4 ms·

"They certainly didn’t ask the HN crowd. I wonder who they surveyed." You probably didn't survey the HN crowd either.

hedora 3y ago
I did not, but sentiment about passkeys is overwhelmingly negative in the comments sections of previous articles. Here’s the “most popular” article according to a HN search for passkeys: https://news.ycombinator.com/item?id=36712497 https://news.ycombinator.com/item?id=36712497
- m-p-3 3y ago
  Personally I hope to see Passkeys becoming more prevalent.
  - pomstazlesa 3y ago
    Personally, don't
  - OJFord 3y ago
    I'd like a better baked version to be more prevalent.. right now it seems a bit 'how can we standardise a way for everyone to have a walled garden'. I want bitwarden, or whatever password manager, to be the (cross-platform) provider, not the OS. It's coming, maybe/hopefully?
    - cassianoleal 3y ago
      1Password already has it. I'm sure others will implement it soon enough as well.
      - OJFord 3y ago
        Sure, but the man on the Clapham omnibus is going to use Apple's, or whatever's, that's what I don't like - it seems set up to serve incumbents rather than to stand on technical merit. There's precedent for only supporting certain walled gardens, too: Google MFA sign-in supports Yubikeys et al. only if used in Chrome; in Firefox for example you get the prompt and everything, it just stubbornly refuses to accept it on touch.
        cassianoleal 3y ago
        > but the man on the Clapham omnibus is going to use Apple's, or whatever's, that's what I don't like You don't like that people will use the tool that's most convenient to them? I'm not sure I understand your argument. Right now pretty much all people except us geeks either: - Re-use the same password everywhere; or - Use their OS's password manager; or - Use their browser's password manager. How is this any worse?
        blitzar 3y ago
        > Google MFA sign-in supports Yubikeys et al. only if used in Chrome; in Firefox for example you get the prompt and everything, it just stubbornly refuses to accept it on touch. Ok you made me look because I was sure I had been doing this every morning; Myth busted - Logged in to Google using a Yubikey via Firefox (Windows 11) no problems at all.
    - m-p-3 3y ago
      Most if not all services which I use that supports Passkeys allows you to enroll more than one per account. I have my phone (Android), my laptop (Windows Hello) andnmy primary and backup Yubikeys enrolled. I'm not restricted to a specific platform.
      - kiwijamo 3y ago
        Which platforms allows you to enroll your yubikey as as a passkey? I know Google for example does not support hardware keys within their Passkeys system and that's a major gap IMHO.
        m-p-3 3y ago
        Uh.. I enrolled my Yubikeys as Passkeys without any problems with Google.. just be sure Windows Hello doesn't get in the way, and be sure to select your USB device when enrolling. https://files.catbox.moe/eowjba.png https://files.catbox.moe/eowjba.png I also have my Microsoft account enrolled as a Passkey, and Bitwarden is enrolled using WebAuthn.
      - danShumway 3y ago
        > Most if not all That this is not a required part of the spec and that it's possible for a website to go through certification and get an official endorsement of support without supporting multiple keys per-account is a complete failure of the FIDO Alliance. One of the big issues with how passkeys are being developed is the painful naivety of the FIDO Alliance about actually standardizing good behavior. Every response is, "but why would providers do X bad thing?" If we're expecting every provider to allow multiple keys, then require it in the spec. Otherwise, if it's important that the spec not mandate that, then don't tell me that every provider is going to allow multiple keys, because apparently there's use-case for only allowing a single key and we're expecting the spec to need to accommodate that behavior. ---- > I have my phone (Android), my laptop (Windows Hello) andnmy primary and backup Yubikeys enrolled. I'm not restricted to a specific platform. That people are seriously suggesting this as a solution to cross-ecosystem recovery and backup makes me skeptical of the potential of passkeys to ever be simpler or more straightforward than passwords are. Normal users can't be taught not to reuse passwords, they can't be taught to do 2FA, and you think they're going to proactively enroll multiple keys in every website they sign up to? That's not going to happen; what will happen is they're going to lose their Android phone and they won't be able to do cross-device authentication without it, and they won't have proactively done cross-device authentication on their Windows machine, and the only way to get access to those keys will be to buy another Android phone. "Register multiple devices ahead of time" is only a solution if you expect passkey usage to be restricted to niche technical groups.
- nl 3y ago
  This article isn't even negative! It's pointing out that passkeys could make most security keys obsolete because they lack the storage to store resident passkeys for lots of sites. It even provides recommendations to work around this problem.
  - monooso 3y ago
    > sentiment about passkeys is overwhelmingly negative in the comments sections of previous articles (Emphasis mine) The thread is discussing the general sentiment on HN regarding passkeys (based on previous discussions), not the sentiment of the linked article.
- rat9988 3y ago
  Vocal minority or majority? Hard to tell without a proper survey.

I did not, but sentiment about passkeys is overwhelmingly negative in the comments sections of previous articles. Here’s the “most popular” article according to a HN search for passkeys: https://news.ycombinator.com/item?id=36712497 https://news.ycombinator.com/item?id=36712497

m-p-3 3y ago
Personally I hope to see Passkeys becoming more prevalent.
- pomstazlesa 3y ago
  Personally, don't
- OJFord 3y ago
  I'd like a better baked version to be more prevalent.. right now it seems a bit 'how can we standardise a way for everyone to have a walled garden'. I want bitwarden, or whatever password manager, to be the (cross-platform) provider, not the OS. It's coming, maybe/hopefully?
  - cassianoleal 3y ago
    1Password already has it. I'm sure others will implement it soon enough as well.
    - OJFord 3y ago
      Sure, but the man on the Clapham omnibus is going to use Apple's, or whatever's, that's what I don't like - it seems set up to serve incumbents rather than to stand on technical merit. There's precedent for only supporting certain walled gardens, too: Google MFA sign-in supports Yubikeys et al. only if used in Chrome; in Firefox for example you get the prompt and everything, it just stubbornly refuses to accept it on touch.
      - cassianoleal 3y ago
        > but the man on the Clapham omnibus is going to use Apple's, or whatever's, that's what I don't like You don't like that people will use the tool that's most convenient to them? I'm not sure I understand your argument. Right now pretty much all people except us geeks either: - Re-use the same password everywhere; or - Use their OS's password manager; or - Use their browser's password manager. How is this any worse?
      - blitzar 3y ago
        > Google MFA sign-in supports Yubikeys et al. only if used in Chrome; in Firefox for example you get the prompt and everything, it just stubbornly refuses to accept it on touch. Ok you made me look because I was sure I had been doing this every morning; Myth busted - Logged in to Google using a Yubikey via Firefox (Windows 11) no problems at all.
  - m-p-3 3y ago
    Most if not all services which I use that supports Passkeys allows you to enroll more than one per account. I have my phone (Android), my laptop (Windows Hello) andnmy primary and backup Yubikeys enrolled. I'm not restricted to a specific platform.
    - kiwijamo 3y ago
      Which platforms allows you to enroll your yubikey as as a passkey? I know Google for example does not support hardware keys within their Passkeys system and that's a major gap IMHO.
      - m-p-3 3y ago
        Uh.. I enrolled my Yubikeys as Passkeys without any problems with Google.. just be sure Windows Hello doesn't get in the way, and be sure to select your USB device when enrolling. https://files.catbox.moe/eowjba.png https://files.catbox.moe/eowjba.png I also have my Microsoft account enrolled as a Passkey, and Bitwarden is enrolled using WebAuthn.
    - danShumway 3y ago
      > Most if not all That this is not a required part of the spec and that it's possible for a website to go through certification and get an official endorsement of support without supporting multiple keys per-account is a complete failure of the FIDO Alliance. One of the big issues with how passkeys are being developed is the painful naivety of the FIDO Alliance about actually standardizing good behavior. Every response is, "but why would providers do X bad thing?" If we're expecting every provider to allow multiple keys, then require it in the spec. Otherwise, if it's important that the spec not mandate that, then don't tell me that every provider is going to allow multiple keys, because apparently there's use-case for only allowing a single key and we're expecting the spec to need to accommodate that behavior. ---- > I have my phone (Android), my laptop (Windows Hello) andnmy primary and backup Yubikeys enrolled. I'm not restricted to a specific platform. That people are seriously suggesting this as a solution to cross-ecosystem recovery and backup makes me skeptical of the potential of passkeys to ever be simpler or more straightforward than passwords are. Normal users can't be taught not to reuse passwords, they can't be taught to do 2FA, and you think they're going to proactively enroll multiple keys in every website they sign up to? That's not going to happen; what will happen is they're going to lose their Android phone and they won't be able to do cross-device authentication without it, and they won't have proactively done cross-device authentication on their Windows machine, and the only way to get access to those keys will be to buy another Android phone. "Register multiple devices ahead of time" is only a solution if you expect passkey usage to be restricted to niche technical groups.
nl 3y ago
This article isn't even negative! It's pointing out that passkeys could make most security keys obsolete because they lack the storage to store resident passkeys for lots of sites. It even provides recommendations to work around this problem.
- monooso 3y ago
  > sentiment about passkeys is overwhelmingly negative in the comments sections of previous articles (Emphasis mine) The thread is discussing the general sentiment on HN regarding passkeys (based on previous discussions), not the sentiment of the linked article.
rat9988 3y ago
Vocal minority or majority? Hard to tell without a proper survey.