

Post by thewebguyd »

thecombjelly wrote: post #217
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

> It seems like everyone wants to be _the_ password manager for all your passkeys.

Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vault gets compromised.

Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey).

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#318

Post by Telaneo »

no-name-here wrote: post #180
lelandbatey wrote: post #114

Earlier quoted context omitted.

> This makes it impossible to copy and paste your passkey to the wrong person (someone trying to trick you). It also, unfortunately, means it's not possible (via most passkey implementations) to back those passkeys up to paper. Which is quite unfortunate: backing up to paper is one of the most stable and human accessible ways of ensuring redundancy and continuity, an inevitable but also oft-ignored part of credential…

> back those passkeys up to paper Is writing down passwords something people do? I have countless passwords saved over >20 years and I don’t think I’ve ever recorded one to paper. I even checked a couple of popular password management solutions and they don’t seem to have “print” functionality.

Yes. Old people constantly do it, since they have no hope of remembering 15 passwords. Sometimes, they can barely remember 1 (one).

I've written down one: the master password for my Keepass database, along with instructions on how to get to and open that file. It's in a 'open if I'm no longer alive' envelope.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#319

Post by snailmailman »

vel0city wrote: post #283
snailmailman wrote: post #263

Earlier quoted context omitted.

This is good in theory but in practice doesn't always work. It isn't just a QR code like I would like it to be, its a QR code and you need bluetooth. Maybe there is a hypothetical world where bluetooth drivers actually work on windows machines and can connect to a mobile device seamlessly but that is not my experience. Across multiple windows machines i often have a problem where windows just decides the machine does…

I use this feature a bunch across dozens of different Windows and Mac devices from various device vendors with multiple Android phones and seemingly never had an issue. But I'm also a person who generally never experiences the issues some people have with Bluetooth in general. If I ever have an issue with Bluetooth on a computer, I swap out the wireless chipset with an actually good one. Its almost always just bad ha…

From what I understand the Bluetooth is required to ensure proximity. It isn’t actually used to transmit anything of vital importance. The QR is doing most of that. It’s just there to prevent scanning the QR through a video call and logging in from elsewhere.

Which I’m sure is great in theory. But IMO just adds even more complexity to a system that already has several moving parts and is more fragile than it should be.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#320

Post by Telaneo »

NetMageSCW wrote: post #249
tekla wrote: post #230

Earlier quoted context omitted.

It is what the vast majority of people do.

I doubt if that’s true since the vast majority of people no longer have printers. Not even the vast majority of online people.

Both pens and pencils exist.
Post reply on HN