Rendered at 15:53:13 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
drtz 3 hours ago [-]
Passkeys do marginally improve security against MITM and phishing attacks, but they are primarily for protecting the lowest common denominator from themselves: people who re-use passwords and/or don't use a password manager.
If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
dspillett 45 minutes ago [-]
> The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for.
My irritation is that I know what it is, and I've said no thanks many times, but I'm still asked regularly by the likes of Amazon, and they usually pick a time when I'm trying to order something quick¹. It is one of the growing number of things in life that simply have no “no” option, it is always “yes or later” - I wouldn't mind so much if “later” meant “I know the option exists, I'll ask for it if I change my mind, don't bother me again otherwise”. Call me cynical, but if companies are trying to nag me into something I very much doubt the main benefit is mine. I'm sure there are many people out there who go along with it simply because they are sick of being asked repeatedly.
I also don't see the real benefit with the way things are often implemented anyway. When the credential recovery process is sending a magic email or text, making SMTP or SMS the weak link of the chain just as it often is for passwords so I'd be giving up my preferred workflows for no better security.
----
[1] A short while ago I actually ordered from somewhere else because of this, bitter twit that I am. “I wonder if I can get this almost certainly drop-shipped item on next day delivery via Prime?”, [goes to Amazon to check], [get passkey prompt], “sod it, I'll go back to the original place”.
Telaneo 2 minutes ago [-]
> My irritation is that I know what it is, and I've said no thanks many times, but I'm still asked regularly by the likes of Amazon
The people responsible show a distinct lack of understanding when it comes to consent.
ProjectArcturis 29 minutes ago [-]
I dropped Amazon entirely a couple years ago because they didn't provide any way at all to separate my credit card from my kid's Fire tablet and I didn't want to be on the hook for thousands in charges because he pushed the wrong button. It's remarkably easy! It has made basically no change to my life except that I'm a little smug about not using Amazon.
section_me 3 minutes ago [-]
> If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache
This is why you use hardware keys which work across devices like yubikeys and the like.
I have two of the old neos and two of the newer usb c + NFC enabled ones.
No issues.
HaloZero 2 hours ago [-]
My MIL setup a passkey accidentally on her Google account and now has no idea where it is. Removing it now requires her password which she’s also forgotten. But now for some reason on Google I can’t initiate any type of forgot your password flow because of how Google sets up things and I have zero clue where she stored the passkey.
brandon272 50 minutes ago [-]
Ran into the same issue with my dad the other day. Has a passkey set up on his Google account. Bear in mind that he doesn’t know what a passkey is, so Google obviously sent him through a pattern at one point to get him to create one.
He didn’t have access to it the other day and we needed access to his account. He didn’t remember his password, and we were unable to reset it because you need the passkey! No other options to authenticate for a reset were available.
Add in the fact that I was trying to help him with this by long distance call and you can imagine the frustration.
UltraSane 1 hours ago [-]
Doesn't the passkey have to be on her phone or computer?
HaloZero 1 hours ago [-]
It should be but haven’t checked her apple vault. I checked Google password manager and her windows password manager and there nothing in either. She might have used her phone and it’s in her iOS vault which I’ll check next. But this is what makes this entire passkey thing a mess. She’s 75, she didn’t do this on purpose and the ecosystem is just a mess
tim333 46 minutes ago [-]
They seem unnecessarily opaque about it all.
I just made one for PayPal using my MacBook which seems to have ended up in Bitwarden rather than the mac thing. But there's nothing in Bitwarden to say list all passkeys. Not sure how I check elsewhere. Maybe they should email you "you have created a paypal passkey in Tim's Bitwarden" or something. Then at least you could search the email for "passkey"?
I wonder if I can use Bitwarden on another device with that? I honestly don't know.
lukan 47 minutes ago [-]
Everything about it is.
Also in the process of helping my dad with his phone, 76 and my grandmother 99. Maybe this works better with Apple, but the biggest problem on Android is, that it feels like every update shuffles everything around. Allmost no point in explaining, that they can solve some things on their own.
And all the time new things on the screen, new features they don't understand, need nor asked for.
xboxnolifes 40 minutes ago [-]
Im young and I dont even bother learning how to use my Android phone's new features since it feels like everything moves or changes all the time. there's no point trying to get familiar with most of the features.
monknomo 9 minutes ago [-]
if any android pms or execs read this comment, it should be like a slap in the face. a scathing indictment of the state of their product.
just hang their heads in shame and walk into the sea
UltraSane 36 minutes ago [-]
Apple does seem to have one of the best and most secure passkey implementations.
ryandrake 53 minutes ago [-]
Even the concept of "where on the PC" has been totally annihilated by OS vendors and app developers. Is it on the filesystem? Is it on The Cloud? Is it vaguely "In An App"? Is it in some "Secure Enclave"? Who the fuck knows anymore? And the apps are no help--they insist on blurring the lines between local and cloud, hiding full paths, and generally just saying "Don't worry about where your data actually is. We pinky swear to be able to find it for you!"
HaloZero 35 minutes ago [-]
Windows prompting her about Bluetooth for the pass key threw me too. I thought for sure she had clicked the wrong thing before I realized that somehow her widows pass key requires communicating to some device? Maybe her phone? No idea
judge2020 2 hours ago [-]
> how do I log in on a device that I don't own?
This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport). iOS and Android support this, and it’s generally not a locked-down thing if other devices wanted to do it too.
The only use case left is in “how do I login if all my devices are stolen/fall into a body of water” in which there really isn’t an answer beyond “get (a|your) device back, sign back into your password manager, use that to get back into critical accounts”.
darkwater 54 minutes ago [-]
>This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport).
Ok but how do I share my Netflix or Spotify accounts for example with those?
judge2020 48 minutes ago [-]
In general you shouldn’t - Netflix[0] really should get proper invite-based family sharing, and Spotify’s subscriber agreement has a section that defines Premium as a “Single-user Paid Subscription” and thus can’t be used by multiple people, legally (and you might be at risk of getting banned if they detect it)
However, passkeys can and are available to be shared via password managers. They’re not locked to the secure chip on the device where they live usually. iOS’ Passwords app has a share button and 1Password lets you share passkey-containing items.
In fact, the QR code login feature makes it even easier to do a one-time sign in to your account for a friend, if you don’t want them to be able to login to your account indefinitely.
0: Netflix doesn’t support passkeys because their main audience is people signing in via smart TVs and whatnot, which largely don’t support CTAP or Webauthn in general)
201984 2 hours ago [-]
What if the computer you want to log in on doesn't have Bluetooth? Probably most public computers (like ones in libraries) don't have it.
limagnolia 2 hours ago [-]
The website should display a qr code you can scan with your phone that allows you to then login, unfortunately a lot of sites don't implement this, and some don't implement backup codes. This isn't the fault of passkeys per se, but of poor implementations.
201984 2 hours ago [-]
How does scanning the barcode with your phone log you into the computer? Does your phone need network access for that?
jon-wood 36 minutes ago [-]
There's a whole set of fallbacks built in to the standard, including Bluetooth, local network connections, and going via a relay server. All of them eventually end up with your device signing something and handing that back to the browser on the other device to complete the authentication flow.
roryirvine 2 hours ago [-]
If you're not happy connecting your phone to the network, then how likely is it that you would you be willing to enter your login details on a machine you don't control?
tavavex 2 hours ago [-]
What if you just can't have internet on your phone? Like if the computer is connected via Ethernet and there's no wifi network you can connect to? What if you're abroad and have no roaming? And the ultimate question about a person that the modern world can barely conceptualize - what if you have a dumbphone? Or what if your smartphone is lost or stolen or dead and you need to access some account? That last one has happened to me, and I sure am glad I know the key passwords that I need for survival.
These may seem like nitpicks, but there's probably a thousand rare scenarios like these that exist. You inevitably have to consider them when you're moving from punching in letters and numbers that you remember in the normal, low-tech way to a complex networked two-device workflow.
vel0city 44 seconds ago [-]
Passkeys can exist on devices other than phones, so your entire premise is moot.
limagnolia 2 hours ago [-]
If my phone is lost or damaged, I would buy a new, cheap Android phone and sync my passkeys to it. But I am curious why one would need to login to a website in order to survive? If one did have say a severe medical condition that somehow required a website in order to manage, I guess I would concede that maybe passkeys aren't the best way to secure such a life-sustaining website.
horsawlarway 1 hours ago [-]
> But I am curious why one would need to login to a website in order to survive?
They use bank like Ally or Discover with no physical branches.
They use a mortgage provider like Rocket mortgage with no physical branches.
They use a medication delivery service with no physical customer facing pharmacies.
They have an employer that only facilitates reimbursement for expenses via online tools.
etc...
I guess "survive" has a sliding scale, but if I lost access to critical accounts... my life is going to FUCKING SUCK in a non-trivial and very impactful way almost immediately, on many fronts.
And if your answer to that problem is "well, just call them"... then we're right back to the point the article is making: "An account’s security is still dictated by the weakest recovery method"
Passkeys aren't a meaningful improvement in security - assuming you do actually have decent password hygiene like a password manager.
epihelix 37 minutes ago [-]
If your phone is lost, how are you going to sync your passkeys to your new cheap android? In a passkey-only future, you cannot login to your Gmail account without your passkey, which is only on your phone, which you've now just lost.
What am I missing? Either we retain passwords as backup for a lost or stolen device - in which case, all the security concerns are still there - or we only use passkeys, in which case we've added a clear nonrecoverable point of failure in the system.
tavavex 35 minutes ago [-]
Doesn't being able to sync your passkeys by entering your conventional password somewhere eliminate the whole point of passkeys? It just shifts the point where you can enter the password to recover your data to a less convenient place. And if your entire stack is passkey-protected (which I'm pretty sure is the case most of the time) then the secondary phone won't do anything for you.
When I said "survival", I meant it in the "being able to make do with few resources in a time of crisis" way, not that you will literally die if you can't access an account. Losing a crucial device without a fallback of being able to log in somewhere else quickly can mean immediately losing access to payments (the most crippling, especially if you're not home), being stranded in an airport or even not having an identity document (in countries with digital ID systems). Any of these happening can lead to enormous losses in time, money or worse, depending on when and where this event hits you.
1 hours ago [-]
enriquto 1 hours ago [-]
> willing to enter your login details on a machine you don't control?
Are you talking about your phone here?
roryirvine 56 minutes ago [-]
Sure, your personal security posture might very well preclude that.
But, again, if you don't trust your phone then how likely is it that you will be prepared to trust a public computer?
stonogo 2 hours ago [-]
Poor people exist.
roryirvine 2 hours ago [-]
The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription.
The number of people sharing GP's concerns for reasons of poverty rather than because of their personal security posture will be vanishingly small.
arcfour 58 minutes ago [-]
I'll have to remember this one the next time I hear the phone/poverty argument made in bad faith.
Yokolos 2 hours ago [-]
Steam does this. If I want to login, it shows a barcode I can scan with the app and it logs me in without needing to enter my login information. Phone needs internet access, doesn't need to be on the same network as the device I'm logging in on.
I assume the QR code contains a token for the device, which is used by the app to authorize the login and the server automatically logs in the client on the device with the matching token.
Seems a lot safer to me than using my login credentials on a potentially unsafe device.
limagnolia 2 hours ago [-]
Yes, this is how it could work, or it could display a code you type into your phone.
jerkstate 2 hours ago [-]
what good is a phone if it isn't on a network?
cpburns2009 1 hours ago [-]
Have you ever been in a large building with awful cell reception and no wifi access?
cesarb 39 minutes ago [-]
> what good is a phone if it isn't on a network?
1. It might be on a voice network but not on a data network; for instance, if you don't have a data plan.
2. Modern smartphones are actually a hybrid of a traditional cell phone and a traditional PDA, and you might be using it for the PDA part.
2 hours ago [-]
alienbaby 1 hours ago [-]
That's still a terrible solution. Plenty of people don't have phones that can do that, or dont have e it with them when they do etc..
judge2020 53 minutes ago [-]
Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms.
cesarb 45 minutes ago [-]
> > What if the computer you want to log in on doesn't have Bluetooth?
> Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms.
What if the computer you want to log in on doesn't have a WiFi chip?
It doesn't have to be an old computer; for instance, the desktop computer I built last year uses a wired gigabit Ethernet connection to the router right next to it, and doesn't have (or need) any WiFi or Bluetooth chip.
reaperducer 35 minutes ago [-]
Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms.
That's a technocratic reply, not one that is useful in the real world.
As noted by the person you're replying to, it's not his computer. It's a public library.
Most computers in non-residential settings will have various features locked down, including Bluetooth.
Hotels, clubs, airport lounges, various government facilities… there are thousands of places where you might really need to use a computer but don't control the technology.
xp84 1 hours ago [-]
My suggestion would be to not do that. But keep a password and an offline TOTP app if you must. It’s still an option.
epihelix 44 minutes ago [-]
Awesome. I'll just find the thief and ask nicely, shall I?
esseph 2 hours ago [-]
Passkey on NFC/USB hardware token (x2)
They're cheap enough if you lose one it's not the end of the world. Goes on your keyring. Doesn't require esim management. Use NFC swipe/usb-plug-in + pin to use.
limagnolia 55 minutes ago [-]
The problem with hardware tokens is that they 1) Only store a limited number of logins, 2) It is very difficult to keep them in sync- every time you need to add a passkey, you have to get them both out, which makes it difficult to keep one a in a secure safe to keep it safe from damage/loss
This two fatal flaws are what limits their usefulness to enterprise SSO and perhaps some other limited uses where the organization has the ability to replace tokens. (Even in a distributed enterprise, enterprise SSO may not be a good fit for hardware tokens, if they can't get replacements out to employees fast enough).
pavel_lishin 2 hours ago [-]
The problem isn't the cost of replacing it, the problem is - how do you log in when all your passkey-bearing devices just got flushed down the toilet?
vablings 58 minutes ago [-]
Copy pasting my other comment from an earlier thread
FIDO2 USB Security key -> Bitwarden (With master password) -> Every other method (topt/password)
I have 3 FIDO2 USB Security keys, One I carry with my persons at all times, one that stays with my main machine at all times and an offsite backup that is sitting in a friend's server, if my house burns down, I can either physically collect the key or use USB-IP to authenticate back into bitwarden and enroll a new key. (Actually all 3 are at home right now but that's ok)
remix2000 1 hours ago [-]
How is that different from accidentally deleting your keepass database? Or forgetting your password? I think it’d be easier for me to forget than find myself trying to flush all my hw tokens…
pavel_lishin 1 hours ago [-]
I can back up my keepass database, and I can write down my passwords.
faust201 60 minutes ago [-]
Same way. A majority generally have a old phone that was already signed in to google. Or if they remember only Apple ID and password (one very difficult password) + sms. They can login on to a new phone.
Everything is SYNCED immediately.
What if you have a ransomeware that destroy everything on the same day your house and all backups burn down. And you cant get it from immutable backups as you wrote that decryption key in paper. And the bank will not allow you to access it as the govt deported you elsewhere.
megous 53 minutes ago [-]
I can back up my FIDO2 (non-)resident keys too. In the end it's just a piece of HW with some secret material inside. non-resident FIDO2 keys are easier to back up, because the master secret seed is fixed and shared for all origins and there's nothing stored on the key.
faust201 1 hours ago [-]
But a majority don't do that. For them let them use passkeys. If the possibility is once in 10 years then I am happy to do that. A majority is happy to do that.
And yes, Google or Apple - dont say you should not keep passwords in your database and sync it with dropbox. DIY.
Rest of us want convenience.
56 minutes ago [-]
lxgr 2 hours ago [-]
Enrolling two devices stored in different locations for every sign up is extremely annoying.
I suspect that most people that ostensibly do this actually only enroll one for non-critical accounts and then depend on some fallback mechanism.
iamnothere 1 hours ago [-]
This is a legitimate problem, and one of the few cases where a third party login provider makes sense, at least for non-critical “apps”. If both tokens can be authorized to that provider, then you don’t need to enroll any more tokens for apps using that provider. The difficulty is creating a trustworthy provider system without weakening security (the provider shouldn’t be able to login without you) that doesn’t collect information about you and which can’t lock you out from all your accounts.
I’m not sure what work has been done on this since Mozilla Persona. I certainly wouldn’t want Google and Apple, or governments, to be the sole gatekeepers.
lxgr 47 minutes ago [-]
Why would you choose that over a synchronizing passkey manager?
A third party OAuth provider puts you at the mercy of the service provider, the other can work fully on your client side even if the app provider were to disappear tomorrow.
The only advantage I can think of is that you have a centralized place to revoke credentials in case your password manager does get compromised.
iamnothere 35 minutes ago [-]
> Why would you choose that over a synchronizing passkey manager?
No second factor, compromised passkey manager leads to compromise of all accounts. This is a huge problem.
> A third party OAuth provider puts you at the mercy of the service provider, the other can work fully on your client side even if the app provider were to disappear tomorrow.
Yes that’s what I was saying, it needs some thought and careful work. It would need to be decentralized, and I’m not sure that current standards are up to the task.
UltraSane 27 minutes ago [-]
"A third party OAuth provider puts you at the mercy of the service provider" This is they key issue with trusting a third party to manage my passkeys, they can also BLOCK them and lock me out. An exception is if the passkeys are synced to all your devices and cannot be remotely wiped. I think this is how Apple works.
iamnothere 16 minutes ago [-]
I didn’t think of this in the moment, but you’re right, this is an even bigger risk than compromise. There’s regularly a thread here about someone getting locked out of their cloud accounts, and now we’re going to gate everything behind those same accounts? Horrible idea.
2 hours ago [-]
mystifyingpoi 3 hours ago [-]
> how do I log in on a device that I don't own?
Sad reality is that such usecase is less and less common, thus, no one cares about it. I think majority of my friends would not be able to access their email, or facebook or alike, if they were forced to use my computer in emergency.
epihelix 46 minutes ago [-]
And that sounds fine, until you're traveling and your devices get stolen or lost. How, exactly, are you going to get into your email then, once passkeys become the only means of login? Because that moment is when you really do need to access your email, stat.
alienbaby 59 minutes ago [-]
Rubbish. Such use cases are extremely common anywhere it can't be expected everyone has access to their own device.
makeitdouble 35 minutes ago [-]
A variant of that is alternative accounts that properly live on a different device/context.
For instance YouTubers usually have a different account for their channel than the one they use privately, and don't want their channel account logged in everywhere.
That means having to log in as a guest when push comes to shove. And similar setups are common for most self-employed keeping a "work" account IMHO.
heavensteeth 30 minutes ago [-]
You wouldn't be able to if you use a traditional password manager, either. At best you'd have to share your entire password database.
cj 3 hours ago [-]
Isn't there a workflow where you scan a QR code to confirm the pass key on your phone?
I've definitely done this, but not sure if the workflow was at the OS or browser level.
I'm honestly confused by all the negativity in the comments. Passkeys are great for convenience. Just leave your password login enabled as a backup. That defeats any security benefit, but oh well.
kps 1 hours ago [-]
> Isn't there a workflow where you scan a QR code to confirm the pass key on your phone?
For people in this position, if they had their phone, they probably wouldn't be logging in on a computer anyway.
limagnolia 47 minutes ago [-]
There are a lot of reasons why I might want to login on a computer I don't own to do something, rather than to use my phone. Having a keyboard is a major usability benefit for many types of work. Larger screen, printer. Software that is on the machine that can't run on my phone.
kps 39 minutes ago [-]
I agree with you; those are all reasons I only use my phone for on-the-go messaging or navigation. I'm against the idea that you should have to have a secure (against the owner) connected phone on your person at all times in order to sign in to a web service.
xboxnolifes 38 minutes ago [-]
Thats still irrelevant to the example being discussed.
conradludgate 22 minutes ago [-]
This is what I use to log into our remote desktop software at work. The passkey is on my phone and I scan a QR code presented by the remote desktop software (in this case it's the Windows App on my macbook and Microsoft Authenticator on my android).
dgunay 1 hours ago [-]
There is. Doesn't work on every browser but it's really nice and I use it routinely.
Latty 3 hours ago [-]
Which is a trade-off that makes sense for a lot of people. If you have multiple devices, many of which are portable and one you have on you all the time, the need for that is just way lower, so being more secure against commonplace automated widespread attacks is worth it to them.
iamnothere 1 hours ago [-]
Many people are moving to only a single portable device that’s easily lost, broken, or stolen, without any understanding of backups or fallbacks for their accounts.
And many are moving to virtual wallets like Cashapp rather than banks with a physical presence where you can take out money without a phone.
It’s a bad situation.
megous 46 minutes ago [-]
That's actually a good use case for HW keys. Since untrusted computers are much more likely to have keyloggers/malware, etc. So you don't need to reset password and invalidate all sessions after each such login on an untrusted computer.
Latty 3 hours ago [-]
The offer a strong protection against phishing attacks that would still get plenty of password manager users: fake websites. A passkey is strongly linked to a domain, so a fake site can't get that credential.
Some password managers will only fill if a domain matches, but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in. I've also seen lots of them do stuff like happily autofill on any prefix of the domain, so your credential for `something.example.com` will autofill into `fake-something.example.com`.
ealready_value 2 hours ago [-]
"Oh, usually my bank just logs me in, that's strange. Let me just go grab my username and password and type it into this site that looks like my bank."
Same thing is going to happen with passkeys for non-technical users for exactly the same reason you stated. People will think the integration is busted and manually copy/paste the non-passkey credentials in. In that way, I would argue that passkey is not stronger protection against phishing attacks unless its the only way to login. It is, at best, a convenience for users.
Latty 2 hours ago [-]
If the user just has a username/password fallback and that's it, then yes, but the aim of passkeys is that won't be the norm, rather users will only have passkeys and the fallback would be to, e.g: magic link email log in where the phishing attack is still broken. I've seen some sites explicitly disallow plain username/password login after you enable passkeys for this reason (you can still put them in, but then it just does a magic link flow afterwards as a second factor).
pamcake 2 hours ago [-]
The pitch is that passwords will supposedly be phased out entirely as an option.
cpburns2009 57 minutes ago [-]
I've been told by multiple people that the recovery method of passkeys is to enter your username/password. If passwords are eliminated, your final recourse is fucked.
rcxdude 2 hours ago [-]
Which is a laudible goal, but something that makes "oh just fall back to the standard insecure recovery process" not a very good response to the concerns about users being able to actually hold on to their passkeys easily and reliably.
flerchin 3 hours ago [-]
How did fake-something get injected as a subdomain?
Asmod4n 3 hours ago [-]
Loads of hosting sites do this, username.domain.tld is the most common one.
somehnguy 2 hours ago [-]
I guess it's a good thing my bank doesn't have a free web hosting service
lapcat 3 hours ago [-]
> Some password managers will only fill if a domain matches, but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in. I've also seen lots of them do stuff like happily autofill on any prefix of the domain, so your credential for `something.example.com` will autofill into `fake-something.example.com`.
Why would you trust the very same password managers that don't handle passwords properly to handle passkeys properly?
conradludgate 26 minutes ago [-]
The password integration breaks because it's trying to detect password fields rather and failing because of weird HTML/JS code.
The passkey integration goes the other way, which is much more reliable.
Latty 2 hours ago [-]
You don't. The browser handles the passkey matching to the domain which is obviously a better place to do it. There could obviously still be bugs as with all things, but it's much more intentionally integrated into the flow which makes it much harder to bypass.
lapcat 2 hours ago [-]
> The browser handles the passkey matching to the domain which is obviously a better place to do it.
I'm not sure why you're making a distinction. In many cases the browser is the password manager.
Latty 2 hours ago [-]
Right, I haven't seen that particular flaw in baked-into-the-browser ones (probably because they already having secure domain matching code ready to use), but the distinction is that doing the domain check is a part of the spec and standard, so e.g: sites aren't going to break it by changing the log-in subdomain routinely, as has been common historically.
Password managers have had to be permissive enough to work with most websites, and there is no standard for it. There have been sites that blocked the autofilling of passwords and so on as well.
My point wasn't this one particular flaw in some password managers is the reason to use passkeys (the copy/paste point is the much bigger issue anyway), just that it's an example of how relatively brittle the password manager process is. Having it a core part of the spec gives stronger guarantees.
cruffle_duffle 1 hours ago [-]
“There have been sites that blocked the autofilling of passwords and so on as well.”
Sites that do this irritate me so much. Ones that try to block pasting and stuff… like somebody intentionally baked that into the site. Who? And what was their rationale? Are they really so arrogant to think people are going to carefully type in some elaborate password not once but twice?
That and blocking paste in fields like bank account numbers and stuff.
Surely somebody here has been asked to implement these mis-features. Please explain what went through the heads of the people responsible for it?
jkubicek 2 hours ago [-]
The users are the ones manually copy/pasting the password. There's no way the password manager could prevent this short of disallowing copying/viewing passwords.
6P58r3MXJSLi 2 hours ago [-]
> Why would you trust the very same password managers that don't handle passwords properly to handle passkeys properly?
> but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in.
I've seen people do this AFK as well, and I'm always helpfully suggesting them the correct way of solving this: verifying the URL again, and if correct, add it to the password manager so it remembers in the future, and never copy-paste passwords on the web. Basically 50/50 if they take the advice or come back after a week asking if it's safe to copy-paste the password into the website, and I try to inform again.
Shockingly, I saw one developer peer copy-pasting a password into a website, but I guess for these people there is no hope.
Latty 2 hours ago [-]
It should be a big red flag for sure, but the reality is most users aren't going to understand that. They got told to use a password manager by someone or find it convenient, but they don't understand the security flow enough to catch that it's a potential attack, or how to resolve it safely.
Historically I've seen lots of sites do a subdomain shuffle for login pages every now and then which routinely breaks domain matching, introducing false positives that users have to deal with, making them numb to the threat too. Passkeys baking in the domain check with no workaround means that sites can't do that, which is a benefit.
winstonwinston 2 hours ago [-]
> I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
No doubt there exist services that do not offer recovery method for passkey or mfa enabled account. But this is entirely on them (the service), to blame for, not the passkeys or the users. It’s bad implementation.
mikepurvis 2 hours ago [-]
I'm just storing my passkeys in 1password, which means they're synced across my two computers and phone and also means I gave up any kind of hardware security.
Oh well.
throwaway27727 1 hours ago [-]
> how do I log in on a device that I don't own?
You scan the qr code from your phone and it logs you in on that device. The experience is pretty amazing, honestly.
xboxnolifes 35 minutes ago [-]
They mean if you dont have access to your devices.
TacticalCoder 1 hours ago [-]
> Passkeys do marginally improve security against MITM and phishing attacks ...
The tragedy of passkeys is that they're a step back from the security offered by the likes of Yubikeys.
But because passkeys are pushed by both Google, Microsoft and Apple: there is is simply no fighting these three. It is impossible.
Passkeys won not because they're better (they're not and the entire concept of "secret behind a hardware security module" that can be transferred to another system defeats the whole point of a HSM in the first place) but because the powers-that-be decided that passkeys are to be used.
It's still a win: the commoners are better served with passkeys.
But a secret in control of Google/Apple/Microsoft that can be backed up is not a secret I control: it's a complete step back from yubikeys.
Passkeys won and we better get used to them (and, yup, there are usability issues as you mentioned).
cryptoegorophy 2 hours ago [-]
iCloud Keychain? Is there a reason not to use it? Aside from having android.
hannasanarion 3 hours ago [-]
The point about poor support for 3rd party managers is so frustrating. Because this is correct, that is the obvious solution for the normal user, but passkey implementations somehow do not know how to deal with it.
Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.
And the confusing mechanism hurts there too: I'm always a little bit afraid that i'm somehow more in danger because I keep them in a vault that's shared on all my devices rather than a TPM, because whenever the protocol is explained the "it can't leave your device" part is highlighted as the main source of the security, except.... mine obviously do leave my device, with the vault, so.....
jasonjayr 3 hours ago [-]
Yet, the Apple + Google implementations will sync passkeys between your devices. "Securely", of course. (I've seen first hand how Apple implements this, and it seems.... sound)
Sites can request hardware-bound tokens, which would block any software based password managers. It's an option in the protocol but one not yet widely utilized.
cryptoegorophy 2 hours ago [-]
So is there a problem with Apple or no?
SoftTalker 8 minutes ago [-]
I'd absolutely never trust Google to manage passwords/passkeys for me, with their habit of irrevocably auto-banning accounts. Apple seems... better? But that's today. That could change, and then you'd be screwed.
XorNot 3 hours ago [-]
Which is a problem.
It should not be in the protocol. And I don't trust Apple and Google not to lock it away from me.
I want my own open source manager and if that is attempted I want it to lie about it.
arcfour 48 minutes ago [-]
Can we try to play nice now and recognize that other people have diverging, but valid, interests from your own? For example, securing things?
lelandbatey 4 minutes ago [-]
It is playing nice to criticize things. It's not just "different priorities", passkeys have intentional trade offs which cause them to be "more secure" but in ways that users do not want because it negatively affects them. The intentional trade off made in the name of "more security" makes them wildly inconvenient and risks causing massive lockout. Like removing all the staircases from people's homes and replacing them with climbing walls all in the name of "security". You can't just diffuse that by say "well we want banks to be more secure, we have different priorities."
I am already seeing my "normie" friends getting locked out of accounts due to not understanding passkeys. If they don't have their phone, or it's dead, or it breaks, or is stolen, they just can't access their account anymore. They have no idea how they work or what they're trading off, nor do they understand that they should have prepared for this scenario ahead of time somehow. Upon telling them "yeah you have to use your phone now that you have a passkey" they all universally say "wtf, that's stupid, I never want to have that happen again, I will never use a passkey again."
Passkeys should never have been built for general audiences, they are a huge mistake, I hope they cease to be relevant and die due to everyday folks realizing they're inconvenient and the "more secure" gains ain't worth it for the usability nightmares.
drtz 49 minutes ago [-]
Lying about it may become impossible in the future when you throw hardware key attestation into the mix.
> Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.
I haaaaaate this. And every time I'm like, "do I not already have one??" Passkey implementation has been half-assed by everyone.
jeroenhd 3 hours ago [-]
> Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.
What setup are you using? Because I don't have that problem on Linux + Firefox at all
hannasanarion 1 hours ago [-]
Linux, Mac, and Windows (i happen to use all three regularly for work, hobbies, gaming), Firefox + Bitwarden.
It's totally possible there's something specific about my situation, or the way it was set up in the first place that enables this, idk, but somebody else replied saying they have the same experience so it's not just me.
And even if it was just me, it's still clearly something wrong on the provider's implementation, because it should not be possible for software to sidetrack the user into a passkey enrollment flow, when that user logged in with a passkey to open the current session.
alistairSH 2 minutes ago [-]
My only issue is the ... unclarity... with them.
The option pops up in the middle of a normal log-in flow. I'm guessing most non-techies don't know how it's implemented.
Oddly, some login flows display a normal user/pwd form, but you get the in-browser "use a passkey?" option/popup which further confuses matters.
Thankfully, me, wife, and all our parents are tech-savvy enough to use password managers, so the fallout from lost passkeys hasn't be an issue. But I certainly see how it would be an issue for anybody entering passwords from memory or similar.
elteto 3 hours ago [-]
While the technology itself may be great (I don't really know since I don't use them) it has been co-opted by the tech conglomerates as another form of isolating and walling off users into their ecosystems.
And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".
alibrarydweller 9 minutes ago [-]
I did a deep dive on this since progressively more places are taking a hard line about Passkeys.
The most flexible, independence preserving thing to do is to use a third party password manager like Bitwarden, and make that the default passkey flow for your devices. If desired, you can self-host something like Vaultwarden so that you can both keep the keys independent of third parties and walled gardens and also propagate them to other client devices.
To be clear I'd much rather not have learned / implemented any of this, and I don't use passkeys unless forced, but this seems like a valid coping strategy.
reddalo 3 hours ago [-]
Exactly. That's why I'll never use passkeys: they're just another way to force us into a commercial walled garden.
Passwords with 2FA are simply better and more freedom friendly.
apexalpha 2 hours ago [-]
I just bought a passkey... It's a USB device, completely separate from any big conglomerates.
reddalo 33 minutes ago [-]
But then you need to phisically carry it along with you everywhere you go, if you want to log into a service :/
SoftTalker 6 minutes ago [-]
And hope you don't lose it, or leave it in a pocket when you do the laundry, or plug it into a faulty USB port that zaps it, etc.
spider-mario 3 hours ago [-]
It’s a bit ironic that Apple is the one that lets you export them.
rcxdude 3 hours ago [-]
They're also not supporting device attestation which would allow websites to insist on particular implementations of passkeys.
dingaling 2 hours ago [-]
That's more because attestation breaks their passkey cross-device sync process, rather than out of benevolence.
mschuster91 3 hours ago [-]
> And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny.
The reason is the ever increasing number of hijacks of social media presences and code hosting portals, with the latter being a serious financial threat. Done right, passkeys stay in the Secure Enclave, at least for anything Apple and most of the Android sphere. There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
zamadatix 3 hours ago [-]
The doubt is more "how will tech companies use passkeys as an excuse to do something stupid" than "passkeys themselves must have inherent problems because tech companies are pushing them".
Passkeys could be the savior of all security problems worldwide from a capability point of view and tech companies would still ruin it by trying to force ways it pushes you into their ecosystem instead of just being whats both secure and convenient.
As an example, I have 3 different passkey _APPS_ on my phone and cannot go down to one because of various reasons with each (such as MS authenticator, forced for integrating to Microsoft at work).
iso1631 3 hours ago [-]
> There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
Click "I lost my device", enter contact, get a reset link via email/sms
terminalbraid 3 hours ago [-]
Email and SMS are not reasonable and both have an extraordinary number of flaws.
jmbwell 2 hours ago [-]
So use the recovery codes. Or scan the QR code and auth from another device
I’d buy that there are too many different confusing ways to recover from this situation, but not that it’s impossible
Barbing 2 hours ago [-]
>use the recovery codes.
Fun fact: Google can decide to reject these. Lose access to the original device, try to rely on recovery codes to login with known current password on family member’s device… nope!
iso1631 2 hours ago [-]
Sure, yet in the real world those are the acceptable means if you want your customer to continue to pay you when they've lost their phone.
3 hours ago [-]
nunez 1 hours ago [-]
I respectfully disagree with the author!
Passkeys have been a massive quality-of-life improvement. Yes, there's the minimal risk of lockout if you lose access to the passkey (though almost every site I've used that implements pk's lays it on top of their traditional user/pass auth flow), but generally speaking most people use iCloud or their Google account to store their passkeys, and because those sync everywhere, this isn't a real risk.
I love not needing to deal with 1Password's autofill being flakey and having to CMD-C/CMD-V passwords/passphrases/OTPs on these sites.
I like Yubikeys as well but they are super inconvenient by comparison when dealing with multiple devices. Setting them up is also very user-unfriendly in general; doubly so compared to passkeys.
Now, what I'd REALLY F'IN LOVE to see go away is the passwordless/magic link auth flow wherein you authenticate by clicking a magic link that gets sent to your email or text message inbox.
"Emails are super easy to hack and we're still not sure whether text messages are safe to send on US carriers, so let's have everyone click on a link sent by email or text so that they don't have to deal with those pesky passwords that iOS or Android will automatically suggest for them." Like, what?
rdsubhas 51 minutes ago [-]
> what I'd REALLY F'IN LOVE to see go away is the passwordless/magic link auth flow
This seems really naive? That's the only flow that's at the basis if you get locked out. What else, do you put people on the phone to verify people by asking their name and date of birth? That's even worse!
stetrain 43 minutes ago [-]
I think they're referring to sites where that is the only way to sign in, which I have seen a few of. Basically you can never register a password or passkey, every sign in requires going to your email and waiting for the link to arrive.
kyle-rb 53 minutes ago [-]
> Emails are super easy to hack
Source? And if somebody hacks my Gmail account, won't they be able to access my Google-synced passkeys?
Magic link auth isn't any less secure than any site that has a password-reset flow.
boronine 1 hours ago [-]
Majority of websites use email to authenticate (“forgot password” flow). Passwords/passkey is just an optional convenience for quicker login.
alerighi 41 minutes ago [-]
To the day where your device breaks, you had set a passkey to access your Google account (because the phone did prompted it up and you did not understand and clicked yes), you did not setup a recovery method (such as another email/SMS) or you did setup a recovery method that still depends on the Google passkey access (e.g. a second email account where you sign in with Google or has Google as a two factor verification!) and you are locked out of your Google account. Good luck at that point contacting Google assistance, you may as well consider that account as lost forever since there is no way to talk with an human being.
And unfortunately is something I start to see to family members/friends that are not tech experts when they ask me to setup them up a new phone... at least the passwords they would have written them in some notebook that they had at home, or always used the same for everything, but with passkey... and when you tell them that they lost access to their email, possibly the files backed up to Google Drive/Google Photos, etc they are surely not happy.
Also passkeys makes it difficult to get access to your account in an emergency scenario, what if I loose my phone and I'm not signed in to other devices? Maybe I've setup an SMS as a recovery method, but first I have to get to my phone company to request another SIM card, maybe I'm on vacation on the other side of the earth in vacation for 2 weeks, I'm locked out of my Google account, and from all accounts that uses the passkey as a sign-in method (including, for example, the account that I need to use to check in on my return flight, or my banking app that I need to pay stuff!)
PennRobotics 26 minutes ago [-]
Partner's mom lost phone. Partner called me with mom's password. I went to Find Hub. Entered email and password. "Hold on, we're sending the lost phone a verification text."
madog 1 hours ago [-]
> Yes, there's the minimal risk of lockout if you lose access to the passkey (though almost every site I've used that implements pk's lays it on top of their traditional user/pass auth flow)
Exactly, if you lose your passkey you just sign in with your password like you did previously. I'm yet to find an app/website that has passkeys only and no passwords.
Seems like a total non-issue to me.
6 minutes ago [-]
epihelix 29 minutes ago [-]
Ok, so the big security risk that passkeys are supposedly designed to stop, is actually still there?
If you can still be phished, remind me what the point of any of this was, again?
morgoo 1 hours ago [-]
One of the big benefits of passkeys is that you can completely remove the ability to log in with a password!
tcoff91 50 minutes ago [-]
Just spitballing here, but it seems like a good mix of phishing resistance & lockout recovery would be to have passkey-only auth, but with email recovery.
So no password login, but then you can recover your account by adding an additional passkey by receiving an email.
jayknight 10 minutes ago [-]
Just make sure you don't lose the passkey to log into your email.
drtz 54 minutes ago [-]
> and because those sync everywhere, this isn't a real risk.
Do they sync between Android and iPhone devices?
pottertheotter 15 minutes ago [-]
I'm in the same spot. It seems like every month a post pops up here that's "I hate passkeys" and most of HN seems to agree.
I use 1Password, but passkeys have made things even easier. I'd rather have them than any 2FA method. So many websites make me use a login/password AND then send me an email or text with a code. Every. Single. Time. You're really telling me you would rather do that than have a passkey?!
And, like you said, passwordless email auth is really terrible.
torstenvl 27 minutes ago [-]
> To an individual, the greatest risks are instead permanent account lockout, automated account bans, and device loss. By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts.
I'm glad to see this view becoming more mainstream. Passkeys are grotesquely insecure.
The only possible way to consider them more secure is if phishing attacks were more common and more damaging than lockout, which is so implausible that I reject the idea that someone could take that position in good faith.
bennetthilberg 10 minutes ago [-]
> Passkeys are grotesquely insecure.
Lockout is a real risk, but there is nothing insecure about passkeys. Private keys stored on the secure enclave + biometrics or passcode before any signature is produced + origin binding mogs a static string and a 6-digit TOTP (often generated with a secret key outside the secure enclave) that can be phished and entered from anywhere. Also, in many (possibly the majority) of scenarios where someone is locked out of their passkeys, they’d also be locked out of TOTPs and passwords.
> The only possible way to consider them more secure is if phishing attacks were more common and more damaging than lockout
You’d be surprised.
torstenvl 4 minutes ago [-]
> Lockout is a real risk, but there is nothing insecure about passkeys.
This statement is internally contradictory.
joshstrange 3 hours ago [-]
I continue to avoid passkeys but it's becoming an incredibly dense minefield. Certain sites try to trick me into adding one each time I log in and I have to be careful to dismiss the 1Password prompt, then dismiss the chrome prompt, then dismiss the OS-level prompt (all back-to-back). It's so incredibly user-hostile.
my-huge-pony 1 hours ago [-]
Wow, we live in completely different worlds. I don't remember seeing a single passkey prompt. I basically only login from my Linux desktop using Firefox, do I assume my software stack just doesn't support them?
fendy3002 49 minutes ago [-]
IIRC last time I cannot access outlook email (the website one) without setting up and use passkey
dahart 1 hours ago [-]
Three of those four prompts are opt-in and configurable and aren’t the site’s fault, no? I disable the browser and OS password managers because I use 1Password… why do you have the Chrome and OS password managers enabled if you’re using 1Password? Or if there’s some reason you need them all available, at least rather than dismissing the prompts, why not add an entry to disabling prompting for a specific site in the 2 managers you don’t want to see again? All three support that.
joshstrange 1 hours ago [-]
On my phone I don’t see any way to disable the system passkey option. I have only 1Password toggled on in my settings but I still see the system prompt to save a passkey. It’s maddening. I’ll have to double check on desktop but I thought I had toggled off everything but 1Password.
Perhaps I missed something or perhaps it really is that user hostile. It wouldn’t surprise me in the slightest.
frizlab 2 hours ago [-]
Where do you have so many sites asking for passkeys? I’m desperately trying to have more but I have ~1.1k passwords in my password manager and only 63 passkeys!
joshstrange 2 hours ago [-]
It's the banks/Amazon/etc-type places that keep prompting me, coupled with random one-off websites here and there. When I upgrade my phone in a month or so I'm dreading the deluge of passkey requests I'll run into and having to deny it multiple times per initial login.
My annoyance with the prompts is not evenly spread over the sites I use, it just so happens the same sites that think short login periods = security (it does not) are also the same sites that think passkeys are the best thing since sliced bread.
I have such a low opinion of any company that logs me out every time I turn around and those are the same disrespectful companies that think it's appropriate to spam me with passkey requests when I login. My dislike also extends to those companies they have a "Remember me" or "Remember this choice" checkbox that is decorative, as in it doesn't do anything. Often paired with clicking external links in things like a banking website "Warning: You are leaving this site!", yeah, I know how the internet works, I don't need to be babied by a completely ineffectual dialog (if you think normies are reading that and not just clicking through, you are living in a fantasy world).
frizlab 2 hours ago [-]
Interesting. For the GAFAM yeah, I got those. But for banks, in my country at least, I’m not sure they are even allowed to use passkeys. Instead we have a glorious numerical keypad where we have to manually click on the keys and the keys are never at the same place. I’d love to have passkeys instead…
conradludgate 18 minutes ago [-]
It's usually the same site that keeps asking in my experience - they don't bother to remember your preferences
dboreham 1 hours ago [-]
The worst offender for me is the Costco mobile app. It's handy because it allows you to enter the store by scanning the QR code it displays on start up. However it also nags you to create a passkey. You can dismiss this by saying that you want to keep using a password. But then it nags you again next time. This behavior is problematic because the delay between opening the app and the "create a passkey" splash dialog (which hides the QR code) is exactly the time it takes to pull the phone out, open the app and present the screen under the reader at the door. Every single time I need to look back at the phone screen to see why it didn't scan, dismiss the passkey nag, bring up the QR code again, scan.
Liftyee 3 hours ago [-]
YES. This exactly. I work across multiple devices, some of which are nonstandard/uncommon (Linux, Xiaomi China ROM, ...) and I've NEVER had passkeys work properly - yet everything constantly prompts me to add one. Even if they did work, I'd have to carry around hardware keys or register each computer separately. And the lack of backups if a device is lost/broken is definitely a larger concern for me than being phished of my TOTP keys.
utopiah 2 hours ago [-]
> lack of backups if a device is lost/broken
Same as traditional physical keys, you don't have a single key, you have multiple ones precisely so that if you lose/break one, you are not stuck and can go to the local locksmith and get another one in minutes.
In fact it's even nicer since you can just re-use the backup key with no security loss by revoking the other one, and buying another key.
cesarb 26 minutes ago [-]
> Same as traditional physical keys, you don't have a single key, you have multiple ones [...]
I have multiple identical ones.
> [...] and can go to the local locksmith and get another one in minutes.
Can I go to the digital equivalent of a locksmith (like a backup software) and duplicate my passkey? Can I do that with only my passkey in hand (without having to do anything to the corresponding lock, or having to contact its issuer), like I recently did with a physical key?
account42 1 hours ago [-]
For physical keys I don't need to ask permission to be able to make a second or third copy.
utopiah 1 hours ago [-]
You don't need to ask permission to buy another key then register it to your self-hosted service.
In fact if you have the technical skills to make your own physical key and respect standards, e.g U2F, you don't even need to buy one and it will work with existing devices and services. I can recommend the Precursor for an interesting exploration of that from a verifiable software/hardware perspective.
cpburns2009 41 minutes ago [-]
It's not like physical keys at all. You can get copies made of those. Passkeys deliberately are not copyable.
girvo 3 hours ago [-]
My wife clicked through a Google dialog and suddenly was using a passkey. It absolutely happens, though IMO more to the non technical users. I know what those login dialogs and pop ups mean, and decline them.
(At least til I get around to setting up my new usb c yubikeys!)
vanschelven 3 hours ago [-]
Passkeys remind me of ipv6 in that they are a "solution" coming from the supply-side, without (apparently) having done any research in what motivates actual users (and what would motivate them to switch).
<<ducks>>
coldpie 2 hours ago [-]
They make sense as a technology for businesses & their users. In that scenario, the owner of the account is not the user, but the business. It makes sense for the business to be able to place strong restrictions on how & where the user may log in, it fixes a lot of real problems businesses may have thanks to sloppy user behavior, and the business is also motivated to provide a way to fix broken logins. It's a good solution for that scenario.
But for regular end users where services are primarily motivated to take money from those users and lock them into their ecosystems, they are a usability disaster and yet another exploitation vector.
It's one solution for two very different usecases, and it just does not work. There is an approach that could work for end users who own their own accounts, but they need to go back to the drawing board and rewrite the protocol with the assumption that the keystore is hostile to the user's interests. That means strong guarantees on key portability so users can migrate away from hostile keystores, and absolutely no ability for services to restrict the user's choice in passkey provider software.
frantathefranta 2 hours ago [-]
I think passkeys were made to work in mind with complete idiots (here's a pop-up, tap it, now you have access to website without password, don't think about where it was saved or that it exists at all). I can understand parts of IPv6 like Router Advertisement being like that but there is so much customizability for the user that I can't really see them being similar that way.
cpburns2009 55 minutes ago [-]
Except they never considered that "complete idiots" could lose access to their phone's passkeys.
tway235 2 minutes ago [-]
password managers that allow to export OUR passkeys: Bitwarden, Enpass
it's all backwards, I agree, even worse that we trust "sync to the cloud" but don't allow users to own their credentials.
kenrick95 3 hours ago [-]
Passkeys have a marketing problem where no one is able to describe simply what it is without having to use technical jargon. There's also the problem where each OS tries too hard in pushing this to the face of end-user
ryan-duve 3 hours ago [-]
> Passkeys are passwords your second device makes/types for you, without you ever seeing it.
My bigger problem with passkeys is how there's no universal way to register more than one device (in case the first one is lost).
jmbwell 2 hours ago [-]
This burden is on the site using passkeys. There should be some equivalent of “My Account > Security > Passkeys > Add Passkey.” There often isn’t, which is an incomplete implementation. And yes it’s frustrating.
account42 1 hours ago [-]
Sites didn't need to do anything special for this use case with passwords so it is a passkey problem.
blackdahlia313 3 hours ago [-]
Proton Pass. I moved to it and love it.
malfist 3 hours ago [-]
Proton Pass hardly meets the bar of "universal way to register more than one device"
Proton Pass is a specific way to do that, but not a universal way. Bitwarden can't use proton pass to move keys around, google can't, firefox can't.
3 hours ago [-]
cfiggers 3 hours ago [-]
Imagine a password, but it a) types itself for you and b) detects when it's being sent to an impostor site and blocks them from seeing itself, so it can't be phished.
Tada, passkeys.
rcxdude 3 hours ago [-]
Cool, where are they stored? (I know the answer: 'it depends', and that's the big problem with their usability: most users haven't a clue what the answer is and most tech support can't answer that question straightforwardly because it depends on some decisions the user probably didn't even realise they made).
iamnothere 3 hours ago [-]
On my keychain in a USB hardware token. With a couple of backup tokens in fire safes.
rcxdude 3 hours ago [-]
If you're using a USB hardware token your knowledge of it is at least an order of magnitude better than the median user's. I know where my passkeys are stored, I don't know where my family member's passkeys are stored and neither do they. The same is true for most of my otherwise fairly technical co-workers.
iamnothere 1 hours ago [-]
There needs to be industry and government leadership on this to gradually require hardware token usage, for at least critical financial and government applications. Right now everyone is putting their energy behind passkeys, but those are much harder to understand than a physical token. I don’t know any non-technical people who understand how passkeys are normally tied to the device (or the manufacturer-provided cloud account in some cases), how to set them up on a second device, why you might want to do that, etc. And many technical people still don’t get it either!
faust201 1 hours ago [-]
Then that family member does not worry like you do worry. The main point is assuming one can have a proper security for Google account - everything else becomes easy.
The fearmongering of losing google account should stop. Yes, some people lose it. There are a larger proportion losing/getting pwned by repeat use. For the majority - just pressing the fingerprint to access an account (like amazon/eBay) via passkey is great.
Fairly technical co-workers - I used to suggest them to buy USB security key few years ago. Now that same fairly technical some how has at least 2 devices with them - so they just skipped the USB security key need - and just use Google (in Android) or iPhone in Apple ecosystem. Everything just works.
Yes, there will be a poor soul that may lost everything with only one device.
iamnothere 55 minutes ago [-]
People keep their entire lives in cloud accounts these days. Their passwords, financial history, copies of important documents, baby photos, etc. Losing access to it is incredibly disruptive and may result in unrecoverable losses.
It shouldn’t be this way, but it is.
UltraSane 1 hours ago [-]
The biggest issue with passkeys is that since most USB tokens that support them don't allow syncing the private key to a backup device you have to enroll ALL of them to every site that supports passkeys. This is annoying but it makes storing backups in secure offsite locations impractical.
It's beyond annoying. It's creating needless toil that no "normies" will ever actually do.
I'd love a hardware sold in multi-packs and "born" at the factory with identical internal device key encryption keys (DKEK). I'd love, even more, if a token just allowed you to "commission" new ones w/ a user-specified DKEK on first use.
I'd use one token as a daily driver and store the other(s) in safe location(s), empty of my personal key material. (Or, if I can just commission a new token w/ my DKEK, store a printed copy of my DKEK in a safe location.)
Give the token a mechanism to "type" a backup of its internal state, encrypted with the DKEK, as a USB HID keyboard. That gives me an easy way to backup the token each time I enroll a new website.
If I lose my daily-driver token I just pull a spare from storage, import my last backup, and I'm up and running.
That would kick ass. No "You just need to buy two tokens and enroll them in every website" bullshit.
wolvoleo 3 hours ago [-]
In a secure vault on your phone
malfist 3 hours ago [-]
How do I use it on my desktop or laptop then? What if I switch browsers on my phone? What if I get a new phone? What if I change from android to iOS or visa versa? What if I need to log into the site on my Wii U's browser?
Johnny555 50 minutes ago [-]
You can let Apple sync your passkeys between devices using iCloud Keychain. Then you can create a passkey on one device and have it available on all of your devices.
malfist 46 minutes ago [-]
Apple can sync to my wii u?
faust201 1 hours ago [-]
as long as you have one working device all will be OK. Either you scan the QR code shown by the website. or if you did login to Chrome with google account then desktop or laptop will just sign you -friction less. Same with iCloud account.
If you browser vendor has implemented passkey then all good.
Most things are built for the majority users. Most don't change. Most don't debate browser wars in hn. Life is like that.
For Wii etc. You just scan the QR code shown in the TV interface. all just works.
Yes, if you want 100% privacy and will do only your own dovecot server then it is not for you.
mystifyingpoi 3 hours ago [-]
So if I drop my phone to the toilet, I will forever lose access to everything? Since the vault is on my phone.
faust201 1 hours ago [-]
A majority have more than one phone. Or at least they can get a new SIM card and sign into the iCloud account. Then all passkeys are synced from cloud.
Yes, if you are edward snowden then not for you. For rest of us - it is useful
recursive 46 minutes ago [-]
This is crazy. I have one phone and zero iCloud. I don't think I'm that unusual.
chrystalkey 54 minutes ago [-]
Idk how much money you must be having, but all of my bubbles only ever go with one device
caryme 1 hours ago [-]
A majority have more than one phone?
rcxdude 3 hours ago [-]
Not always. And which vault? There can be multiple on a given device. This isn't some hypothetical 'mollify the user's worries' question, this is an important practical question of what do they need to worry about losing access to. Trust me when I say that most users I have talked to have absolutely no idea about this, and usually only find out when they've already lost them.
cpburns2009 48 minutes ago [-]
Great, what happens if I lose my phone?
alt227 2 hours ago [-]
As others have pointed out, this is a terrible oversimplification which misses all the nuances which cause people headaches when using passkeys.
To your point, I for example would add point c) - Is linked to the device you are using currently. If you want to use another device to log in you are in a world of complexity and pain.
flerchin 3 hours ago [-]
But how do I type it into my new phone?
vntok 2 hours ago [-]
It depends.
Are you part of the 99.99999% users of one of iOS+Apple or Androidlike+Google/Tencent or HarmonyOS+Huawei? If that's the case, you don't need to as the key is automagically saved by your OS' platform and synced with your new device.
Otherwise, you're such an extreme outlier that you probably either know what you're doing or can find out by yourself, right?
dspillett 58 minutes ago [-]
> … users of one of … Google …? If that's the case, you don't need to as the key is automagically saved by your OS' platform and synced with your new device.
This absolutely does not encourage confidence in me. We all know how easy it can be to get locked out of a Google account and have no way of getting back in unless you have enough clout to make a huge noise online so a human there pays attention instead of you being stuck in the 'ol support-bot-run-around loop. It doesn't happen often when you consider how many users there actually are out there, but the potential inconvenience is high enough that “fairly rare in the grand scheme of things” is still enough to be reason enough to be wary.
faust201 1 hours ago [-]
The point is people like this usually are arguing as they hate adopting new tech. And they hate FAANG. No way to convince them.
etatester 3 hours ago [-]
It's a key, what else do non-technical people need to know?
Ironically on macOS we used to have an app called Keychain which unfortunately was effectively renamed to Passwords for non-technical users.
paulryanrogers 3 hours ago [-]
It's a digital key.
Unlike physical objects they may reside in a TPM, a software vault, an export/backup, or any combination thereof. You may or may not be able to recover or migrate them, depending on where/how they were made.
Therefore you may need multiple per service, or maybe not. Services which only allow one may end up locking you out with no recourse. You get to find out.
None of this is obvious or self explanatory to normies.
etatester 2 minutes ago [-]
That's false. It's a digital key and it doesn't matter where it's stored. My key is on iCloud and it can be unlocked with my many recovery methods and contacts https://support.apple.com/en-us/102641
As for normies, passkeys or passwords it doesn't make a difference. Either you have people who use love1969 everywhere or those who constantly lose their passwords.
All passkeys accounts for normies require an email or phone number, which is what you can use to recover a password or passkey exactly the same way.
kskdkwkdkwk 3 hours ago [-]
Probably because these caveats and weird behaviours are platform-dependent, not really the passkey’s fault.
Passkeys really are not any more difficult to explain than 2-factor authentication. Anyone who’s currently been able to actually create an Apple or Google account and successfully navigate their devices up to a passkey screen will be able to grok how it works.
People around here really ought to stop thinking users are complete idiots. Hell, you don’t even to scroll that far to read people calling users “normies” for crying out loud. What is this? High school?
cpburns2009 44 minutes ago [-]
I don't care about the theoretical sufficiently advanced keypass implementation that works perfectly. I want to know about the half baked ones in the real world that I'll have to deal with.
alt227 2 hours ago [-]
You obviously dont have to deal with anybody who doesnt know how or want to use computers.
paulryanrogers 53 minutes ago [-]
Do you know how many Google and Apple accounts my boomer parents have?
Roughly one per smart-phone that they've ever used. They don't know the passwords or even the email address of any of them, not even the latest.
arwineap 3 hours ago [-]
The keychain and passwords app are separate and keychain still exists
I always operated under the assumption that the passwords app was just a more casual view into the keychain
Maybe that's a bad assumption
joombaga 3 hours ago [-]
They're separate stores. I was under the same assumption until I tried to use `security` to get a saved password. It doesn't work, and as far as I know there is no CLI for the Passwords app's store.
lezojeda 3 hours ago [-]
[dead]
mikepurvis 2 hours ago [-]
Surely it's a pretty easy pitch to average Joe: Using a passkey takes the place of typing in a code they sent by text or email.
That's a pain point in everyone's day that should make the benefit easy to understand.
alt227 2 hours ago [-]
ok cool so when somebody logs into a site on their phone and sets up a passkey, then goes to their laptop and tried to log into the same account, how do you easily explain how to deal with this situation?
kps 43 minutes ago [-]
You don't. A laptop might still be a general-purpose computer under the owner's control, and we discourage those.
stetrain 39 minutes ago [-]
What I have seen is that the site gives you a QR code to scan with your phone. People are already used to needing their phone to sign in via an Authenticator app or SMS code.
jmbwell 2 hours ago [-]
I tell people a website is like a payment terminal. Your device is like your debit card. A password is like a PIN on the card. A Passkey is like a chip on the card.
Logging into a site with your device is like putting your card into the terminal. The site can ask for a password the way the terminal asks for a PIN, but if your device supports Passkeys, that’s like your card having a chip, and it’ll use that instead.
So think of Passkeys like using a chip card.
I dunno how well this analogy works down to the last detail but it has gotten it across to all the parents I’ve used it with
seirim 1 hours ago [-]
Great analogy, am going to use that going forward, thank you.
dgunay 1 hours ago [-]
Do most people understand why cards have a chip in them now?
Spide_r 3 hours ago [-]
That's the main thing I wish was done better. There was barely any actual lead up from the perspective of an average person. Just a new unfamiliar flow on half of the login screens that they use.
Sure, its explained. But not in a satisfactory way that would reach all users at their level.
This is a bit of an exaggeration and out of proportion, but I think my ideal would be one of the big tech companies should have bought out something like a super bowl ad. Something that actually conveys the idea "hey, we know you've used passwords since you were able to type on a keyboard, but here's new technology that's better and here's why" in plain language that the average person can understand.
Unfortunately, XKCD 2501 continues to be relevant. [1]
The average person? I have a Master's and PhD in CS, code regularly, and have followed and used all the cool technologies from the days of gopher, telnet and Mosaic to crypto, and lately LLMs. And I still don't have a clear enough picture of passkeys to know really basic things like "what if we have a family computer but each wants to access their private accounts and keep the others from accessing?", "what do I need do to login from an airport computer?" or "what should I do if my phone is stolen?"
If it's that unclear to me, I can't imagine how it can be to the average user.
The way they explain them is atrociously unclear, borderline negligent for services that nag people to activate it for accounts where they may hold valuable data for their personal lives. And while I don't want to spend much time finding out the details as long as I have the option to decline them, I suppose if they can't explain it and convince people of its advantages, it's because it's just bad tech.
alt227 2 hours ago [-]
I cant upvote you enough for this very concise explanation of passkeys pain points.
dboreham 1 hours ago [-]
As implemented they also lack conceptual integrity: you get them somehow (where are they?), and somehow you can use them (how, exactly?) but you can't enumerate them anywhere, see them, see where they came from and what they can do for you.
lezojeda 3 hours ago [-]
[dead]
littlecranky67 2 hours ago [-]
I try to boycott passkeys due to built-in attestation feature in the standard. Not active now, but given how Google+Apple already use the passkey feature to lock you into their ecosystems, it is just a matter of time until their service will require that the passkey is attested from a non-rooted Google or Apple device. I think this will especially be true for Google to prevent AI scraping bots. Turning this on does not require anything, once passkeys are widely used, Apple, Google and Co. simply can flip a switch.
EvanAnderson 23 minutes ago [-]
> Not active now, but given how Google+Apple already use the passkey feature to lock you into their ecosystems, it is just a matter of time until their service will require that the passkey is attested from a non-rooted Google or Apple device.
I'm with you 100%.
There will be evil and stupid uses.
The brain-damaged people who think disabling paste on password fields is a security feature will be all over forcing device-attested passkeys as soon as they learn about it.
Evil people will see it as a proxy attestation of humanity.
Either way it will be rammed down our throats if passkeys are widely adopted.
nottorp 1 hours ago [-]
> When you have to handle a colleague’s computer, it gets much more inconvenient.
Let's add to that: What if you're on holiday and your phone gets stolen or is suddenly 20 meters under water because it fell off the boat?
What if you are a normal person who only has a phone and it simply dies for one reason or another?
You get a new phone then hire the boat again, go above where your phone fell in and hope it syncs your passkeys?
AntonyGarand 56 minutes ago [-]
You should always plan for your currently active device to be bricked suddenly and act accordingly.
You either should treat your passkeys with a backup like any data, this can mean multiple hardware keys or a cloud backup of your passkey, like bitwarden or the provider's native backups.
raesene9 39 minutes ago [-]
The key word in the post you're replying to is "normal". Non-technical people don't (in my experience) plan for this kind of thing, like at all.
The idea of multiple hardware keys, which have to be enrolled individually to every site, is just not an ordinary end-user friendly activity.
So passkeys may be great for technical users (who are happy doing that) or corporate users (where centralized IT systems can be put in place) but not for standard non-corp users (which realistically, is most people)
35 minutes ago [-]
nottorp 42 minutes ago [-]
Bet you have a home lab.
Not talking about you. After all passkeys are not there to protect people who have home labs and don't recycle passwords anyway? They're for normal people who only have one device.
> who are happy doing that
You think they're happy? I'd say they grudgingly comply at best.
Suppose you do want a secure solution for the main sites your stuff is on. But every piece of shit content mill also wants to set up a passkey.
rconti 14 minutes ago [-]
My situation at work is absolutely untenable. Constant redirects, logins that used to have passwords but now have passkeys, but you don't find out until you enter the password. Chrome hijacks the passkey dialog and wants me to use my yubikey, but I have to fumble around and bypass that to then get it to prompt me for a passkey in Apple Passwords. (as long as 1Password isn't trying to intercept my passkey requests today!)
Then on top of that there's a whole 2nd factor layer which _also_ typically involves a touchid press but for a totally different reason (as the 2nd factor, not to unlock the password safe storing my passkey.
It's just an ugly inconsistent dance, dozens of times a day.
I know these gripes are mostly about implementation, and partially about user-facing software, and partially about user choices, but it doesn't make it any less ugly for the user.
eviks 1 hours ago [-]
> Since they are bound to the site they are created for, they cannot be phished by a hacker’s fake login screen.
With the app you use to store those keys (a password/key manager) it's the same - you simply wouldn't have an autofill working. Sure, people can and will circumvent this for the benefits of the scammers, just like they can circumvent passkeys using non-passkey login option, indeed:
> weakest recovery method: SMS
> If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details.
Similarly, don't other modern password storage methods have the same property?
> lacks the decades of UX polish towards password autofill.
A lot of years in those "decades" have been wasted polish-wise: you still can't log in with a single button, e.g., many popular sites only fill a username first, then require an extra dealy and action before accepting a password
SkyeCA 2 hours ago [-]
They're a solution to a problem that were created by people who are completely out of touch with normal users and how they use computers.
Sure they work fine on a technical level, but they're frustrating and confusing for the vast majority of people I know.
PaulHoule 2 hours ago [-]
Depends. They make it pretty easy for people who don't think about the consequences of things.
I worry I am going to get locked out of my Google account, muggles don't. Doesn't stop them from getting locked out.
Apple has a vision where you have an iPhone and a mac at home and a mac at work and a vision pro and an Apple TV and all of that and your passcodes "just work". Doesn't work for the "rest of us", like we're already used to AirPods punishing us for using Windows.
fg137 29 minutes ago [-]
Similar for "automatically enabling Bitlocker and uploading the keys to microsoft server".
If it works without any issues, great.
But if you ever run into one of the 50 messed up situations, good luck.
ectoloph 3 hours ago [-]
I am conflicted with passkeys.
I actually prefer non-resident U2F in some ways. You don't have to store anything on your key, you are just signing requests. This is relevant where U2F/FIDO keys have limited slots for 'resident' keys.
In principle, it's great. You have one good password to remember for the average user, and that's enforced by their device's probably good enough security posture.
They are resistant to being phished and they won't reuse the same one everywhere. They then don't end up going from hunter2 to hunter2! everywhere.
But my experience for users is that they worry they are giving their biometrics to Amazon or whoever and so the UX just confuses them.
The certification aspect was new to me too last time passkeys came up. Sites can require that a given passkey has been certified.
The patchy support for them is also frustrating. MacOS does not support NFC FIDO/U2F. iOS does.
iamnothere 40 minutes ago [-]
Absolutely! U2F keys are unlimited, but I only have so many slots on my hardware key. And now sites are moving away from supporting U2F towards a passkey-only model. No! I have limited slots!
ethin 49 minutes ago [-]
I love passkeys. Really. They completely eliminate the need for a password and OTP in most cases (when actually used as they were intended and not as a second factor only), although I always set up both in case. Although I will never, ever like how Google does it. I set up my first Google account with them and now Google absolutely refuses to allow me to authenticate to it because it wants a passkey I don't have (and of course there's no way of not using said passkey) or it wants me to use an Android phone I (also) don't have (I traded it in a couple years ago). And, of course, it provides absolutely no way around that problem. So eventually I just gave up and created a new one for the (rare) times I do need a Google account for anything.
jmull 15 minutes ago [-]
> refuses to allow me to authenticate to it because it wants a passkey I don't have... it wants me to use an Android phone I (also) don't have
And yet you love passkeys? How much will you love them when you're locked out of something you can't do without?
bennetthilberg 25 minutes ago [-]
> A combination of randomly generated passwords stored inside a third-party password manager, paired with an independent TOTP app, gives control to the user without giving up the flexibility of plain text.
No grandma, don’t use the unphishable one-click passkey setup that syncs across all your devices. Instead, install a third-party password manager (no, no, not the one built in to your device or browser), then another TOTP app on your phone. It’s slower and more susceptible to phishing, but uhhh, what if you’re among the one in a million people that has their Google or Apple account wrongly banned?
unethical_ban 6 minutes ago [-]
Infosec for 15 years, and I do not want passkeys either. Anything that attaches itself to hardware is susceptible to loss. Anything that attaches itself to hardware makes it harder to use services from a new device.
At some layer you have be able to access your services with password/totp if only for recovery. Passkeys add a layer for minimum benefit, in my opinion.
Yes, push based totp and passkeys are more phish proof but for non techies, managing them is its own job.
xyzzy_plugh 3 hours ago [-]
Do passkeys improve security posture for the average person, reducing the likelihood of them losing their accounts to fraudulent actors? Absolutely.
But they also introduce single points of failure, as the article points out. I can't even remember how many times I've had to help a family member recover their account or get confused when they can't sign in on a new device. It's incredibly frustrating that this flow is promoted as the default for so many services.
1password is the best solution I've found for the average person. It's not perfect (it's definitely more complex than writing down your passwords on a piece of paper or using the same password everywhere) but it's much easier than juggling yubikeys. I know so many non-technical staff members who prefer the OS or browser keys even if it means another account recovery is lurking around the corner.
patrickmay 2 hours ago [-]
From TFA: "Both Apple and Google want your identity anchored to their operating systems. The “happy path” on their devices is to use their synced passkey management tied to your Apple or Google account. If their automated systems decide one day to ban your account, you irreversibly lose access to all your passkeys used across all third-party accounts too."
This is, in my opinion, the most serious problem with passkeys. I'd like to adopt them, but this is a blocker.
pamcake 2 hours ago [-]
If this is your only blocker you could still use passkeys with a different provider, like KeepassXC?
dariosalvi78 1 hours ago [-]
you can use password managers that support passkeys, or a HW key
account42 2 hours ago [-]
> Passkeys are a fantastic technology. Since they are bound to the site they are created for, they cannot be phished by a hacker’s fake login screen.
The same is true for passwords with a password manager.
> If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details.
Also not really a problem with randomly generated site-specific passwords in a password manager.
Really all the browser vendors had to do was add an API to make automatically generate a password that is then stored in the user's password manager the low friction option.
rcxdude 2 hours ago [-]
If you're doing that you might as well use public/private keys. The issues with passkeys are around user experience and education about how they are stored, and a lack of good backup options like enrolling a not-present device as opposed to relying on syncing them through an external service.
account42 1 hours ago [-]
The difference is that no password manager I used ever tried to hide my passwords from me.
BoppreH 3 hours ago [-]
Completely agree. I think the root of many of its issues is the inability to add a key that you don't currently hold. This prevents me from storing a backup key in a safe, for example.
I proposed an alternative scheme many years ago: https://www.researchgate.net/publication/343318317_Privacy-a... . By allowing "offline" keys you can also treat them as higher priority, and use them to revoke any lesser keys from attackers if your account is compromised.
It would also be nicer to get rid of usernames, but that's a fight against the data-gathering powers that we're unlikely to win.
kccqzy 2 hours ago [-]
The author talks about the problem with using hardware keys, but they neglect to mention that many websites and apps simply do not allow the use of hardware keys! They will insist you use Apple or Google syncable keys. So after you have spent the money to buy 2 or 3 hardware keys, you find that they are not accepted.
account42 56 minutes ago [-]
That websites get any say at all about which client-side software or devices you use is already a misfeature makes passkeys a nonoption.
iamnothere 3 hours ago [-]
I don’t like how tokens have gradually evolved from a secure 2F device that you carry with you (Yubikey etc) to a single factor “passkey” that’s built in to your computer/phone, or worse, a password manager with export capability.
It should always have remained a second factor device. It’s not impossible to teach people to use these, European banking did it for years. There’s just no will to do it.
kccqzy 2 hours ago [-]
If a user doesn’t have a second factor, what should their first and only factor be? The passkey people are trying to posit that a passkey is better than a password as the only factor.
iamnothere 1 hours ago [-]
Second factor should be gradually ushered in everywhere over a period of years, starting with banking, until it becomes second nature for users. This would effectively end concerns over strong or reused passwords, and would make phishing incredibly difficult.
Under this scenario, the first factor can be a short password or even a PIN.
dalyons 2 hours ago [-]
It’s because we have effective biometrics now, so the need to carry around an inconvenient limiting physical 2nd factor is obsolete (for the vast majority of regular use cases)
izacus 2 hours ago [-]
We also have devices with yubikeys built-in now.
48 minutes ago [-]
sikozu 2 hours ago [-]
I 100% agree with this.
I have physical passkeys, one attached to my keys and another on my desk at home and I absolutely hate software based passkeys. Every single time I'm asked for a passkey it always ask me if I want to use my Apple Keychain first and I wish I could default to physical.
throwaway27727 3 hours ago [-]
Passkeys are great in that its turning login support on websites into simple "autheticate your device to seamlessly login". My biggest gripe is that it seems Apple/Google are using this to consolidate control into their own password ecosystems and don't support password managers as a store for passkeys.
juancn 3 hours ago [-]
Account lockout as the author mentions is the biggest risk on personal accounts.
Passkeys just make it harder/riskier.
wg0 3 hours ago [-]
They really are bad. Passkeys have turned out to be just another password that you cannot even memorize.
john_strinlai 3 hours ago [-]
>just another password that you cannot even memorize
there's some issues with passkeys, but not being able to memorize them is a feature
wg0 3 hours ago [-]
So where do I keep my pass keys is the problem. They are in my password manager just like another password. So what's the point of having them because effectively, the passwords in the password manager and the passkey in the password manager offer the same UX to me? Except that at least I can memorize a password by heart just in case.
john_strinlai 3 hours ago [-]
>They are in my password manager just like another password. So what's the point of having them because effectively, the passwords in the password manager and the passkey in the password manager offer the same UX to me?
same ux, different security properties.
>Except that at least I can memorize a password by heart just in case.
"just in case" should be a thought out recovery flow, rather than hoping that you remember the password of the account you need to access.
drdexebtjl 2 hours ago [-]
That is the point. They stop you from memorizing it “just in case” and reusing it, and they force you to use a password manager.
For the average user, which doesn’t use a password manager, this is great. It means they can’t get phished. And it’s also great for the average password manager user, who keeps dozens of insecure and reused passwords in their vault because they manually thought of a password when signing up instead of randomly generating one.
If you’re already using a password manager and random passwords, the UX is designed to be the same. It’s just a way to get regular people to do this.
account42 1 hours ago [-]
A corportation's feature is a user's bug.
28 minutes ago [-]
blackdahlia313 3 hours ago [-]
And this is why people bash passkeys, but they hear a buzzword lol
axus 1 hours ago [-]
Passkeys match a very unique situation where I don't want to store anyone's email address, don't want them to type anything, generally want to store as little information as possible. Also don't want it to be easy for people to share/steal passwords/accounts, and prefer storing on the local device.
Windows still required entering a local PIN, sometimes 2-3 times. I think the account recovery didn't scale, though haven't really tested/explored with any real users :)
datron 1 hours ago [-]
The point about Google or apple or your passkey manager banning your account is a reason I'm still using random passwords in Keepassxc. I don't know if there is an open source passkey manager that syncs across devices that is self hostable.
Anyway, companies should be educating users more on passkeys, how they work and where they get stored.
Grombobulous 2 hours ago [-]
I love passkeys as a tech enthusiast with a password manager that can hang on to them but I don’t love them as a confusing user experience for the average joe.
I also don’t love how many websites and apps use them in stupid ways like using them alongside other 2FA or login methods when the passkey alone should be sufficient.
tigereyeTO 1 hours ago [-]
You’re the first person in these comments to mention 2FA with passkeys.
My gripe with passkeys is they are almost always implemented without a second factor.
You’ve mentioned the rare case of 2FA with a passkey as being a bad thing, but in my opinion those few cases are actually doing it RIGHT.
With passwords and 2FA, if someone manages to copy your primary authenticator (password) they will still be locked out because they don’t have your secondary authenticator. This protects you against malware that steals your password database.
But the way most companies implement passkeys (single auth), if someone steals your passkey database they can use it immediately. For all of the true measurable benefits that passkeys bring (not memorizable, higher entropy, automatic storage and use in a database) they are almost always used in a way that has this huge drawback: no 2FA.
This is not an issue with passkeys directly, it’s an issue with how services implement passkeys.
kogir 30 minutes ago [-]
It’s the passkey that should be protected with MFA (biometrics, PIN), not the account with the third party service.
My Yubikey supports passkeys and protects them with a PIN of my choosing. No services need challenge me further.
HoldOnAMinute 37 minutes ago [-]
I hated them at first, but since I am already dependent on iCloud Keychain to manage my passwords, I just figured there is not really any additional risk. I just make sure I will always have multiple, healthy devices, which are always patched, charged, and sync'ed. And don't put them all in the same physical location at one time.
przemub 36 minutes ago [-]
> When storing passkeys in a password manager like Bitwardenor KeePassXC, you end up fighting the platform
I must say it's pretty amazing how well-integrated is Bitwarden with iOS now, passkeys, password generation, everything. I have disabled Apple passwords manager, and Bitwarden feels like the native solution.
ecesena 58 minutes ago [-]
> By design, you cannot create a backup of passkeys on a hardware key
In fact, I think it's technically possible. But it's true, as of today I don't think anybody supports it.
I was experimenting on solokeys with ios, in principle we could backup Passwords (the ios/mac app) into a solo key, space permitting, including passkeys, regular passwords and totp (not wifi passwords). I believe the same is for Android, but haven't tested yet. This is all experiments I've been doing on my own, there's nothing ready to be released.
kardianos 3 hours ago [-]
I agree with all the points this articulates. I understand why for many users they are great. But I would prefer better acceptance and continuance of the simpler, unfishable, u2f simple hardware keys.
utopiah 2 hours ago [-]
Just yesterday I was showing to a friend how I logged in my self-hosted forge with my own hardware key.
0 intermediary yet proper and convenient authentication. If that friend ate the key (which he didn't) I'd just use my backup key, a cheaper non biometric one.
I think it's not more popular because people don't care enough about security to buy actual keys, rely instead of 3rd parties that they don't actually trust, e.g. Microsoft, Google, etc then... complain it's not good enough.
MeetingsBrowser 2 hours ago [-]
> By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts.
> Phishing through the standard login flow is eliminated by passkeys, but it creates a false sense of security. An account’s security is still dictated by the weakest recovery method: SMS, email links, security questions, and so on.
Passkeys are too strong and may cause account loss.
Passkeys are too weak and can be bypassed by account recovery.
beej71 44 minutes ago [-]
> Passkeys are too strong and may cause account loss. Passkeys are too weak and can be bypassed by account recovery.
Turns out, given the variety in the ecosystem, both these things are true depending on where you look.
blfr 3 hours ago [-]
Yes, thank you. Maybe I am getting old but password+yubikey/webauthn was really top UX.
xxs 2 hours ago [-]
What prevents passkey being used alongside password (+ email 2fa)?
blfr 2 hours ago [-]
Email 2fa otoh is the worst UX I have experienced. I curse every time Claude sends me a magic link. Absolutely hate them.
esafak 2 hours ago [-]
You don't like not having to worry that they don't store your creds so they can't lose it?
blfr 2 hours ago [-]
The creds they store hold no value. These creds only give access to their system anyway. They store the email address either way so the situation is no better but less convenient.
mschuster91 3 hours ago [-]
> Maybe I am getting old but password+yubikey/webauthn was really top UX.
It most definitely isn't. Any 2nd factor that is not the device I am currently using (either a yubikey or my phone) has a non-zero chance of not being near me when I need it, leading to the constant question of "where the fuck did I put that darn thing", only to find out that the cat has decided to believe the yubikey is a mouse and tried to devour it, the phone's battery went dead...
AdamJacobMuller 2 hours ago [-]
> When storing passkeys in a password manager like Bitwardenor KeePassXC, you end up fighting the platform
Very odd. I use passkeys extensively with BitWarden and I love it to the point where it's my preferred way of securing things at this point.
The fact that the website presents the question to BitWarden in a structured way (what website, what username) means that I never fight with selecting the right account to get the password for (because I commonly have multiple accounts for a single site) and it generally makes the login flow much smoother.
Environment is MacOS with Brave/Firefox + iOS.
xphos 3 hours ago [-]
I agree 100% i learned that my old school with whom I had linked to my windows computer and finished my degree with one day required passkeys rather than passwords on all devices. This force locked my windows PC back to passkey mode luckily I remember recovery account and got a passkey to work. But it took months to figure out why I had to use it. All the help board were said just click this button which was grayed out. Or set this register key which auto repopulated. It was an awful experience. I like my password as default
rcxdude 3 hours ago [-]
Ah yeah, Microsoft has this awful habit of just hiding the buttons for actions you don't have permission to do, which makes me feel like I'm being gaslit sometimes when a guide says 'there's a button right here' and there's not, and I've no idea if the button was just moved or if not, why it's not available (sometimes it's because I don't have permission, but sometimes it's because it's a different product with the same name and branding as a completely different product).
kstenerud 2 hours ago [-]
I just had a very annoying interaction with the tailscale Android app:
It wanted me to log in for some reason even though it had worked fine for months. Login uses my Google log in.
When I try that, Google asks me for a hardware key to complete the login, even though it's my phone and I'm already logged in.
Eventually I figured out that if you select "log in using another device" and then click cancel when it brings up the qr code, you can select a push notification on "another device", which actually pops up on the same device. Do that once and it fails. Do it a second time and it succeeds.
All to use the tailscale app on my own phone.
a2tech 3 hours ago [-]
They’re bad and I wish places would stop being so aggressive about them (I’m looking at you Amazon and PayPal)
Finnucane 3 hours ago [-]
Asking Amazon and Paypal to not do something bad is a big ask.
56 minutes ago [-]
MotoriX 1 hours ago [-]
I feel like we're solving one security problem while creating another. Passkeys make phishing much harder, but putting so much trust in Apple, Google or a password manager for account recovery creates a pretty significant single point of failure.
AIiscoming 59 minutes ago [-]
I wouldn't mind it if all the services stop working properly when you use a Passkey but still want to use your other stuff like password and 2fa through app...
GitHub breaks with this, PayPal breaks with this...
rdsubhas 2 hours ago [-]
It's the stupidity of Service Providers to adopt passkeys in the first place.
As a service provider myself, I've evaluated and said "Nah" to passkeys - because it's simply increased Customer Service contacts I have to invest in, whenever a user changes or loses devices, or any of the hundreds of ways Passkeys are not portable.
And guess what, the Tech companies pushing this have zero liability for user login support or security breaches. It's always me. There is no need for me to work hard and spend CS contacts, to wall off my users to the OS or Browser vendor.
I'll simply do passwordless Email or SMS 2FA / Magic Links and own my users without the overhead of Customer contacts, thank you.
dwb 2 hours ago [-]
I understand many passkey complaints but not this one. Why, for you as a service provider, are passkeys not just better (or at least equivalent to) passwords? You collect and verify an email address at signup and the account can be recovered in the same way as with passwords, or passwordless-email. No CS-verified recovery needed.
rdsubhas 54 minutes ago [-]
> Why, for you as a service provider, are passkeys not just better (or at least equivalent to) passwords?
Why you missed the last line of my answer? How did you get an impression to go back to broken passwords?
F7F7F7 3 hours ago [-]
I'm was tempted to come in here and say "you're holding it wrong." But then I quickly realized that I had to spend weeks changing my behaviors and messing around with devices in order to get it to work correctly.
As someone who's OpSec puts swiss cheese to shame Passkey has been a godsend. My passwords are actually much better because of it.
blackdahlia313 3 hours ago [-]
I will say it. They are all holding it wrong. But it's not their fault. Its how the platforms designed their implementation of it.
BirbSingularity 2 hours ago [-]
That's why I just implanted my NFC passkeys. I've got one in my left hand and one in my right forearm. If I lose access to them, I have other, much larger problems.
r_i_m_b_a_u_d 32 minutes ago [-]
Linux support seems really bad, so not very useful for me
brushfoot 3 hours ago [-]
If you have to use passkeys, try KeePassXC and KeePassXC-Browser. I used them to set one up for Amazon a few days ago, as Amazon now forces passkeys as of this month, at least for my account. It was relatively painless.
That said, I don't like passkeys either.
beej71 42 minutes ago [-]
This is the direction I'm looking, but it sounds like we might have a little farther to go before it works well across all devices.
jtrn 2 hours ago [-]
My thinking is that Passkey is an extremely good and, in theory, extremely easy solution to security, authorization, and login issues. The problem is that Google, Apple, and Microsoft have done a just horrendous job, and made it suck as much as possible.
They didn't want to cooperate, and they wanted to make passkeys transferable within you cloud account, while not cooperating with anyone or anything else. The result was that you have no predictable and stable pattern/protocol/interface, or even general description, for how, for instance, a website connects to the passkey or even a hardware key, if you wanted it.
We basically have all the browsers, the operating systems, and the password managers, all fighting over who gets to store and present the passkey. And everybody assumes that they are the only one that exists and actively tries to fight the others is they can.
The basic technology is really good and could work well, but the large asshole tech firms focused on self-interest and walled gardens and made it insufferable.
hn_submit 1 hours ago [-]
The future of authentication is....CertFP. Basically the same as passkeys, but a based on certificates that you can backup somewhere.
If the browser supports them and stores them securely you're safe as houses even after a breach.
1 hours ago [-]
Shorel 2 hours ago [-]
For me passkeys work wonderfully synced in Bitwarden on Windows, Linux, and Android.
I have no idea what this article trying to say, except some negative opinion that should IMO be ignored.
PennRobotics 52 minutes ago [-]
The article was clear and reflects my own opinions:
If you use an untrusted machine, you either revert to the least secure backup method (your master password in Bitwarden) or don't log in.
If your phone is your trusted device and becomes lost/stolen and then replaced, you revert to the least secure backup method e.g. password, security questions, or even waiting to be manually verified. This can be problematic if your online bank requires 2FA so you can purchase the replacement phone.
The QR + Bluetooth thing sounds dumb as hell.
Kiwi Browser doesn't support passkeys even with Bitwarden on my device. I have to choose between an inferior (for my needs) browser or passkeys.
-----
Rather than passkeys, which always rely on a trusted device, my preference is, "I use a password manager and site-specific generated passwords, and when I try to log in with only a password on your site, send me an email (whether pass or fail), plus never require 2FA except for banking and perhaps to change email/password"
It's unlikely I'll lose access to email notifications at the same time someone tries logging in with a phished password (except, obviously, my email password, which should only be changeable with 2FA) unless I am specifically physically targeted or astonishingly unlucky.
If someone uses a fake website or other MITM method to grab my credentials, I'll be fine because I'll get the "hey PennRobotics you logged in to crabcakes.com just now from a iPhone" and immediately triage that unexpected situation.
If I need to log in to a website in private mode or on a different device, it takes an extra 30 seconds to log in to my password manager.
-----
The passkey problem? You need some hardware or else it's glorified 2FA, and as soon as you lose EITHER the hardware or the "what you are/what you have" part of 2FA you enter a world of trouble.
ideasman42 2 hours ago [-]
They're great when you don't own a phone - when you can't use random 2FA "Apps".
Personally I love passkeys and think it’s not deployed enough. It works great (for me anyways!) and it is SO MUCH better than “login with email” that is everywhere now.
fg137 39 minutes ago [-]
I find it annoying that so many apps and websites push passkeys onto users without informing them the basics of passkeys, including how it's associated with those specific devices/password managers or how to prepare in case a device is lost. Meanwhile as a user who uses a password manager to generate a different password for every site and has autofill enabled everywhere, passkeys barely improve my life if not making things more confusing.
ofjcihen 20 minutes ago [-]
Just a small clarification, attackers can definitely steal a passkey from your key store and use it if your corporate settings are incorrect IE. device attestation is turned off.
My company has already responded to multiple breaches where this has been what quickly follows an initial intrusion.
kelvinjps10 2 hours ago [-]
I didn't like the passkeys that were handled by Google and only worked on my phone. But now that most of them support bitwarden they are really convenient.
yoz-y 43 minutes ago [-]
I just don’t get how passkeys are supposed to be an improvement.
On any site where I create them the login experience gets worse. Sometimes I get a QR code to scan (terrible, almost never works too). Sometimes I am offered to login with passkey which I have and it doesn’t work. Almost always I need to fallback to password and it just sucks.
I hate passkeys. I wish there was a checkbox somewhere to tell all websites that I never want to use them.
karlshea 2 hours ago [-]
Every time passkeys are brought up on HN it’s nothing but complaining and/or refusing to learn the basics about something new, but I’ve been switching to them on every site I can for months with literally no problems.
1Password everywhere, on iOS, Mac, and Windows. I’ve run into none of the issues elsewhere in the comments. Everything just works, including in-app logins.
Maybe your other password managers are just bad at implementing the right browser/OS hooks?
michimagdesign 2 hours ago [-]
Passkeys work great with Bitwarden too. With it being set up on all of my devices I actually often prefer the passkey experience. Too many people depend on OS password managers or even the ones built into their browsers.
commandersaki 2 hours ago [-]
Passkeys are a great way for attackers to have a secondary login into your account (e.g. Outlook, Gmail, etc.)
elAhmo 3 hours ago [-]
Ecosystem is not mature yet for individuals?
Probably hundreds of millions or even billion people have devices that support biometric auth. How is that not mature?
Al-Khwarizmi 3 hours ago [-]
Devices that break or get lost, and then either the user had password authentication activated all the time anyway in addition to the passkey, or they have the classic "mother's maiden name" recovery path, or they get locked out of their account.
Brilliant security: a highly secure high-tech shiny front door that can randomly fail to open, so you still need the low-tech back door, which is the one potential thieves will use.
Mind you, it can work if the back door is old but sturdy (basically, for a bank that will ask for KYC authentication, or in the worst case you can set foot in the brick-and-mortar branch showing your face and ID and ask for access) but for pretty much every other service it introduces risks for very little or no gain.
red_admiral 1 hours ago [-]
> Both Apple and Google want your identity anchored to their operating systems. The “happy path” on their devices is to use their synced passkey management tied to your Apple or Google account.
<sarcasm>On the plus side, this way passkeys can also be tied to age/identity verification.</sarcasm>
throw7 3 hours ago [-]
I have said before, I'm personally not interested using "Something I have"/"device bound" as an authentication factor. I'm also not interested in the sync "workarounds" that store keys in the cloud.
People have replied it's possible to extract the private key, but it's not clear to me that that's usable (maybe it is I don't know). It's certainly not in line with what passkey devs want people to do and not do, so I'm not interested in "fighting" against the "flow" so to speak.
I'm happy with TOTP, as I can manage and use the codes where I want, under my control.
skybrian 2 hours ago [-]
To guard against lockout, you need to be able to log in from multiple devices. But you don’t need to copy passkeys around to do that! Instead, generate a new one for each device. This is similar to setting up ssh by copying public keys, not private keys.
(Or since syncing passkeys usually works within ecosystems, you might just need a passkey per OS.)
hahn-kev 3 hours ago [-]
I like using passkeys in bitwarden from Firefox, I just wish it didn't popup a dialog that's usually behind the browser.
micromacrofoot 3 hours ago [-]
The experience is also junk if you're using a password manager, I have passkeys that I'm not sure if I saved to the OS manager or my password manager... mostly my fault but I enter passwords so many times a day it can be hard to stay on top of which UI I'm clicking yes in to store them.
Password managers are great IMO, I can use some absurdly long password, backup is reliable, I can use them across devices. For extra secure stuff 2FA works the same, I've got an app with codes I can easily back up and use from multiple devices.
Passkeys tend to obscure everything and take away a lot of control.
otter-in-a-suit 2 hours ago [-]
I take passkeys over the unbearable cargo cult that follows LLM companies, namely companies' newly found obsession to "sign in via email".
Ideally optionally followed by a 2FA (naturally, via text, delivered straight to my Mac, even further diluting the questionable security of the whole exercise) and naturally, to be repeated every 2 days or so, since "stay logged in" is the biggest lie after "I've read and accepted the ToS".
Your phone (which is probably what, 80% of relevant traffic these days?) likely has a perfectly fine password manager built in. This "sign in via email" trend must be every scammer and phishers biggest dream come true...
PaulHoule 2 hours ago [-]
Almost everything has supported email-based password reset since 90's for all the problems it entails.
I am looking at a new project that uses magic links sent by texts. I have been there and done that with authentication systems and that's good enough for a low stakes ludic activity.
Barbing 1 hours ago [-]
Great writing and points Ethan!
silon42 3 hours ago [-]
Is there a reason why passkeys couldn't be used in "expire-periodically" mode?
hannasanarion 3 hours ago [-]
What benefit does that give you? Passkeys cannot be moved, by design. So for the website, recieving the same one means you're talking to the same device, always.
The purpose of rotating passwords is to cycle out potentially compromised ones, due to phishing attacks, keyloggers, shoulder snoops, etc. But those cannot exist with a passkey.
pirates 3 hours ago [-]
Doesn’t this mean that a compromised device with passkeys on it is worse than a compromised password since the passkeys can’t be rotated? I feel like the answer is obvious so there must be another angle I’m missing
hannasanarion 54 minutes ago [-]
Passkeys can be rotated, of course. The question was whether they should be rotated on a regular basis.
What kind of compromise are we talking about? Was the device stolen? Then yeah, you need to rotate passkeys (and all your passwords, and remotely cancel all your live sessions, none of which is new).
Was the device hacked from afar and the data read off of it? The passkey is probably fine. You can rotate it if you want to, it's not a bad idea, I probably would to be certain, but you're not pwnd even if a bad guy got a shell for a while, heck even if they got a root shell.
I understood the question to be "should passkeys be rotated regularly" to which the answer is probably no because there's not really a compromise mechanism that periodic rotation defends against as far as I know.
Rotation defends against secrets that leak through normal use and without your knowledge, like a password entered into a phishing page or snooped over your shoulder or cracked from a breached hash. Passkeys aren't vulnerable to those things because they never travel over a network, are never seen by the server, are never seen by their own users.
You change the locks on your house when a key goes missing, or is known to be in the hands of somebody you don't want getting in, it's not something you do every three months just in case. Same with passkeys.
pletnes 3 hours ago [-]
Then how do you log in? Not all sites let you keep password logins after.
poppycock23 47 minutes ago [-]
I hate that there's no accepted definition whether passkeys should be considered MFA or not. As a result, some sites treat it as MFA and you just provide passkey and you're in, which I like. Other sites still ask for a second factor after I provide a passkey which I think is stupid. At that point, it's simply another password I can't remember.
I should not be prompted for a second factor after I log in with a passkey.
alper 2 hours ago [-]
I had to setup a Passkey recently and wanted to store it in 1Password and the experience was quite absurd.
I don't know who designed this or who thinks these are acceptable affordances, but it seem to be part of the same disingenuous push that's behind passkeys in general.
23 minutes ago [-]
pqdbr 2 hours ago [-]
Related: the UX is currently terrible. Every time I go to a website that has passkey flow, I'm presented with:
- MacOS native UI; which I cancel; then I see
- Bitwarden UI; which I cancel; then I see
- Chrome UI; which I cancel;
Like, seriously?
Jnr 3 hours ago [-]
Surprised to see so much hate towards passkeys. I absolutely love them when I can use them with Bitwarden and my own SSO.
Sucks when I am limited to hardware tokens like yubikeys.
VCFundedGenYer 3 hours ago [-]
This is generally the same experience I've had.
Microsoft is especially poorly prepared for this - Often if you have a passkey, it will CONTINUE To ask you to create a passkey (a new and different one), and it may save it in a different place, which is infuriating.
Strong password + MFA is the way, and I don't see that changing.
OutOfHere 2 hours ago [-]
Passkeys lock you into a third-party provider ecosystem that you really should be trying hard to avoid getting locked into. They also add a quantum safety risk. Stay away.
blackdahlia313 3 hours ago [-]
Passkeys have made my life very easy. Especially using Proton Vault.
If you think passkeys aren't ready yet, blame the people implementing it on their platforms.
VCFundedGenYer 3 hours ago [-]
If the concept isn't easily understood nor well implemented by the majority of platforms, it's not a good concept.
izacus 2 hours ago [-]
We've been using SSH keys which behave the same for years. At this point it's mostly clowning by old farts in these articles.
cpburns2009 32 minutes ago [-]
SSH keys are much easier to use and understand. Heck, passkeys could have just been a ZIP file holding a key-pair instead of whatever hostile design by committee we ended up with.
wnevets 1 hours ago [-]
I absolutely hate that so many sites are begging me to use them.
einpoklum 1 hours ago [-]
I've not yet encountered a site which has even suggested I use something like a passkey. Under the assumption that you're doing the Right Thing, and avoid using Apple, Alphabet and Microsoft's services - this is a non-issue. In fact, even if you use their non-login-requiring services (e.g. YouTube, Bing, Google search) - again no passkeys in your life.
Finnucane 3 hours ago [-]
I've resisted passkeys for some of the reasons listed. I use third-party password managers, they're device/system independent, and I can export the data when I want to. I don't see passkeys as a big advantage, or perhaps I should say the bigger advantage isn't really for the _user_.
Of course, at the rate we see security failures everywhere, I'm not entirely convinced writing your passwords on post-it notes wasn't such a bad idea after all.
XorNot 2 hours ago [-]
Keepass2Android without network permissions saving the file to a folder monitored by Syncthing is pretty good though - it keeps responsibilities nicely separated.
ChrisMarshallNY 2 hours ago [-]
Eh. Not worth complaining about.
Passkeys work nicely, and I'll use them, in cases where I want decent security, but I don't consider them the "Philosopher's Stone" of regular end-user security. I think they are still a bit too "fiddly" for your average Joe[line].
junaru 3 hours ago [-]
They exist for sole purpose companies can just shoot the "we have been hacked, but worry not your 'passwords' have not been leaked" email.
It's entirely one sided solution.
cbarrick 3 hours ago [-]
But they could always do that with regular passwords.
Like, no company should be storing anything but a salted hash of their users' passwords.
dariosalvi78 60 minutes ago [-]
passkeys are excellent for security and horrible for usability. We did a students' project on that and decided to not invest on them, yet.
But, hey, here is the new startup idea for you: make passkeys great!
esafak 2 hours ago [-]
Well I like them, as an option. I offer using passkeys and email interchangeably; if you lose one you can recover with the other. Passwords, SMS, TOTP are out for me.
thousand_nights 1 hours ago [-]
am i the only one on HN who really likes passkeys?
so much better than fumbling around with a password managers
beej71 35 minutes ago [-]
Lots of people like them, but it's clear from the complaints there's another large group for whom they are problematic. Enthusiasts are going to have to actually address those issues if they want adoption.
EPWN3D 2 hours ago [-]
I went in expecting yet another screed about how passkeys were not issued by RMS in a FOSS encyclical, and therefore not only were they insecure, but they were also a morally bankrupt abomination. I was pleasantly surprised to read an actual thoughtful critique, albeit one I largely disagree with.
The author's assertion that the greatest risk to an individual is account lockout versus phishing or password harvesting is just not grounded in reality. I get phishing emails and SMSs daily. The criminal ecosystem running these campaigns is extremely active already and set to become even more so with LLMs. These campaigns are by far the biggest threat to normies.
Whereas account lockout happens most often with multiple failed password entries, which passkeys completely eliminate. I just don't know where this risk evaluation comes from.
The author also points out that even with passkeys, if you're able to also log in with e.g. security questions, you still have a much weaker security footprint for that account. This is true, but it's also true of a TOTP second factor. So I'm not sure what the criticism is here.
The exportability argument is a real weakness and something I'd like to see addressed. Passkeys don't have an equivalent for backup TOTP codes that you can just write down somewhere or trivially store yourself. But it probably wasn't in v1 because the people who designed passkeys figured that websites would not go all in on them immediately and would preserve other authentication methods, which is exactly what's happened.
megous 44 minutes ago [-]
I don't like attestation. That is dangerous to user freedom. I don't mind other parts of this technology.
Attestation already destroyed user freedom in mobile app ecosystem. You can't just implement your version of some mobile banking app or whatever just by using original app's API, because dark overlords of gated app comunities allowed app authors to prevent this on OS level by giving them attestation tools.
whalesalad 3 hours ago [-]
using them with 1password has been pretty effortless. 'want to add the passkey' sure why not. 'want to use the passkey?' sure why not. for me it works across devices/os/platform so not sure what the big gripe is tbh.
deaux 2 hours ago [-]
Passkeys suck because only the wealthiest 5% of the world is all-in on one ecosystem (such as Apple) while the remaining 95% uses a Windows laptop, an Android phone and (for the top 5-35%ish) maybe an iPad. All of these OSes push hard to get you to store your passkeys with THEM so it ends up a shitshow with everything scattered everywhere.
And why do the OSes push for this so hard? Because the goal of the execs is lock-in and control. And their lackeys here on HN who implement this stuff and their families are the 1% who are all-in on one ecosystem so they arrogantly believe "this all works great and the masses are just too stupid to get it".
lapcat 3 hours ago [-]
Two crucial things you can do with a password that you can't do with a passkey:
1. Write it down on a piece of paper and put it in a safe deposit box.
2. Read it on one device (or from a piece of paper!) and enter it manually on another device.
Plain text is the ultimate form of cross-platform portability. Passkeys are the ultimate form of vendor lockdown. The passkey vendors won't even allow you to view the private key, unlike with ssh keys, which you can also write down on a piece of paper. It's vendor cabal to destroy computing freedom in the name of "security", always the excuse. Tech company paternalism at its worst.
XorNot 3 hours ago [-]
This is exactly how I feel about it.
If passkeys were meant to be user friendly then there'd be a secure optical transfer mode to QR code them from device to device with the screen and camera.
Easy to implement (receiver flashes a public key, sender encrypts to that key and flashes the QR code back).
That it doesn't exist for a protocol meant to work with phones tells you exactly where the thinking was headed.
diego_moita 2 hours ago [-]
I hate them, mostly because I am forced to use them.
They provide crappy usability, they're expensive, they're easy to lose, you can't use the physical keys when doing remote desktop access.
My job requires me to use them. I use only for the job and nothing else. For sites requiring 2FA, I use TOTP (time-based one time passwords) from KeePassXC.
tonymet 2 hours ago [-]
Username and password was a predictable flow. Passkeys are just a small component in the modern obstacle race of logging in. Every few months a new credential or ritual to access your own resources .
brettermeier 3 hours ago [-]
I absolutely hate them and avoid them everywhere I can. I'm not bound to a single device or I don't want to get bound to some, and some pages quit your option with a normal password login after setting up a passkey. Absolutely frustrating.
oxcartctl 2 hours ago [-]
[dead]
T3RMINATED 3 hours ago [-]
[dead]
inquirerGeneral 2 hours ago [-]
[dead]
dxjxjdjsssb 3 hours ago [-]
[flagged]
rcxdude 3 hours ago [-]
I've seen it. Websites are pretty inconsistent about the flow but I've had a few just try to install a passkey when I log in (amazon does it. Paypal seems to do it but only try to use it on the same browser it was installed on, even if it's synced through a password manager, just to be different. The more reasonably ones have a 'log in with passkey' button but this isn't universal. Microsoft seems to just nag the user on login periodically in their classic 'Yes/Ask me again later' style of 'consent'). You can, if you're paying attention, avoid it actually happening, but the average user isn't going to notice until they suddenly can't log in because they're on a different device. You can see some advocates are pretty vocal about making them mandatory as well.
dbalatero 3 hours ago [-]
I feel like dozens of sites constantly nag me about this. The best ones at least save a cookie to note I'm not interested, such as GitHub.
geerlingguy 3 hours ago [-]
Every time I login to certain sites (like my health insurance, for one) I get a passkey prompt (system dialog) with no way to keyboard-dismiss, so I'm forced to move my hand over to the mouse and figure out which of three poorly-named buttons to press to get on with the login and ignore the passkey.
It's a minor inconvenience, but happens so regularly I hate it. It also stops the login flow until I dismiss the prompt, which is also annoying as I could've already gotten to the page I wanted to get to in the time it took to dismiss the dialog.
paulryanrogers 3 hours ago [-]
You must not use Outlook
exabrial 2 hours ago [-]
These are the four flaws with Passkeys I've found after implementing them on our website. I actually like them now. But, It made me discover why people dislike them. The vast majority of problems are _the way websites implement them_ and _the way password managers today_ work.
Website problems:
* First big problem: you try to kludge them as an "add-on" to a password or SMS "2fa". Just rip the band aide off and let people go 100% passkey by default. It's actually really easy for users. We do a push at the end of their onboarding flow and have a 95% conversion. Users love it and its seamless.
* Don't make people enter a username. Just have a "login with passkey" button first, and thats it. If the HIPPO in your organizations insists a username-password still be available, make the user navigate to a secondary page first to do so. Make the passkey the first-class citizen.
Password Manager problems:
* Google, Apple, Microsoft are trying to lock people in to proprietary password managers. Microsoft's password manager, plus their "microsoft account" experience is a steaming pile of shit. The key here would be portability. An export format exists for the public key (thats how enrollment works): It's a but of digits in ANSI X9.62 format. Not hard. The private key would be an unbelievably simple export.
Protocol problems, and I'm happy to be wrong here:
* The client does not sign the server issued nonce (aka the 'challenge') during the authentication flow. This is kinda weird IMHO. Technically, yes it is secure, but it relies solely on the TLS channel heuristics. It'd be much better to have the client prove the signature on enrollment as layered security.
To address the author fears on attestation: This is a real threat to users... imagine a website "only accepting passkeys from OUR password manager". Luckily, Apple has done us all a favor and outright killed that part of the protocol by refusing to send this required fields there, protecting all users.
Overall, you should use them. We need one tiny change to the protocol and better password managers.
hahamaster 2 hours ago [-]
I don't know much about passkeys, I have never implemented them. I once tried to find out more about them but all I could see is "you're going to regret using this one day".
etatester 3 hours ago [-]
As someone who uses a single password manager on my computer and phone, I don't see the problem with passkeys. I use Safari on both and I never even had to "set up" anything.
I can see why they would be problematic for people who otherwise live life with a single love2025 password though.
flerchin 2 hours ago [-]
Imagine you lose your computer and phone. How do you recover your digital accounts? This happens every day to someone. The most common scenario being a house fire or robbery.
The same way you recover your account when you lose a password.
kejdkwjdjwj 3 hours ago [-]
[flagged]
xp84 1 hours ago [-]
The article asserts with little proof that lockout risk is a big problem. But consumer sites themselves basically 100% of the time have a recovery path that amounts to a SMS code or emailed code.
The only part that is very persuasive is the part about storing your passkeys with Google or Apple integrations, and what happens if they ban your account. But the same argument would apply if you’re only storing your passwords in a Google or Apple password manager.
I use passkeys and I always store them in a password manager I control - but usually I also store another one in the OS on Windows, Apple, and Google. Best of all worlds. Also, I appreciate that idiots aren’t forcing me to “change my passkeys” every 90 months like they STILL do with passwords!
buckle8017 1 hours ago [-]
Passkeys are mostly useless because of that.
Their security is nearly universally undermined by reset mechanisms.
There are virtually no sites where passkeys cannot be bypassed.
If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
My irritation is that I know what it is, and I've said no thanks many times, but I'm still asked regularly by the likes of Amazon, and they usually pick a time when I'm trying to order something quick¹. It is one of the growing number of things in life that simply have no “no” option, it is always “yes or later” - I wouldn't mind so much if “later” meant “I know the option exists, I'll ask for it if I change my mind, don't bother me again otherwise”. Call me cynical, but if companies are trying to nag me into something I very much doubt the main benefit is mine. I'm sure there are many people out there who go along with it simply because they are sick of being asked repeatedly.
I also don't see the real benefit with the way things are often implemented anyway. When the credential recovery process is sending a magic email or text, making SMTP or SMS the weak link of the chain just as it often is for passwords so I'd be giving up my preferred workflows for no better security.
----
[1] A short while ago I actually ordered from somewhere else because of this, bitter twit that I am. “I wonder if I can get this almost certainly drop-shipped item on next day delivery via Prime?”, [goes to Amazon to check], [get passkey prompt], “sod it, I'll go back to the original place”.
The people responsible show a distinct lack of understanding when it comes to consent.
This is why you use hardware keys which work across devices like yubikeys and the like.
I have two of the old neos and two of the newer usb c + NFC enabled ones.
No issues.
He didn’t have access to it the other day and we needed access to his account. He didn’t remember his password, and we were unable to reset it because you need the passkey! No other options to authenticate for a reset were available.
Add in the fact that I was trying to help him with this by long distance call and you can imagine the frustration.
I just made one for PayPal using my MacBook which seems to have ended up in Bitwarden rather than the mac thing. But there's nothing in Bitwarden to say list all passkeys. Not sure how I check elsewhere. Maybe they should email you "you have created a paypal passkey in Tim's Bitwarden" or something. Then at least you could search the email for "passkey"?
I wonder if I can use Bitwarden on another device with that? I honestly don't know.
Also in the process of helping my dad with his phone, 76 and my grandmother 99. Maybe this works better with Apple, but the biggest problem on Android is, that it feels like every update shuffles everything around. Allmost no point in explaining, that they can solve some things on their own.
And all the time new things on the screen, new features they don't understand, need nor asked for.
just hang their heads in shame and walk into the sea
This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport). iOS and Android support this, and it’s generally not a locked-down thing if other devices wanted to do it too.
The only use case left is in “how do I login if all my devices are stolen/fall into a body of water” in which there really isn’t an answer beyond “get (a|your) device back, sign back into your password manager, use that to get back into critical accounts”.
Ok but how do I share my Netflix or Spotify accounts for example with those?
However, passkeys can and are available to be shared via password managers. They’re not locked to the secure chip on the device where they live usually. iOS’ Passwords app has a share button and 1Password lets you share passkey-containing items.
In fact, the QR code login feature makes it even easier to do a one-time sign in to your account for a friend, if you don’t want them to be able to login to your account indefinitely.
0: Netflix doesn’t support passkeys because their main audience is people signing in via smart TVs and whatnot, which largely don’t support CTAP or Webauthn in general)
These may seem like nitpicks, but there's probably a thousand rare scenarios like these that exist. You inevitably have to consider them when you're moving from punching in letters and numbers that you remember in the normal, low-tech way to a complex networked two-device workflow.
They use bank like Ally or Discover with no physical branches.
They use a mortgage provider like Rocket mortgage with no physical branches.
They use a medication delivery service with no physical customer facing pharmacies.
They have an employer that only facilitates reimbursement for expenses via online tools.
etc...
I guess "survive" has a sliding scale, but if I lost access to critical accounts... my life is going to FUCKING SUCK in a non-trivial and very impactful way almost immediately, on many fronts.
And if your answer to that problem is "well, just call them"... then we're right back to the point the article is making: "An account’s security is still dictated by the weakest recovery method"
Passkeys aren't a meaningful improvement in security - assuming you do actually have decent password hygiene like a password manager.
What am I missing? Either we retain passwords as backup for a lost or stolen device - in which case, all the security concerns are still there - or we only use passkeys, in which case we've added a clear nonrecoverable point of failure in the system.
When I said "survival", I meant it in the "being able to make do with few resources in a time of crisis" way, not that you will literally die if you can't access an account. Losing a crucial device without a fallback of being able to log in somewhere else quickly can mean immediately losing access to payments (the most crippling, especially if you're not home), being stranded in an airport or even not having an identity document (in countries with digital ID systems). Any of these happening can lead to enormous losses in time, money or worse, depending on when and where this event hits you.
Are you talking about your phone here?
But, again, if you don't trust your phone then how likely is it that you will be prepared to trust a public computer?
The number of people sharing GP's concerns for reasons of poverty rather than because of their personal security posture will be vanishingly small.
I assume the QR code contains a token for the device, which is used by the app to authorize the login and the server automatically logs in the client on the device with the matching token.
Seems a lot safer to me than using my login credentials on a potentially unsafe device.
1. It might be on a voice network but not on a data network; for instance, if you don't have a data plan.
2. Modern smartphones are actually a hybrid of a traditional cell phone and a traditional PDA, and you might be using it for the PDA part.
> Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms.
What if the computer you want to log in on doesn't have a WiFi chip?
It doesn't have to be an old computer; for instance, the desktop computer I built last year uses a wired gigabit Ethernet connection to the router right next to it, and doesn't have (or need) any WiFi or Bluetooth chip.
That's a technocratic reply, not one that is useful in the real world.
As noted by the person you're replying to, it's not his computer. It's a public library.
Most computers in non-residential settings will have various features locked down, including Bluetooth.
Hotels, clubs, airport lounges, various government facilities… there are thousands of places where you might really need to use a computer but don't control the technology.
They're cheap enough if you lose one it's not the end of the world. Goes on your keyring. Doesn't require esim management. Use NFC swipe/usb-plug-in + pin to use.
This two fatal flaws are what limits their usefulness to enterprise SSO and perhaps some other limited uses where the organization has the ability to replace tokens. (Even in a distributed enterprise, enterprise SSO may not be a good fit for hardware tokens, if they can't get replacements out to employees fast enough).
FIDO2 USB Security key -> Bitwarden (With master password) -> Every other method (topt/password)
I have 3 FIDO2 USB Security keys, One I carry with my persons at all times, one that stays with my main machine at all times and an offsite backup that is sitting in a friend's server, if my house burns down, I can either physically collect the key or use USB-IP to authenticate back into bitwarden and enroll a new key. (Actually all 3 are at home right now but that's ok)
Everything is SYNCED immediately.
What if you have a ransomeware that destroy everything on the same day your house and all backups burn down. And you cant get it from immutable backups as you wrote that decryption key in paper. And the bank will not allow you to access it as the govt deported you elsewhere.
And yes, Google or Apple - dont say you should not keep passwords in your database and sync it with dropbox. DIY.
Rest of us want convenience.
I suspect that most people that ostensibly do this actually only enroll one for non-critical accounts and then depend on some fallback mechanism.
I’m not sure what work has been done on this since Mozilla Persona. I certainly wouldn’t want Google and Apple, or governments, to be the sole gatekeepers.
A third party OAuth provider puts you at the mercy of the service provider, the other can work fully on your client side even if the app provider were to disappear tomorrow.
The only advantage I can think of is that you have a centralized place to revoke credentials in case your password manager does get compromised.
No second factor, compromised passkey manager leads to compromise of all accounts. This is a huge problem.
> A third party OAuth provider puts you at the mercy of the service provider, the other can work fully on your client side even if the app provider were to disappear tomorrow.
Yes that’s what I was saying, it needs some thought and careful work. It would need to be decentralized, and I’m not sure that current standards are up to the task.
Sad reality is that such usecase is less and less common, thus, no one cares about it. I think majority of my friends would not be able to access their email, or facebook or alike, if they were forced to use my computer in emergency.
For instance YouTubers usually have a different account for their channel than the one they use privately, and don't want their channel account logged in everywhere.
That means having to log in as a guest when push comes to shove. And similar setups are common for most self-employed keeping a "work" account IMHO.
I've definitely done this, but not sure if the workflow was at the OS or browser level.
I'm honestly confused by all the negativity in the comments. Passkeys are great for convenience. Just leave your password login enabled as a backup. That defeats any security benefit, but oh well.
For people in this position, if they had their phone, they probably wouldn't be logging in on a computer anyway.
And many are moving to virtual wallets like Cashapp rather than banks with a physical presence where you can take out money without a phone.
It’s a bad situation.
Some password managers will only fill if a domain matches, but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in. I've also seen lots of them do stuff like happily autofill on any prefix of the domain, so your credential for `something.example.com` will autofill into `fake-something.example.com`.
Same thing is going to happen with passkeys for non-technical users for exactly the same reason you stated. People will think the integration is busted and manually copy/paste the non-passkey credentials in. In that way, I would argue that passkey is not stronger protection against phishing attacks unless its the only way to login. It is, at best, a convenience for users.
Why would you trust the very same password managers that don't handle passwords properly to handle passkeys properly?
The passkey integration goes the other way, which is much more reliable.
I'm not sure why you're making a distinction. In many cases the browser is the password manager.
Password managers have had to be permissive enough to work with most websites, and there is no standard for it. There have been sites that blocked the autofilling of passwords and so on as well.
My point wasn't this one particular flaw in some password managers is the reason to use passkeys (the copy/paste point is the much bigger issue anyway), just that it's an example of how relatively brittle the password manager process is. Having it a core part of the spec gives stronger guarantees.
Sites that do this irritate me so much. Ones that try to block pasting and stuff… like somebody intentionally baked that into the site. Who? And what was their rationale? Are they really so arrogant to think people are going to carefully type in some elaborate password not once but twice?
That and blocking paste in fields like bank account numbers and stuff.
Surely somebody here has been asked to implement these mis-features. Please explain what went through the heads of the people responsible for it?
Gell-Mann amnesia effect
https://en.wikipedia.org/wiki/Michael_Crichton#%22Gell-Mann_...
I've seen people do this AFK as well, and I'm always helpfully suggesting them the correct way of solving this: verifying the URL again, and if correct, add it to the password manager so it remembers in the future, and never copy-paste passwords on the web. Basically 50/50 if they take the advice or come back after a week asking if it's safe to copy-paste the password into the website, and I try to inform again.
Shockingly, I saw one developer peer copy-pasting a password into a website, but I guess for these people there is no hope.
Historically I've seen lots of sites do a subdomain shuffle for login pages every now and then which routinely breaks domain matching, introducing false positives that users have to deal with, making them numb to the threat too. Passkeys baking in the domain check with no workaround means that sites can't do that, which is a benefit.
No doubt there exist services that do not offer recovery method for passkey or mfa enabled account. But this is entirely on them (the service), to blame for, not the passkeys or the users. It’s bad implementation.
Oh well.
You scan the qr code from your phone and it logs you in on that device. The experience is pretty amazing, honestly.
The tragedy of passkeys is that they're a step back from the security offered by the likes of Yubikeys.
But because passkeys are pushed by both Google, Microsoft and Apple: there is is simply no fighting these three. It is impossible.
Passkeys won not because they're better (they're not and the entire concept of "secret behind a hardware security module" that can be transferred to another system defeats the whole point of a HSM in the first place) but because the powers-that-be decided that passkeys are to be used.
It's still a win: the commoners are better served with passkeys.
But a secret in control of Google/Apple/Microsoft that can be backed up is not a secret I control: it's a complete step back from yubikeys.
Passkeys won and we better get used to them (and, yup, there are usability issues as you mentioned).
Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.
And the confusing mechanism hurts there too: I'm always a little bit afraid that i'm somehow more in danger because I keep them in a vault that's shared on all my devices rather than a TPM, because whenever the protocol is explained the "it can't leave your device" part is highlighted as the main source of the security, except.... mine obviously do leave my device, with the vault, so.....
Sites can request hardware-bound tokens, which would block any software based password managers. It's an option in the protocol but one not yet widely utilized.
It should not be in the protocol. And I don't trust Apple and Google not to lock it away from me.
I want my own open source manager and if that is attempted I want it to lie about it.
I am already seeing my "normie" friends getting locked out of accounts due to not understanding passkeys. If they don't have their phone, or it's dead, or it breaks, or is stolen, they just can't access their account anymore. They have no idea how they work or what they're trading off, nor do they understand that they should have prepared for this scenario ahead of time somehow. Upon telling them "yeah you have to use your phone now that you have a passkey" they all universally say "wtf, that's stupid, I never want to have that happen again, I will never use a passkey again."
Passkeys should never have been built for general audiences, they are a huge mistake, I hope they cease to be relevant and die due to everyday folks realizing they're inconvenient and the "more secure" gains ain't worth it for the usability nightmares.
https://developer.android.com/privacy-and-security/security-...
I haaaaaate this. And every time I'm like, "do I not already have one??" Passkey implementation has been half-assed by everyone.
What setup are you using? Because I don't have that problem on Linux + Firefox at all
It's totally possible there's something specific about my situation, or the way it was set up in the first place that enables this, idk, but somebody else replied saying they have the same experience so it's not just me.
And even if it was just me, it's still clearly something wrong on the provider's implementation, because it should not be possible for software to sidetrack the user into a passkey enrollment flow, when that user logged in with a passkey to open the current session.
The option pops up in the middle of a normal log-in flow. I'm guessing most non-techies don't know how it's implemented.
Oddly, some login flows display a normal user/pwd form, but you get the in-browser "use a passkey?" option/popup which further confuses matters.
Thankfully, me, wife, and all our parents are tech-savvy enough to use password managers, so the fallout from lost passkeys hasn't be an issue. But I certainly see how it would be an issue for anybody entering passwords from memory or similar.
And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".
The most flexible, independence preserving thing to do is to use a third party password manager like Bitwarden, and make that the default passkey flow for your devices. If desired, you can self-host something like Vaultwarden so that you can both keep the keys independent of third parties and walled gardens and also propagate them to other client devices.
To be clear I'd much rather not have learned / implemented any of this, and I don't use passkeys unless forced, but this seems like a valid coping strategy.
Passwords with 2FA are simply better and more freedom friendly.
The reason is the ever increasing number of hijacks of social media presences and code hosting portals, with the latter being a serious financial threat. Done right, passkeys stay in the Secure Enclave, at least for anything Apple and most of the Android sphere. There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
Passkeys could be the savior of all security problems worldwide from a capability point of view and tech companies would still ruin it by trying to force ways it pushes you into their ecosystem instead of just being whats both secure and convenient.
As an example, I have 3 different passkey _APPS_ on my phone and cannot go down to one because of various reasons with each (such as MS authenticator, forced for integrating to Microsoft at work).
Click "I lost my device", enter contact, get a reset link via email/sms
I’d buy that there are too many different confusing ways to recover from this situation, but not that it’s impossible
Fun fact: Google can decide to reject these. Lose access to the original device, try to rely on recovery codes to login with known current password on family member’s device… nope!
Passkeys have been a massive quality-of-life improvement. Yes, there's the minimal risk of lockout if you lose access to the passkey (though almost every site I've used that implements pk's lays it on top of their traditional user/pass auth flow), but generally speaking most people use iCloud or their Google account to store their passkeys, and because those sync everywhere, this isn't a real risk.
I love not needing to deal with 1Password's autofill being flakey and having to CMD-C/CMD-V passwords/passphrases/OTPs on these sites.
I like Yubikeys as well but they are super inconvenient by comparison when dealing with multiple devices. Setting them up is also very user-unfriendly in general; doubly so compared to passkeys.
Now, what I'd REALLY F'IN LOVE to see go away is the passwordless/magic link auth flow wherein you authenticate by clicking a magic link that gets sent to your email or text message inbox.
"Emails are super easy to hack and we're still not sure whether text messages are safe to send on US carriers, so let's have everyone click on a link sent by email or text so that they don't have to deal with those pesky passwords that iOS or Android will automatically suggest for them." Like, what?
This seems really naive? That's the only flow that's at the basis if you get locked out. What else, do you put people on the phone to verify people by asking their name and date of birth? That's even worse!
Source? And if somebody hacks my Gmail account, won't they be able to access my Google-synced passkeys?
Magic link auth isn't any less secure than any site that has a password-reset flow.
And unfortunately is something I start to see to family members/friends that are not tech experts when they ask me to setup them up a new phone... at least the passwords they would have written them in some notebook that they had at home, or always used the same for everything, but with passkey... and when you tell them that they lost access to their email, possibly the files backed up to Google Drive/Google Photos, etc they are surely not happy.
Also passkeys makes it difficult to get access to your account in an emergency scenario, what if I loose my phone and I'm not signed in to other devices? Maybe I've setup an SMS as a recovery method, but first I have to get to my phone company to request another SIM card, maybe I'm on vacation on the other side of the earth in vacation for 2 weeks, I'm locked out of my Google account, and from all accounts that uses the passkey as a sign-in method (including, for example, the account that I need to use to check in on my return flight, or my banking app that I need to pay stuff!)
Exactly, if you lose your passkey you just sign in with your password like you did previously. I'm yet to find an app/website that has passkeys only and no passwords.
Seems like a total non-issue to me.
If you can still be phished, remind me what the point of any of this was, again?
So no password login, but then you can recover your account by adding an additional passkey by receiving an email.
Do they sync between Android and iPhone devices?
I use 1Password, but passkeys have made things even easier. I'd rather have them than any 2FA method. So many websites make me use a login/password AND then send me an email or text with a code. Every. Single. Time. You're really telling me you would rather do that than have a passkey?!
And, like you said, passwordless email auth is really terrible.
I'm glad to see this view becoming more mainstream. Passkeys are grotesquely insecure.
The only possible way to consider them more secure is if phishing attacks were more common and more damaging than lockout, which is so implausible that I reject the idea that someone could take that position in good faith.
Lockout is a real risk, but there is nothing insecure about passkeys. Private keys stored on the secure enclave + biometrics or passcode before any signature is produced + origin binding mogs a static string and a 6-digit TOTP (often generated with a secret key outside the secure enclave) that can be phished and entered from anywhere. Also, in many (possibly the majority) of scenarios where someone is locked out of their passkeys, they’d also be locked out of TOTPs and passwords.
> The only possible way to consider them more secure is if phishing attacks were more common and more damaging than lockout
You’d be surprised.
This statement is internally contradictory.
Perhaps I missed something or perhaps it really is that user hostile. It wouldn’t surprise me in the slightest.
My annoyance with the prompts is not evenly spread over the sites I use, it just so happens the same sites that think short login periods = security (it does not) are also the same sites that think passkeys are the best thing since sliced bread.
I have such a low opinion of any company that logs me out every time I turn around and those are the same disrespectful companies that think it's appropriate to spam me with passkey requests when I login. My dislike also extends to those companies they have a "Remember me" or "Remember this choice" checkbox that is decorative, as in it doesn't do anything. Often paired with clicking external links in things like a banking website "Warning: You are leaving this site!", yeah, I know how the internet works, I don't need to be babied by a completely ineffectual dialog (if you think normies are reading that and not just clicking through, you are living in a fantasy world).
Same as traditional physical keys, you don't have a single key, you have multiple ones precisely so that if you lose/break one, you are not stuck and can go to the local locksmith and get another one in minutes.
In fact it's even nicer since you can just re-use the backup key with no security loss by revoking the other one, and buying another key.
I have multiple identical ones.
> [...] and can go to the local locksmith and get another one in minutes.
Can I go to the digital equivalent of a locksmith (like a backup software) and duplicate my passkey? Can I do that with only my passkey in hand (without having to do anything to the corresponding lock, or having to contact its issuer), like I recently did with a physical key?
In fact if you have the technical skills to make your own physical key and respect standards, e.g U2F, you don't even need to buy one and it will work with existing devices and services. I can recommend the Precursor for an interesting exploration of that from a verifiable software/hardware perspective.
(At least til I get around to setting up my new usb c yubikeys!)
<<ducks>>
But for regular end users where services are primarily motivated to take money from those users and lock them into their ecosystems, they are a usability disaster and yet another exploitation vector.
It's one solution for two very different usecases, and it just does not work. There is an approach that could work for end users who own their own accounts, but they need to go back to the drawing board and rewrite the protocol with the assumption that the keystore is hostile to the user's interests. That means strong guarantees on key portability so users can migrate away from hostile keystores, and absolutely no ability for services to restrict the user's choice in passkey provider software.
it's all backwards, I agree, even worse that we trust "sync to the cloud" but don't allow users to own their credentials.
My bigger problem with passkeys is how there's no universal way to register more than one device (in case the first one is lost).
Proton Pass is a specific way to do that, but not a universal way. Bitwarden can't use proton pass to move keys around, google can't, firefox can't.
Tada, passkeys.
The fearmongering of losing google account should stop. Yes, some people lose it. There are a larger proportion losing/getting pwned by repeat use. For the majority - just pressing the fingerprint to access an account (like amazon/eBay) via passkey is great.
Fairly technical co-workers - I used to suggest them to buy USB security key few years ago. Now that same fairly technical some how has at least 2 devices with them - so they just skipped the USB security key need - and just use Google (in Android) or iPhone in Apple ecosystem. Everything just works.
Yes, there will be a poor soul that may lost everything with only one device.
It shouldn’t be this way, but it is.
I'd love a hardware sold in multi-packs and "born" at the factory with identical internal device key encryption keys (DKEK). I'd love, even more, if a token just allowed you to "commission" new ones w/ a user-specified DKEK on first use.
I'd use one token as a daily driver and store the other(s) in safe location(s), empty of my personal key material. (Or, if I can just commission a new token w/ my DKEK, store a printed copy of my DKEK in a safe location.)
Give the token a mechanism to "type" a backup of its internal state, encrypted with the DKEK, as a USB HID keyboard. That gives me an easy way to backup the token each time I enroll a new website.
If I lose my daily-driver token I just pull a spare from storage, import my last backup, and I'm up and running.
That would kick ass. No "You just need to buy two tokens and enroll them in every website" bullshit.
If you browser vendor has implemented passkey then all good.
Most things are built for the majority users. Most don't change. Most don't debate browser wars in hn. Life is like that.
For Wii etc. You just scan the QR code shown in the TV interface. all just works.
Yes, if you want 100% privacy and will do only your own dovecot server then it is not for you.
Yes, if you are edward snowden then not for you. For rest of us - it is useful
To your point, I for example would add point c) - Is linked to the device you are using currently. If you want to use another device to log in you are in a world of complexity and pain.
Are you part of the 99.99999% users of one of iOS+Apple or Androidlike+Google/Tencent or HarmonyOS+Huawei? If that's the case, you don't need to as the key is automagically saved by your OS' platform and synced with your new device.
Otherwise, you're such an extreme outlier that you probably either know what you're doing or can find out by yourself, right?
This absolutely does not encourage confidence in me. We all know how easy it can be to get locked out of a Google account and have no way of getting back in unless you have enough clout to make a huge noise online so a human there pays attention instead of you being stuck in the 'ol support-bot-run-around loop. It doesn't happen often when you consider how many users there actually are out there, but the potential inconvenience is high enough that “fairly rare in the grand scheme of things” is still enough to be reason enough to be wary.
Ironically on macOS we used to have an app called Keychain which unfortunately was effectively renamed to Passwords for non-technical users.
Unlike physical objects they may reside in a TPM, a software vault, an export/backup, or any combination thereof. You may or may not be able to recover or migrate them, depending on where/how they were made.
Therefore you may need multiple per service, or maybe not. Services which only allow one may end up locking you out with no recourse. You get to find out.
None of this is obvious or self explanatory to normies.
As for normies, passkeys or passwords it doesn't make a difference. Either you have people who use love1969 everywhere or those who constantly lose their passwords.
All passkeys accounts for normies require an email or phone number, which is what you can use to recover a password or passkey exactly the same way.
Passkeys really are not any more difficult to explain than 2-factor authentication. Anyone who’s currently been able to actually create an Apple or Google account and successfully navigate their devices up to a passkey screen will be able to grok how it works.
People around here really ought to stop thinking users are complete idiots. Hell, you don’t even to scroll that far to read people calling users “normies” for crying out loud. What is this? High school?
Roughly one per smart-phone that they've ever used. They don't know the passwords or even the email address of any of them, not even the latest.
I always operated under the assumption that the passwords app was just a more casual view into the keychain
Maybe that's a bad assumption
That's a pain point in everyone's day that should make the benefit easy to understand.
Logging into a site with your device is like putting your card into the terminal. The site can ask for a password the way the terminal asks for a PIN, but if your device supports Passkeys, that’s like your card having a chip, and it’ll use that instead.
So think of Passkeys like using a chip card.
I dunno how well this analogy works down to the last detail but it has gotten it across to all the parents I’ve used it with
Sure, its explained. But not in a satisfactory way that would reach all users at their level.
This is a bit of an exaggeration and out of proportion, but I think my ideal would be one of the big tech companies should have bought out something like a super bowl ad. Something that actually conveys the idea "hey, we know you've used passwords since you were able to type on a keyboard, but here's new technology that's better and here's why" in plain language that the average person can understand.
Unfortunately, XKCD 2501 continues to be relevant. [1]
[1] https://xkcd.com/2501/
If it's that unclear to me, I can't imagine how it can be to the average user.
The way they explain them is atrociously unclear, borderline negligent for services that nag people to activate it for accounts where they may hold valuable data for their personal lives. And while I don't want to spend much time finding out the details as long as I have the option to decline them, I suppose if they can't explain it and convince people of its advantages, it's because it's just bad tech.
I'm with you 100%.
There will be evil and stupid uses.
The brain-damaged people who think disabling paste on password fields is a security feature will be all over forcing device-attested passkeys as soon as they learn about it.
Evil people will see it as a proxy attestation of humanity.
Either way it will be rammed down our throats if passkeys are widely adopted.
Let's add to that: What if you're on holiday and your phone gets stolen or is suddenly 20 meters under water because it fell off the boat?
What if you are a normal person who only has a phone and it simply dies for one reason or another?
You get a new phone then hire the boat again, go above where your phone fell in and hope it syncs your passkeys?
You either should treat your passkeys with a backup like any data, this can mean multiple hardware keys or a cloud backup of your passkey, like bitwarden or the provider's native backups.
The idea of multiple hardware keys, which have to be enrolled individually to every site, is just not an ordinary end-user friendly activity.
So passkeys may be great for technical users (who are happy doing that) or corporate users (where centralized IT systems can be put in place) but not for standard non-corp users (which realistically, is most people)
Not talking about you. After all passkeys are not there to protect people who have home labs and don't recycle passwords anyway? They're for normal people who only have one device.
> who are happy doing that
You think they're happy? I'd say they grudgingly comply at best.
Suppose you do want a secure solution for the main sites your stuff is on. But every piece of shit content mill also wants to set up a passkey.
Then on top of that there's a whole 2nd factor layer which _also_ typically involves a touchid press but for a totally different reason (as the 2nd factor, not to unlock the password safe storing my passkey.
It's just an ugly inconsistent dance, dozens of times a day.
I know these gripes are mostly about implementation, and partially about user-facing software, and partially about user choices, but it doesn't make it any less ugly for the user.
With the app you use to store those keys (a password/key manager) it's the same - you simply wouldn't have an autofill working. Sure, people can and will circumvent this for the benefits of the scammers, just like they can circumvent passkeys using non-passkey login option, indeed:
> weakest recovery method: SMS
> If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details.
Similarly, don't other modern password storage methods have the same property?
> lacks the decades of UX polish towards password autofill.
A lot of years in those "decades" have been wasted polish-wise: you still can't log in with a single button, e.g., many popular sites only fill a username first, then require an extra dealy and action before accepting a password
Sure they work fine on a technical level, but they're frustrating and confusing for the vast majority of people I know.
I worry I am going to get locked out of my Google account, muggles don't. Doesn't stop them from getting locked out.
Apple has a vision where you have an iPhone and a mac at home and a mac at work and a vision pro and an Apple TV and all of that and your passcodes "just work". Doesn't work for the "rest of us", like we're already used to AirPods punishing us for using Windows.
If it works without any issues, great.
But if you ever run into one of the 50 messed up situations, good luck.
I actually prefer non-resident U2F in some ways. You don't have to store anything on your key, you are just signing requests. This is relevant where U2F/FIDO keys have limited slots for 'resident' keys.
In principle, it's great. You have one good password to remember for the average user, and that's enforced by their device's probably good enough security posture.
They are resistant to being phished and they won't reuse the same one everywhere. They then don't end up going from hunter2 to hunter2! everywhere.
But my experience for users is that they worry they are giving their biometrics to Amazon or whoever and so the UX just confuses them.
The certification aspect was new to me too last time passkeys came up. Sites can require that a given passkey has been certified.
The patchy support for them is also frustrating. MacOS does not support NFC FIDO/U2F. iOS does.
And yet you love passkeys? How much will you love them when you're locked out of something you can't do without?
No grandma, don’t use the unphishable one-click passkey setup that syncs across all your devices. Instead, install a third-party password manager (no, no, not the one built in to your device or browser), then another TOTP app on your phone. It’s slower and more susceptible to phishing, but uhhh, what if you’re among the one in a million people that has their Google or Apple account wrongly banned?
At some layer you have be able to access your services with password/totp if only for recovery. Passkeys add a layer for minimum benefit, in my opinion.
Yes, push based totp and passkeys are more phish proof but for non techies, managing them is its own job.
But they also introduce single points of failure, as the article points out. I can't even remember how many times I've had to help a family member recover their account or get confused when they can't sign in on a new device. It's incredibly frustrating that this flow is promoted as the default for so many services.
1password is the best solution I've found for the average person. It's not perfect (it's definitely more complex than writing down your passwords on a piece of paper or using the same password everywhere) but it's much easier than juggling yubikeys. I know so many non-technical staff members who prefer the OS or browser keys even if it means another account recovery is lurking around the corner.
This is, in my opinion, the most serious problem with passkeys. I'd like to adopt them, but this is a blocker.
The same is true for passwords with a password manager.
> If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details.
Also not really a problem with randomly generated site-specific passwords in a password manager.
Really all the browser vendors had to do was add an API to make automatically generate a password that is then stored in the user's password manager the low friction option.
I proposed an alternative scheme many years ago: https://www.researchgate.net/publication/343318317_Privacy-a... . By allowing "offline" keys you can also treat them as higher priority, and use them to revoke any lesser keys from attackers if your account is compromised.
It would also be nicer to get rid of usernames, but that's a fight against the data-gathering powers that we're unlikely to win.
It should always have remained a second factor device. It’s not impossible to teach people to use these, European banking did it for years. There’s just no will to do it.
Under this scenario, the first factor can be a short password or even a PIN.
I have physical passkeys, one attached to my keys and another on my desk at home and I absolutely hate software based passkeys. Every single time I'm asked for a passkey it always ask me if I want to use my Apple Keychain first and I wish I could default to physical.
Passkeys just make it harder/riskier.
there's some issues with passkeys, but not being able to memorize them is a feature
same ux, different security properties.
>Except that at least I can memorize a password by heart just in case.
"just in case" should be a thought out recovery flow, rather than hoping that you remember the password of the account you need to access.
For the average user, which doesn’t use a password manager, this is great. It means they can’t get phished. And it’s also great for the average password manager user, who keeps dozens of insecure and reused passwords in their vault because they manually thought of a password when signing up instead of randomly generating one.
If you’re already using a password manager and random passwords, the UX is designed to be the same. It’s just a way to get regular people to do this.
Windows still required entering a local PIN, sometimes 2-3 times. I think the account recovery didn't scale, though haven't really tested/explored with any real users :)
Anyway, companies should be educating users more on passkeys, how they work and where they get stored.
I also don’t love how many websites and apps use them in stupid ways like using them alongside other 2FA or login methods when the passkey alone should be sufficient.
My gripe with passkeys is they are almost always implemented without a second factor.
You’ve mentioned the rare case of 2FA with a passkey as being a bad thing, but in my opinion those few cases are actually doing it RIGHT.
With passwords and 2FA, if someone manages to copy your primary authenticator (password) they will still be locked out because they don’t have your secondary authenticator. This protects you against malware that steals your password database.
But the way most companies implement passkeys (single auth), if someone steals your passkey database they can use it immediately. For all of the true measurable benefits that passkeys bring (not memorizable, higher entropy, automatic storage and use in a database) they are almost always used in a way that has this huge drawback: no 2FA.
This is not an issue with passkeys directly, it’s an issue with how services implement passkeys.
My Yubikey supports passkeys and protects them with a PIN of my choosing. No services need challenge me further.
I must say it's pretty amazing how well-integrated is Bitwarden with iOS now, passkeys, password generation, everything. I have disabled Apple passwords manager, and Bitwarden feels like the native solution.
In fact, I think it's technically possible. But it's true, as of today I don't think anybody supports it.
I was experimenting on solokeys with ios, in principle we could backup Passwords (the ios/mac app) into a solo key, space permitting, including passkeys, regular passwords and totp (not wifi passwords). I believe the same is for Android, but haven't tested yet. This is all experiments I've been doing on my own, there's nothing ready to be released.
0 intermediary yet proper and convenient authentication. If that friend ate the key (which he didn't) I'd just use my backup key, a cheaper non biometric one.
I think it's not more popular because people don't care enough about security to buy actual keys, rely instead of 3rd parties that they don't actually trust, e.g. Microsoft, Google, etc then... complain it's not good enough.
> Phishing through the standard login flow is eliminated by passkeys, but it creates a false sense of security. An account’s security is still dictated by the weakest recovery method: SMS, email links, security questions, and so on.
Passkeys are too strong and may cause account loss.
Passkeys are too weak and can be bypassed by account recovery.
Turns out, given the variety in the ecosystem, both these things are true depending on where you look.
It most definitely isn't. Any 2nd factor that is not the device I am currently using (either a yubikey or my phone) has a non-zero chance of not being near me when I need it, leading to the constant question of "where the fuck did I put that darn thing", only to find out that the cat has decided to believe the yubikey is a mouse and tried to devour it, the phone's battery went dead...
Very odd. I use passkeys extensively with BitWarden and I love it to the point where it's my preferred way of securing things at this point.
The fact that the website presents the question to BitWarden in a structured way (what website, what username) means that I never fight with selecting the right account to get the password for (because I commonly have multiple accounts for a single site) and it generally makes the login flow much smoother.
Environment is MacOS with Brave/Firefox + iOS.
It wanted me to log in for some reason even though it had worked fine for months. Login uses my Google log in.
When I try that, Google asks me for a hardware key to complete the login, even though it's my phone and I'm already logged in.
Eventually I figured out that if you select "log in using another device" and then click cancel when it brings up the qr code, you can select a push notification on "another device", which actually pops up on the same device. Do that once and it fails. Do it a second time and it succeeds.
All to use the tailscale app on my own phone.
GitHub breaks with this, PayPal breaks with this...
As a service provider myself, I've evaluated and said "Nah" to passkeys - because it's simply increased Customer Service contacts I have to invest in, whenever a user changes or loses devices, or any of the hundreds of ways Passkeys are not portable.
And guess what, the Tech companies pushing this have zero liability for user login support or security breaches. It's always me. There is no need for me to work hard and spend CS contacts, to wall off my users to the OS or Browser vendor.
I'll simply do passwordless Email or SMS 2FA / Magic Links and own my users without the overhead of Customer contacts, thank you.
Why you missed the last line of my answer? How did you get an impression to go back to broken passwords?
As someone who's OpSec puts swiss cheese to shame Passkey has been a godsend. My passwords are actually much better because of it.
That said, I don't like passkeys either.
They didn't want to cooperate, and they wanted to make passkeys transferable within you cloud account, while not cooperating with anyone or anything else. The result was that you have no predictable and stable pattern/protocol/interface, or even general description, for how, for instance, a website connects to the passkey or even a hardware key, if you wanted it.
We basically have all the browsers, the operating systems, and the password managers, all fighting over who gets to store and present the passkey. And everybody assumes that they are the only one that exists and actively tries to fight the others is they can.
The basic technology is really good and could work well, but the large asshole tech firms focused on self-interest and walled gardens and made it insufferable.
If the browser supports them and stores them securely you're safe as houses even after a breach.
If you use an untrusted machine, you either revert to the least secure backup method (your master password in Bitwarden) or don't log in.
If your phone is your trusted device and becomes lost/stolen and then replaced, you revert to the least secure backup method e.g. password, security questions, or even waiting to be manually verified. This can be problematic if your online bank requires 2FA so you can purchase the replacement phone.
The QR + Bluetooth thing sounds dumb as hell.
Kiwi Browser doesn't support passkeys even with Bitwarden on my device. I have to choose between an inferior (for my needs) browser or passkeys.
-----
Rather than passkeys, which always rely on a trusted device, my preference is, "I use a password manager and site-specific generated passwords, and when I try to log in with only a password on your site, send me an email (whether pass or fail), plus never require 2FA except for banking and perhaps to change email/password"
It's unlikely I'll lose access to email notifications at the same time someone tries logging in with a phished password (except, obviously, my email password, which should only be changeable with 2FA) unless I am specifically physically targeted or astonishingly unlucky.
If someone uses a fake website or other MITM method to grab my credentials, I'll be fine because I'll get the "hey PennRobotics you logged in to crabcakes.com just now from a iPhone" and immediately triage that unexpected situation.
If I need to log in to a website in private mode or on a different device, it takes an extra 30 seconds to log in to my password manager.
-----
The passkey problem? You need some hardware or else it's glorified 2FA, and as soon as you lose EITHER the hardware or the "what you are/what you have" part of 2FA you enter a world of trouble.
As many USB-security keys can be used passkeys.
You don't need a phone to do 2FA :
https://github.com/pcarrier/gauth
My company has already responded to multiple breaches where this has been what quickly follows an initial intrusion.
On any site where I create them the login experience gets worse. Sometimes I get a QR code to scan (terrible, almost never works too). Sometimes I am offered to login with passkey which I have and it doesn’t work. Almost always I need to fallback to password and it just sucks.
I hate passkeys. I wish there was a checkbox somewhere to tell all websites that I never want to use them.
1Password everywhere, on iOS, Mac, and Windows. I’ve run into none of the issues elsewhere in the comments. Everything just works, including in-app logins.
Maybe your other password managers are just bad at implementing the right browser/OS hooks?
Probably hundreds of millions or even billion people have devices that support biometric auth. How is that not mature?
Brilliant security: a highly secure high-tech shiny front door that can randomly fail to open, so you still need the low-tech back door, which is the one potential thieves will use.
Mind you, it can work if the back door is old but sturdy (basically, for a bank that will ask for KYC authentication, or in the worst case you can set foot in the brick-and-mortar branch showing your face and ID and ask for access) but for pretty much every other service it introduces risks for very little or no gain.
<sarcasm>On the plus side, this way passkeys can also be tied to age/identity verification.</sarcasm>
People have replied it's possible to extract the private key, but it's not clear to me that that's usable (maybe it is I don't know). It's certainly not in line with what passkey devs want people to do and not do, so I'm not interested in "fighting" against the "flow" so to speak.
I'm happy with TOTP, as I can manage and use the codes where I want, under my control.
(Or since syncing passkeys usually works within ecosystems, you might just need a passkey per OS.)
Password managers are great IMO, I can use some absurdly long password, backup is reliable, I can use them across devices. For extra secure stuff 2FA works the same, I've got an app with codes I can easily back up and use from multiple devices.
Passkeys tend to obscure everything and take away a lot of control.
Ideally optionally followed by a 2FA (naturally, via text, delivered straight to my Mac, even further diluting the questionable security of the whole exercise) and naturally, to be repeated every 2 days or so, since "stay logged in" is the biggest lie after "I've read and accepted the ToS".
Your phone (which is probably what, 80% of relevant traffic these days?) likely has a perfectly fine password manager built in. This "sign in via email" trend must be every scammer and phishers biggest dream come true...
I am looking at a new project that uses magic links sent by texts. I have been there and done that with authentication systems and that's good enough for a low stakes ludic activity.
The purpose of rotating passwords is to cycle out potentially compromised ones, due to phishing attacks, keyloggers, shoulder snoops, etc. But those cannot exist with a passkey.
What kind of compromise are we talking about? Was the device stolen? Then yeah, you need to rotate passkeys (and all your passwords, and remotely cancel all your live sessions, none of which is new).
Was the device hacked from afar and the data read off of it? The passkey is probably fine. You can rotate it if you want to, it's not a bad idea, I probably would to be certain, but you're not pwnd even if a bad guy got a shell for a while, heck even if they got a root shell.
I understood the question to be "should passkeys be rotated regularly" to which the answer is probably no because there's not really a compromise mechanism that periodic rotation defends against as far as I know.
Rotation defends against secrets that leak through normal use and without your knowledge, like a password entered into a phishing page or snooped over your shoulder or cracked from a breached hash. Passkeys aren't vulnerable to those things because they never travel over a network, are never seen by the server, are never seen by their own users.
You change the locks on your house when a key goes missing, or is known to be in the hands of somebody you don't want getting in, it's not something you do every three months just in case. Same with passkeys.
I don't know who designed this or who thinks these are acceptable affordances, but it seem to be part of the same disingenuous push that's behind passkeys in general.
Like, seriously?
Microsoft is especially poorly prepared for this - Often if you have a passkey, it will CONTINUE To ask you to create a passkey (a new and different one), and it may save it in a different place, which is infuriating.
Strong password + MFA is the way, and I don't see that changing.
If you think passkeys aren't ready yet, blame the people implementing it on their platforms.
Of course, at the rate we see security failures everywhere, I'm not entirely convinced writing your passwords on post-it notes wasn't such a bad idea after all.
Passkeys work nicely, and I'll use them, in cases where I want decent security, but I don't consider them the "Philosopher's Stone" of regular end-user security. I think they are still a bit too "fiddly" for your average Joe[line].
It's entirely one sided solution.
Like, no company should be storing anything but a salted hash of their users' passwords.
But, hey, here is the new startup idea for you: make passkeys great!
so much better than fumbling around with a password managers
The author's assertion that the greatest risk to an individual is account lockout versus phishing or password harvesting is just not grounded in reality. I get phishing emails and SMSs daily. The criminal ecosystem running these campaigns is extremely active already and set to become even more so with LLMs. These campaigns are by far the biggest threat to normies.
Whereas account lockout happens most often with multiple failed password entries, which passkeys completely eliminate. I just don't know where this risk evaluation comes from.
The author also points out that even with passkeys, if you're able to also log in with e.g. security questions, you still have a much weaker security footprint for that account. This is true, but it's also true of a TOTP second factor. So I'm not sure what the criticism is here.
The exportability argument is a real weakness and something I'd like to see addressed. Passkeys don't have an equivalent for backup TOTP codes that you can just write down somewhere or trivially store yourself. But it probably wasn't in v1 because the people who designed passkeys figured that websites would not go all in on them immediately and would preserve other authentication methods, which is exactly what's happened.
Attestation already destroyed user freedom in mobile app ecosystem. You can't just implement your version of some mobile banking app or whatever just by using original app's API, because dark overlords of gated app comunities allowed app authors to prevent this on OS level by giving them attestation tools.
And why do the OSes push for this so hard? Because the goal of the execs is lock-in and control. And their lackeys here on HN who implement this stuff and their families are the 1% who are all-in on one ecosystem so they arrogantly believe "this all works great and the masses are just too stupid to get it".
1. Write it down on a piece of paper and put it in a safe deposit box.
2. Read it on one device (or from a piece of paper!) and enter it manually on another device.
Plain text is the ultimate form of cross-platform portability. Passkeys are the ultimate form of vendor lockdown. The passkey vendors won't even allow you to view the private key, unlike with ssh keys, which you can also write down on a piece of paper. It's vendor cabal to destroy computing freedom in the name of "security", always the excuse. Tech company paternalism at its worst.
If passkeys were meant to be user friendly then there'd be a secure optical transfer mode to QR code them from device to device with the screen and camera.
Easy to implement (receiver flashes a public key, sender encrypts to that key and flashes the QR code back).
That it doesn't exist for a protocol meant to work with phones tells you exactly where the thinking was headed.
They provide crappy usability, they're expensive, they're easy to lose, you can't use the physical keys when doing remote desktop access.
My job requires me to use them. I use only for the job and nothing else. For sites requiring 2FA, I use TOTP (time-based one time passwords) from KeePassXC.
It's a minor inconvenience, but happens so regularly I hate it. It also stops the login flow until I dismiss the prompt, which is also annoying as I could've already gotten to the page I wanted to get to in the time it took to dismiss the dialog.
Website problems:
* First big problem: you try to kludge them as an "add-on" to a password or SMS "2fa". Just rip the band aide off and let people go 100% passkey by default. It's actually really easy for users. We do a push at the end of their onboarding flow and have a 95% conversion. Users love it and its seamless.
* Don't make people enter a username. Just have a "login with passkey" button first, and thats it. If the HIPPO in your organizations insists a username-password still be available, make the user navigate to a secondary page first to do so. Make the passkey the first-class citizen.
Password Manager problems:
* Google, Apple, Microsoft are trying to lock people in to proprietary password managers. Microsoft's password manager, plus their "microsoft account" experience is a steaming pile of shit. The key here would be portability. An export format exists for the public key (thats how enrollment works): It's a but of digits in ANSI X9.62 format. Not hard. The private key would be an unbelievably simple export.
Protocol problems, and I'm happy to be wrong here:
* The client does not sign the server issued nonce (aka the 'challenge') during the authentication flow. This is kinda weird IMHO. Technically, yes it is secure, but it relies solely on the TLS channel heuristics. It'd be much better to have the client prove the signature on enrollment as layered security.
To address the author fears on attestation: This is a real threat to users... imagine a website "only accepting passkeys from OUR password manager". Luckily, Apple has done us all a favor and outright killed that part of the protocol by refusing to send this required fields there, protecting all users.
Overall, you should use them. We need one tiny change to the protocol and better password managers.
I can see why they would be problematic for people who otherwise live life with a single love2025 password though.
The only part that is very persuasive is the part about storing your passkeys with Google or Apple integrations, and what happens if they ban your account. But the same argument would apply if you’re only storing your passwords in a Google or Apple password manager.
I use passkeys and I always store them in a password manager I control - but usually I also store another one in the OS on Windows, Apple, and Google. Best of all worlds. Also, I appreciate that idiots aren’t forcing me to “change my passkeys” every 90 months like they STILL do with passwords!
Their security is nearly universally undermined by reset mechanisms.
There are virtually no sites where passkeys cannot be bypassed.