3 ms·

Passkeys are just the endgame of "for your safety you need to use a different password on every website that you use" and "no human on the planet can remember t

Passkeys are just the endgame of "for your safety you need to use a different password on every website that you use" and "no human on the planet can remember thousands or millions of passwords so everyone should use a password manager". If everyone who is secure is using a password manager 100% of the time, anyway, then you might as well use something stronger than a plaintext shared "word" (a "key"). Most of the basics are the same: pick a password (passkey) manager you are comfortable with. Most people will pick the one built-in to their most personal computer's OS (their phone's OS) and/or their favorite web browsers. The "passkey manager" you choose becomes in charge of generating the thousands (or more) keys you need for all the websites you might use. The "passkey manager" you choose becomes in charge of synchronizing them between devices, helping recover them when you lose access to a device, making them temporarily available to devices that you don't want to synchronize everything to. (Other than that last one and its new QR code workflow, these "passkey managers" are doing it all almost the same way as "password managers" always have. For instance, Apple's iCloud Keychain is largely the same technically whether it is managing/syncing passwords or passkeys.) There are passkey managers that aren't from the major OS vendors to try (1Password is a major vendor here, of course; other existing password managers are working on it, too) and open source ones to try to learn. It's all based on open standards and most of the password managers in the world can "upgrade" to be passkey managers if they wish to.

WorldMaker 3y ago
> If everyone who is secure is using a password manager 100% of the time, anyway, then you might as well use something stronger than a plaintext shared "word" (a "key"). A related point I missed, too: given the assumption that everyone who is secure is using a password manager 100% of the time, the best way to encourage everyone to be secure, including average users, becomes "make it easier for, if not force, more average users to enroll in password managers". For better and worse, despite "no human on the planet can remember enough passwords to be secure" there's still a lot of human over-confidence that "we can do it", so making the case for password managers has been an uphill battle in some cases among average users. Passkeys present the opportunity "fix that bug" in password manager roll out. I know very few people with delusions that they can do elliptic curve calculations and/or remember large primes and can do large prime multiplication in their head enough to do private key math the same way that people think that they can remember passwords. The password manager stays the same recommended toolkit, but with passkeys there opens the opportunity to get the UX right and get even the most password manager skeptical enrolled into a password manager. Whether or not we succeed or squander this opportunity is still an open question, but that's some of the HN excitement about passkeys is that this is an opportunity to make the average user more secure for the good of all users. (A rising tide lifts all boats, as the saying goes.)

WorldMaker 3y ago

> If everyone who is secure is using a password manager 100% of the time, anyway, then you might as well use something stronger than a plaintext shared "word" (a "key"). A related point I missed, too: given the assumption that everyone who is secure is using a password manager 100% of the time, the best way to encourage everyone to be secure, including average users, becomes "make it easier for, if not force, more average users to enroll in password managers". For better and worse, despite "no human on the planet can remember enough passwords to be secure" there's still a lot of human over-confidence that "we can do it", so making the case for password managers has been an uphill battle in some cases among average users. Passkeys present the opportunity "fix that bug" in password manager roll out. I know very few people with delusions that they can do elliptic curve calculations and/or remember large primes and can do large prime multiplication in their head enough to do private key math the same way that people think that they can remember passwords. The password manager stays the same recommended toolkit, but with passkeys there opens the opportunity to get the UX right and get even the most password manager skeptical enrolled into a password manager. Whether or not we succeed or squander this opportunity is still an open question, but that's some of the HN excitement about passkeys is that this is an opportunity to make the average user more secure for the good of all users. (A rising tide lifts all boats, as the saying goes.)