Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

371–380 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#371

Post by kasabali »

voxic11 wrote: post #311
Tarq0n wrote: post #67

Earlier quoted context omitted.

OK now say you're on a work/library/friend's computer and you want to look up an account in 1password on your phone so you can type in the password. Passkeys don't support this very basic and common workflow. Meanwhile there's no real security benefit over password manager generated complex and not reused passwords.

I use a passkey with discord on my phone. If I want to log in to discord on a computer it shows a QR code on the page/desktop app and I scan it with my phone to log in. I could see this become a pretty common pattern. I like it because I can use discord on even a pretty untrusted computer without providing it any credentials or access to my passkey, and then later when I'm done I can revoke the session.

so you need to have discord installed in your phone.

now multiply it with every web site you want to access.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#372

Post by JohnFen »

thewebguyd wrote: post #327
smelendez wrote: post #151

Earlier quoted context omitted.

Yes, this is exactly the problem. Multiple pieces of software vying to be your passkey provider, often using dark patterns so you don’t realize you’re making a choice, and not using the term “passkey” so people are using the technology without knowing what it is or how to research it. Kind of reflects the state of the web today, where every company wants to be your intermediary in every interaction, from making a pur…

> Multiple pieces of software vying to be your passkey provider, Which entirely defeats the point of using passkeys. There shouldn't be a passkey provider the "provider" is your device's TPM/secure enclave + your biometric challenge. They are supposed to be mathematically non-exportable, device-bound.

> They are supposed to be mathematically non-exportable, device-bound.

Which would make the whole scheme unworkable (at least for me).

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#373

Post by dotancohen »

thewebguyd wrote: post #317
thecombjelly wrote: post #217

Earlier quoted context omitted.

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

  > Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey).
I have just shy of 2000 site credentials in Keepass. Let's assume that they were all Passkeys.

1) When I buy a new device, how do I create 2000 new Passkeys for that device?

2) Can I still do that if I don't have access to the old device? Maybe it was destroyed, stolen, or lost.

3) How about if the new device is from a different vendor than the original device? E.g. switching from Apple to Android?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#374

Post by iamnothere »

NetMageSCW wrote: post #242
otabdeveloper4 wrote: post #188

Earlier quoted context omitted.

WebAuthn is the standard for token authentication. (I.e., Yubikeys and other USB sticks.) It works fine and it a no-brainer to use. The problems start when vendors start trying to shoehorn their shitty cloud auth services into WebAuthn.

How well does that Yubikey work with an iPhone?

Works great, they even have ones with USB on one side and Lightning on the other for older iPhones.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#375

Post by OkayPhysicist »

corndoge wrote: post #135
duskdozer wrote: post #102

Earlier quoted context omitted.

This is why I am so concerned about passkeys. They could be a good improvement, but in practice I already see how it's going to result in Google/Apple/Microsoft/whoever seizing even more control. The document there is laughable too, because KeepassXC is listed as "not performing User Verification" when it demands manual authorization per request. But this isn't good enough for the passkey people. Ultimately, I see an…

Yeah they're really trying to solve problems that should be solved at a technical level with soft solutions in porcelain. See also this issue asking keepassxc to disable plaintext exports, which is completely technically feasible https://github.com/keepassxreboot/keepassxc/issues/10407

That issue was exactly why I took up my "Never use, under any circumstances" stance on passkeys. It is an indictment of the entire passkey project. I now routinely tell the less technical folks in my life, when asked about those weird passkey options, that they are the mark of the beast, and should be avoided at all costs.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#376

Post by iamnothere »

sandeepkd wrote: post #118
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

I am an engineer and have some insights on the discussions and developments around it. ITS NOT SIMPLE AT ALL 1. The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing). 2. Majority of industry players shared the vision of a credential which is available across the platforms and browsers 3. The vision for collaboration never materialize…

I don’t see hardware tokens (like Yubikey) in the list. Those are the only ones that provide a true second factor, to protect against the theft or compromise of your primary device.

I’m a little afraid that hardware tokens are getting lost in all the passkey marketing BS. At least they continue to work for now.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#377

Post by brentm »

cpburns2009 wrote: post #14
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

This is the main reason I've avoided passkeys. I have these exact questions and there's no a clear explanation given for these. I don't want to lose access to important accounts.

If you use something like 1Password it's very easy. It stores your Passkey and it syncs cross device. It's another thing but once it's set up it's less of a pain than using authenticator apps or having to find some random iPad that Google popped up an approval prompt on.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#378

Post by JohnFen »

no-name-here wrote: post #180
lelandbatey wrote: post #114

Earlier quoted context omitted.

> This makes it impossible to copy and paste your passkey to the wrong person (someone trying to trick you). It also, unfortunately, means it's not possible (via most passkey implementations) to back those passkeys up to paper. Which is quite unfortunate: backing up to paper is one of the most stable and human accessible ways of ensuring redundancy and continuity, an inevitable but also oft-ignored part of credential…

> back those passkeys up to paper Is writing down passwords something people do? I have countless passwords saved over >20 years and I don’t think I’ve ever recorded one to paper. I even checked a couple of popular password management solutions and they don’t seem to have “print” functionality.

> Is writing down passwords something people do?

Yes, it's pretty common.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#379

Post by baby_souffle »

fauigerzigerk wrote: post #323
baby_souffle wrote: post #297

Earlier quoted context omitted.

> So you're saying that if you're inside Apple's walled garden, it works really well! Hmm... Or google. If you use android and chrome then it all just works. But god help you if you want to use a password manager to keep everything in sync; I haven't yet found a way for a mobile app or web page to explicitly signal to the device that the passkey to be created should live in $password_manager and not whatever built-in…

>I haven't yet found a way for a mobile app or web page to explicitly signal to the device that the passkey to be created should live in $password_manager and not whatever built-in/on-device key-store exists. On Android 17 (on Pixel) you can select the password service under Settings -> Passwords and passkeys -> Preferred service. If you have an alternative password manager installed, it will be listed there along wi…

> On Android 17 (on Pixel) you can select the password service under Settings -> Passwords and passkeys -> Preferred service.

I have this set to my password manager but I still can't _use_ the pass-keys in my password manager to sign in to most apps.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#380

Post by packetlost »

thewebguyd wrote: post #317
thecombjelly wrote: post #217

Earlier quoted context omitted.

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey).

This is a misconception. A particular service can choose to enforce those class of passkeys, but most don't need that and shouldn't.

Passkeys are primarily meant to replace passwords and be hard (but not necessarily impossible) to exfiltrate.

The key difference is during normal usage you don't have to type the secret in anywhere, it's strictly asymmetric, so a unwitting user is far less likely to get fooled into accidentally leaking the actual credential.

Post reply on HN