Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

501–510 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#501

Post by jeroenhd »

OJFord wrote: post #369
voxic11 wrote: post #311

Earlier quoted context omitted.

I use a passkey with discord on my phone. If I want to log in to discord on a computer it shows a QR code on the page/desktop app and I scan it with my phone to log in. I could see this become a pretty common pattern. I like it because I can use discord on even a pretty untrusted computer without providing it any credentials or access to my passkey, and then later when I'm done I can revoke the session.

Ok but now do a service that doesn't support that, whether or not it might in the future 'become a pretty common pattern'.

On most websites logging in through QR codes works out of the box for passkeys. You usually click "log in with device" or something like that with every desktop OS.

You scan the QR code, click the confirmation button, and you're signed in. It's part of the standard UI of normal operating systems.

Might not work (well) if you're on an old computer without decent Bluetooth but everything has Bluetooth these days.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#502

Post by TheBicPen »

raron wrote: post #423
halJordan wrote: post #399

Earlier quoted context omitted.

I get your problem, i don't really accept it as valid. Passkeys were always supposed to be fungible. You have one in your iPhone, a different one on your desktop. A third in your significant other's phone. All stored in the hardware tpm equivalent. You can have 7 passkeys. You can have 14. The real failure of passkeys (emphasis on the s!) is that people think they must only have one.

I don't think that would work either. Let's say I have a new account and a single Passkey in the TPM of PC1. I want to log in from PC2, too. How can I do that? (I know there is some trickery with Bluetooth, but I haven't seen anything supporting it, and desktop PCs usually doesn't have Bluetooth connectivity.) AFAIK some browsers can do some magic to use a Passkey from your smartphone on a PC, but you need to log in…

Can these services not use the same fallback mechanism that already exists for non-passkey logins? i.e. an email with a 1-time code or similar. Yes that somewhat defeats the purpose of passkeys but that option is going to exist for a long time regardless of passkey adoption.

If you don't want to downgrade security, how about requiring confirmation from another session that is already logged in using a passkey? e.g. You try to log in on PC2. A prompt appears with something like "confirm this login from [PC1, etc.]". You log in on PC1 using your passkey. The service recognizes that the login id definitely you, or at least someone in possession of your physical device and login method for that device. Therefore, it then allows PC2 to register a new passkey. Kinda similar to how google confirms new logins by sending a notification to your phone.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#503

Post by t1234s »

The idea of passkeys is good (similar to key pairs you use with ssh if I understand correctly) but how and where they get stored is the problem. Especially if you use multiple computers / devices.

Something like a yubikey makes sense for this until you lose it and your fucked. From what I understand you cant clone a yubi key to keep a backup somewhere safe.

In the end the solution will be some sort of cloud based storage for these keys where the NSA can have easy access.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#504

Post by akdev1l »

jimbokun wrote: post #472
thewebguyd wrote: post #317

Earlier quoted context omitted.

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

Seems like the flow should be: 1. All passwords stored in password manager. 2. Login with password manager when logging in for the first time on a device. 3. Combination of OS and site/app notice that no passkey has been created for this account and offers to create one. This is presented to the user as “setting up the current device for password-less log ins.” 4. OS negotiates with site/app to install the passkey an…

By still having the password the user can still be attacked via phishing

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#505

Post by jeroenhd »

snailmailman wrote: post #263
vel0city wrote: post #96

Earlier quoted context omitted.

If I'm on someone else's computer and I want to use a passkey on my phone, the computer will display a QR code. I scan the QR code with my phone, the phone signs the login request and posts it to the service's callback. Then I'm logged in on that new device. If my phone's camera is broken but both devices have bluetooth, it can do the handshake over bluetooth. If I'm on someone else's computer and I want to use a pas…

This is good in theory but in practice doesn't always work. It isn't just a QR code like I would like it to be, its a QR code and you need bluetooth. Maybe there is a hypothetical world where bluetooth drivers actually work on windows machines and can connect to a mobile device seamlessly but that is not my experience. Across multiple windows machines i often have a problem where windows just decides the machine does…

This is the one Bluetooth feature that has always worked for me out of the box on both Windows and macOS. I haven't tried Linux yet to be honest, no idea if anyone has bothered implementing it yet. Usually open source is a couple years late to this sort of thing (except for maybe distros like Android or ChromeOS).

Now, if only Windows, macOS, and Linux can get together and fix whatever needs fixing to get headsets to connect properly automatically, that'd be grand.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#506

Post by vel0city »

bflesch wrote: post #488
vel0city wrote: post #302

Earlier quoted context omitted.

If a service wanted to do that they could already do that, you even point to an example with a platform requiring their specific app to use the account. I've had banks which required me to have their own time-based code physical security tokens to log in, isn't that in the end the same? This thing you're talking about isn't inherently a thing about passkeys. If a service wants to remove your ability to log in to thei…

Unfortunately the US has willfully destroyed a significant amount of goodwill with citizens of their NATO allies. Due to aggressive rhetoric we are forced to look at the risks differently now. Further centralization on US services for something that already works fine (like 2FA) is unnecessary risk.

I agree the US has torched a lot of international goodwill.

Once again how does this relate to passkeys? You don't have to use US companies to use passkeys. There are European providers of authenticators. What country is Yubico based out of again? Just picking one example, there are others.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#507

Post by upcoming-sesame »

I love passkeys.

The only confusion I have with them is around when they are used just as a 2fa (most cases) and when they can replace passwords completely (just one click and you're in)

Unfortunately very few services offer #2 not sure why

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#508

Post by gwbas1c »

christina97 wrote: post #185

It’s quite the opposite. Passkeys are phenomenal for a lot of consumers. Based on this thread, it’s the engineers who understand authentication in the first place and have their own system (eg password manager) that are confused. Consider a user in the Apple ecosystem: you are already conditioned to just do Touch ID or Face ID when asked. I was on Amazon the other day, it prompted randomly for “want to set up a passk…

I've found passkeys generally simple and easy to use on MacOS and Android.

On Windows, I hate them. They always push me towards using a PIN instead of my Yubikey or password.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#509

Post by aPoCoMiLogin »

programmertote wrote: post #19

Like some folks already commented here, even as someone who has been working in tech for 20+ years, I find Passkey confusing. I understand the key aspect in computer science term, but I don't know how to use it across devices. Another big worry is that if I tie that to a physical key, then I might lose it (because it's physical) and never get it back.

i don't think you really understand how it works. most implementations are secondary implementation alongside login+password.

how to use cross-device? either use some password manager that supports it (apple/google/1password/keepass/etc support it), or use device that you have on hand most of the time - phone. when the passkey pops up - point your camera and scan the qrcode - you are done. otherwise use dedicated device like yubikey or similar.

really not sure what is hard about that to understand. i'm using android and chrome, so i can use the password manager in chrome, or my phone to scann the qrcode.

my country is using similar authorization for government "profile" (mobywatel - poland) that has similar to passkey implementation. you download the app on your phone, login via login+password (or other), download the certificates, and from now on you can point your camera on qrcodes to login to government websites; it requires pin/code or biometric confirmation on the phone - same as passkeys.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#510

Post by jknoepfler »

thewebguyd wrote: post #317
thecombjelly wrote: post #217

Earlier quoted context omitted.

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

I do not want my identity to be device-bound. I want it to be me-bound.
Post reply on HN