3 ms·

Ask HN: Will passkeys make passwords obsolete, or will both exist?

3 points by fuzztester 3y ago

rzzzwilson 3y ago
I hope both will exist, because I want to use passwords. Each month I regularly log into many accounts and can remember the password to each. They are mostly 16 characters or more in length and all different and regularly changed. Why would I swap that for a system that fails if I lose my phone or hardware gadget?
thomashorrobin 3y ago
Given that they achieve widespread adoption, Google and Apple will kill passwords in favour of passkeys in a similar way to how they killed http in favour of https. You can still use http, but in production it's impractical for most websites
LinuxBender 3y ago
Will passkeys make passwords obsolete, or will both exist? None of the sites I use have suggested they would add passkeys. If passkeys depend on cellphones then I will be excluded from sites that drop passwords and require passkeys. This is probably fine for me personally as it aligns with my goal of dropping sites that I can not quickly reach a human. I only provide my cell phone number to a site if I have a binding contract with them, can reach real humans, are based in the US and I can drive to their HQ in less than 1 day and meet with real people. The bar is even higher if I am to install that companies phone app. I've only ever made one exception to this. Perhaps websites would be happy to exclude my kind.
- tuberactive 3y ago
  First, a clarification: passkeys don't depend on cellphones. They can be used on desktops, laptops, tablets, and more as long as the device has a hardware component (e.g. secure enclave or TPM) I believe that passkeys will eventually make passwords obsolete but that day is not today or tomorrow. Two reasons I believe this: one, passkeys require a shift in user behavior pattern and two, mental model around authentication credentials. - UX pattern change: no more typing a password can be jarring. Also people equate more friction with better security which passkeys refute as a premise. - Mental model around auth: passwords are shared secrets that are portable across any device. Passkeys inherently are tied to devices. Even synced passkeys are only syncable across devices within an OS ecosystem unless you're using a password manager. A device-associated credential fundamentally breaks the assumption that a user's brain is the "storage location" of their secret. Instead users would have to get used to offloading the "storage" of their secret to their OS's which arguably provides much much much better security but can be hard to wrap your head around. Password / passkey managers and OS's can ease the adoption woes but it'll take time to dial in the UX for mass adoption. Until mass adoption, passwords will likely continue to exist alongside passkeys.
  - LinuxBender 3y ago
    First, a clarification: passkeys don't depend on cellphones. They can be used on desktops, laptops, tablets, and more as long as the device has a hardware component (e.g. secure enclave or TPM) That excludes me because I disable the TPM on my daily drivers. I leave it enabled on my windows machine that serves a specific purpose but I do not log into anything important on windows. I believe that passkeys will eventually make passwords obsolete but that day is not today or tomorrow. Maybe you are right, I honestly don't know. I just do see me being a part of it. It probably makes sense on my windows machine for the silly things I use it for. I agree that people are opposed to friction and that may drive adoption. I can also see potential for abuse with passkeys by making hardware ID's part of the picture but that is probably a discussion for a couple decades from now including but not limited to decloaking VPN users but those are probably spoilers for another time.
legrande 3y ago
I think it's nice to have diversity on how to authenticate. Passkeys are useful in a certain context, but I imagine the technology won't exactly 'kill the password' anytime soon. I think the 'password killer' idea is framing it wrong.
fuzztester 3y ago
Thanks to all who replied.

3 points by fuzztester 3y ago

I hope both will exist, because I want to use passwords. Each month I regularly log into many accounts and can remember the password to each. They are mostly 16 characters or more in length and all different and regularly changed. Why would I swap that for a system that fails if I lose my phone or hardware gadget?

thomashorrobin 3y ago

Given that they achieve widespread adoption, Google and Apple will kill passwords in favour of passkeys in a similar way to how they killed http in favour of https. You can still use http, but in production it's impractical for most websites

LinuxBender 3y ago

Will passkeys make passwords obsolete, or will both exist? None of the sites I use have suggested they would add passkeys. If passkeys depend on cellphones then I will be excluded from sites that drop passwords and require passkeys. This is probably fine for me personally as it aligns with my goal of dropping sites that I can not quickly reach a human. I only provide my cell phone number to a site if I have a binding contract with them, can reach real humans, are based in the US and I can drive to their HQ in less than 1 day and meet with real people. The bar is even higher if I am to install that companies phone app. I've only ever made one exception to this. Perhaps websites would be happy to exclude my kind.

tuberactive 3y ago
First, a clarification: passkeys don't depend on cellphones. They can be used on desktops, laptops, tablets, and more as long as the device has a hardware component (e.g. secure enclave or TPM) I believe that passkeys will eventually make passwords obsolete but that day is not today or tomorrow. Two reasons I believe this: one, passkeys require a shift in user behavior pattern and two, mental model around authentication credentials. - UX pattern change: no more typing a password can be jarring. Also people equate more friction with better security which passkeys refute as a premise. - Mental model around auth: passwords are shared secrets that are portable across any device. Passkeys inherently are tied to devices. Even synced passkeys are only syncable across devices within an OS ecosystem unless you're using a password manager. A device-associated credential fundamentally breaks the assumption that a user's brain is the "storage location" of their secret. Instead users would have to get used to offloading the "storage" of their secret to their OS's which arguably provides much much much better security but can be hard to wrap your head around. Password / passkey managers and OS's can ease the adoption woes but it'll take time to dial in the UX for mass adoption. Until mass adoption, passwords will likely continue to exist alongside passkeys.
- LinuxBender 3y ago
  First, a clarification: passkeys don't depend on cellphones. They can be used on desktops, laptops, tablets, and more as long as the device has a hardware component (e.g. secure enclave or TPM) That excludes me because I disable the TPM on my daily drivers. I leave it enabled on my windows machine that serves a specific purpose but I do not log into anything important on windows. I believe that passkeys will eventually make passwords obsolete but that day is not today or tomorrow. Maybe you are right, I honestly don't know. I just do see me being a part of it. It probably makes sense on my windows machine for the silly things I use it for. I agree that people are opposed to friction and that may drive adoption. I can also see potential for abuse with passkeys by making hardware ID's part of the picture but that is probably a discussion for a couple decades from now including but not limited to decloaking VPN users but those are probably spoilers for another time.

legrande 3y ago

I think it's nice to have diversity on how to authenticate. Passkeys are useful in a certain context, but I imagine the technology won't exactly 'kill the password' anytime soon. I think the 'password killer' idea is framing it wrong.

fuzztester 3y ago

Thanks to all who replied.