Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

331–340 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#331

Post by preisschild »

reddalo wrote: post #60
programmertote wrote: post #19

Like some folks already commented here, even as someone who has been working in tech for 20+ years, I find Passkey confusing. I understand the key aspect in computer science term, but I don't know how to use it across devices. Another big worry is that if I tie that to a physical key, then I might lose it (because it's physical) and never get it back.

Exactly, I always refuse to add a passkey because I'm afraid I won't be able to easily login again. Also, I don't want to be locked in to a vendor.

You can register multiple passkeys for a single user, there is no lock in

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#332

Post by ekjhgkejhgk »

christina97 wrote: post #185

It’s quite the opposite. Passkeys are phenomenal for a lot of consumers. Based on this thread, it’s the engineers who understand authentication in the first place and have their own system (eg password manager) that are confused. Consider a user in the Apple ecosystem: you are already conditioned to just do Touch ID or Face ID when asked. I was on Amazon the other day, it prompted randomly for “want to set up a passk…

I refuse to be part of an "ecosystem".

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#333

Post by Someone1234 »

thewebguyd wrote: post #317
thecombjelly wrote: post #217

Earlier quoted context omitted.

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

Right; but THAT idea is consumer hostile by design.

So your account is now tied to a physical device; great, but the device is dead, or you own a dozen devices, now what? Each vendor has their own idea about what THIS means. Heck I have a couple that allow, max, a single Passkey at a time.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#334

Post by preisschild »

avh02 wrote: post #177
rib3ye wrote: post #140

Earlier quoted context omitted.

You can use a passkey that's tied to a Yubikey.

The problem here is i want to have more than 1 yubikey, so if i lose it, all is not lost... I can't do that with the current implementations unless i present N yubikeys to every new account i make. Which makes an off-site backup yubikey impossible. With my current yubikey usage with password store, my "offline" yubikey can be brought in whenever i want to decrypt the passwords, including ones inserted while the key w…

I think technically you can just register the public key of the passkey and only need it on-hand for login

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#335

Post by pkulak »

MattTheRealOne wrote: post #154
pkulak wrote: post #112

Earlier quoted context omitted.

I think the point is that Passkeys are not supposed to be as precious as passwords. You're supposed to have a brand new one for every device/application combination. So they are just login cookies at this point, and haven't even come close to replacing passwords because you need to know your password to get a new passkey every time you log in. Now, is that the official stance? I don't know; but it's _absolutely_ what…

There are a couple of problems I have with that. 1) Many websites limit the number of passkeys I can link to my account. Some only allow 2 or 3. I have more devices than that. 2) If I am supposed to create a new passkey for every device, how do I login in the first place? Most websites currently fallback to password login which defeats the security benefit of using passkeys in the first place. I currently only use pa…

Yeah, I agree. My policy is much the same as yours: set a passkey only when a site makes logging in with a password such a PITA that the PITA of a passkey becomes the easier option. Google comes to mind. They seem to actively not want anyone to log in. At some point sites will start to 2FA you even with a passkey, but we don't seem to be there yet.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#336

Post by TitaRusell »

thewebguyd wrote: post #317
thecombjelly wrote: post #217

Earlier quoted context omitted.

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

This is exactly all the stuff normal people don't care about.

If your system requires any basic intelligence or interest scrap it and go back to the drawing board because you just lost your customers.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#337

Post by kbar13 »

Tarq0n wrote: post #74
mullingitover wrote: post #33

You’d think a head of product at a tech company would embrace a “it’s literally impossible to have your password stolen if you use this” technology.

You can still get your session cookies stolen. If you have good password hygiene passkeys only protect you in extremely niche scenarios.

if you have good password hygiene is doing a lot of work here. such a large population of the world does not have this, credential stuffing is a huge class of vuln

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#338

Post by thewebguyd »

Someone1234 wrote: post #200
pishpash wrote: post #147

Earlier quoted context omitted.

It should have never been a cloud password manager play. It should be hardware device only, and tied to the device. One passkey on each hardware device.

Then most of us would never use it. That means either: - Only one specific device can ever login (bad). - It doesn't limit login to one specific device, therefore it does nothing. Linking Passkeys to a physical device was always DoA. At least not without a way to enroll every device you own, and strong recovery strategies. But considering how inconsistent every company's Passkey implementation is (inc. many that only…

> Only one specific device can ever login

That's entirely service dependent, and the standard doesn't mandate "Service must not allow multiple passkeys"

> It doesn't limit login to one specific device, therefore it does nothing.

It's not nothing. It provides an attestation that you the user are in physical possession of the device, and have passed the challenge to release the key form the TPM (biometrics, pin, something like a yubikey).

Giving your private key to a cloud password vault makes it phishable again (via an attacker getting acsess to your vault, just like with passwords). The private keys are supposed to be non-exportable, and the cloud password managers defeat that as well.

Post reply on HN