Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys were invented by engineers with zero understanding of consumer brain

twitter.com

Post reply on HN
Print view View original

721–730 of 813 posts

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#721

Post by Telaneo »

cpburns2009 wrote: post #120
microflash wrote: post #40

Earlier quoted context omitted.

It depends on the app you’re using to save passkeys. Use Keepass and it saves the passkeys into kdbx file (similar to SSH keys).

Aren't they effectively locked in the database of whatever password manager is used? I know you can export them, sort of, but that feature may blacklist your password manager and make it useless. Are they portable? I thought passkeys are locked to the device.

> Aren't they effectively locked in the database of whatever password manager is used?

Not in the case of Keepass, since you can export them.

> I know you can export them, sort of, but that feature may blacklist your password manager and make it useless.

Yes, and this is why passkeys are flawed.

> Are they portable? I thought passkeys are locked to the device.

There's nothing preventing you from syncing your passkeys and using them on different devices. This even seems to be the happy path in the locked down eco systems (You can create a passkey on an iPhone, which is then synced to iCloud, and now you can use that same passkey on a Mac).

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#722

Post by marysol5 »

gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

Everything you ask is nothing to do with PassKeys, but to do with whatever platform you use authentication flow...

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#723

Post by marysol5 »

account42 wrote: post #690
sandmn wrote: post #680

Earlier quoted context omitted.

It works fine until Google suddenly decides that your new device is not you and asks you to confirm login from previous device...

Or until Google decides that you did a wrongthink and bans your account, including locking you out of your old phone.

[flagged]

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#724

Post by marysol5 »

thewebguyd wrote: post #354
Someone1234 wrote: post #333

Earlier quoted context omitted.

Right; but THAT idea is consumer hostile by design. So your account is now tied to a physical device; great, but the device is dead, or you own a dozen devices, now what? Each vendor has their own idea about what THIS means. Heck I have a couple that allow, max, a single Passkey at a time.

> Right; but THAT idea is consumer hostile by design. No argument from me there, just stating what the design actually calls for. It was never meant to be consumer friendly in the first place, it's an enterprise standard. It was just shoehorned onto consumers with the synced credential compromise to make it easier, instead of coming up with something better, and then just calling it a "Passkey" which now has dual mea…

Eh, PassKeys are consumer friendly by virtue of allowing the keys to be synced across multiple devices. That actually breaks some of the security of it for the benefit of the end user.

No end user wants to export and store a keychain. So they hand that off to somewhere else.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#725

Post by marysol5 »

unscaled wrote: post #407
packetlost wrote: post #380

Earlier quoted context omitted.

> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey). This is a misconception. A particular service can choose to enforce those class of passkeys, but most don't need that and shouldn't. Passkeys are primarily meant to replace passwords and be hard (but not necessarily impossible) to exfiltrate. The key difference…

Passkeys is basically a brand name for "discoverable credentials" (a Webauthn term). They do a little more than that technically, but in practice their purpose is what you said. Replace passwords. Or more accurately usernames and password pairs. This is in contrast from 2FA, but even before Apple started marketing Passkeys the FIDO standard supported the concept of Passwordless authentication, alongside 2FA. Passkeys…

Lest we forget that enterprises have had passwordless auth long before any of this

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#726

Post by boobsbr »

dfabulich wrote: post #49
gortok wrote: post #8

I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use La…

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

> Passkeys are just passwords that require a password manager.

How come I log into my corporate Windows laptop by typing a passkey instead of a user/pass combo?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#727

Post by zombot »

thewebguyd wrote: post #317
thecombjelly wrote: post #217

Earlier quoted context omitted.

A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it f…

> It seems like everyone wants to be _the_ password manager for all your passkeys. Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vaul…

> they are supposed to be device-bound

Which in and of itself should already be a super obvious total no-go. Every device will eventually go out of service or will be decommissioned, for a multitude of reasons. Then what, I lose all access, because I went from an iPhone to Android? WTF?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#728

Post by marysol5 »

jasode wrote: post #108
dfabulich wrote: post #49

Earlier quoted context omitted.

This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email. (But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.) The weird part is tha…

>This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. The issue isn't what passkeys _are_ (e.g. explaining they are like public/private "ssh keys" and hoping that type of explanation ends the confusion). Instead, it's the workflow around passkeys. The websites show very confusing dialog popups and choices that a lot of normal people will not understand. This is…

>I have senior citizens asking me

>instead they have a mixed Windows + Apple setup with 3rd-party password manager

Why do I feel like this scenario is entirely fabricated.

What fucking "senior citizen" is confused by a passkey, but has multiple devices and password managers?

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#729

Post by zeratax »

I kind of get what everyone here is saying, but in my experience i love passkeys and use them for everything as much as possible. I especially love the qr code feature where you can login with a passkey that is only on your phone on another machine without having to do any setup.

Also I find it a bit frustrating when people say password or otp just works. No they absolutely do not work. Even technical people on here get phished all the time even with otp.

Re: Passkeys were invented by engineers with zero understanding of consumer brain

#730

Post by marysol5 »

Telaneo wrote: post #289
Marsymars wrote: post #150

Earlier quoted context omitted.

> In the worst case, banks actually don't make it very hard for seniors to reset your password/passkey; just show up at a branch with photo ID, your bank card, and your PIN, and a teller will help you reset your credentials. They do it all the time. Maybe... I just ran into an annoying scenario where the largest bank in Canada made an administrative error where they mislinked an account belonging to me to my wife's p…

> I went to a physical branch to get it fixed and was told that branches don't have that kind of ability so I'd have to call customer support. What are the branches even for if not customer support?

Banks don't want to run physical branches anymore, hence why, at least in the UK all local branches are done. And central branches are all that exist.

They want to close even them because the only services they have now is ingesting cash, which is getting less and less anyway.

But yeah, any time I've gone into a branch, which they made me do a few months ago to "validate" my documents for a mortgage. Which was just scanning and uploading to their internet..., they've made me sit on the phone to their call centre.

Post reply on HN