6 ms·

The platform lock in attempt is wild, my initial experiences with Passkeys were great on iOS and Safari, either getting pushed to touch-id or scanning a QR with

The platform lock in attempt is wild, my initial experiences with Passkeys were great on iOS and Safari, either getting pushed to touch-id or scanning a QR with my phone. But then in Chrome I couldn't get into GitHub because chrome would only push me to use their manager and wouldn't offer a QR code. Seeing this more and more with Chrome, like Credit Card numbers used to just save and autocomplete in browser but then they had some popup that was worded in a weird way that tricked me into saying it into Google Pay. Then I had to like type in the CCV to retrieve the card but then it also charged my bank account 1c for the privilege of autocompleting the card each time. Took me good 20 minutes to delete my card, get it saved back in the free local auto completely and shut down my Google Pay account I never knew I had.

Groxx 3y ago
Yep, this is why I don't use passkeys. I tried. The power-grabbing garbage was immediately apparent and sent me straight for "heck no, I'll just use passwords until they figure this out, at least that can't control my password manager". In principle I should be very in favor of them, but the wild variety of lack of support for basics, and the built-in-the-spec ability for site X to control how I store and sync stuff is utterly bonkers. It's feeling like the OpenID promise -> OAuth platform lock-in cycle all over again, but compressed into v1.
- sroussey 3y ago
  I use 1Password which supports Passkeys, and don’t have an issue across mobile or desktop. I don’t get what the issues people have really are. I never experience them (fortunately!).
  - MrDrMcCoy 3y ago
    1Password is a closed-source, cloud-hosted service. At any time, for any reason, they can close and delete your account, leaving you high and dry. Self-hosted, multi-device password managers are the only real solution. Thankfully, Vaultwarden and KeePassXC fill this role perfectly. Now if we could just get the other providers that require insecure email/SMS 2FA to follow suit, that would be great...
    - gcr 3y ago
      For others reading this thread, looks like KeePassXC announced passkey support last October! Does it work well?
    - ceinewydd 3y ago
      I’m really not sure the “only real solution” is every human needs to selfhost a password manager. That’s ill-advised; an extreme take. The vast majority of the population will do a worse job on the availability and security of a selfhost solution than 1Password, whose core business and value proposition is password management. I’m a very happy user of 1Password for Families and consider it the likely the best ~$50 a year that I spend on hosted technologies.
      - sroussey 3y ago
        Agreed. I self hosted the key 100 bitcoin in like 2010. Machine crashed. Oops.
        littlestymaar 3y ago
        That's a fundamental problem with cryptographic security: you cannot trust people to manage your keys for you (because due to lack of regulation preventing that companies have this bad habit of pulling the rug under their customers' feet) but you cannot trust yourself doing that either, because you can, and will, make mistakes.
        pydry 3y ago
        I've always wanted a decentralized solution that lets me trust my friends instead.
        eru 3y ago
        You can use a threshold secret sharing scheme to distribute your keys amongst your friends (and amongst companies). This way you don't need to trust any single one of your friends to be 100% honest nor 100% available.
marssaxman 3y ago
> and shut down my Google Pay account I never knew I had Google loves that nonsense, don't they? It's as though they think so highly of themselves that they cannot imagine they might not be strictly doing us all a favor by signing us up for their services. Fifteen years later, I still have friends occasionally sending messages to a GMail address I never asked for, never used, and didn't even know about for most of a year while it was virally spreading through people's address books, silently diverting mail away from my actual address. The only time I used this account, after I discovered that it existed, was to delete it - but GMail apparently still suggests it when people type my name, because I get an "oops, sent this to the wrong address" forward every few months. No I will not be knowingly using any Google passkey service, but perhaps I will someday find that they have signed me up for it anyway.
- Atotalnoob 3y ago
  Why don’t you setup the Gmail account to forward? I know it’s a hassle, but will resolve the issue
  - macintux 3y ago
    That seems like an invitation for long-term pain if Google changes their policies, requiring someone to log in every X months or have their gmail account locked, for example, or some AI enforcement tool locks the account for inscrutable reasons.
    - qingcharles 3y ago
      I'm locked out of my Gmail and it still forwards to the recovery email address, but I can't get in to change the settings. They also won't allow me to download all my data, as required by statute, because I can't log in.
    - duskwuff 3y ago
      I've got some active GMail forwarding addresses that I haven't logged into for 10+ years. I don't think they could change how that worked now even if they wanted to.
twobitshifter 3y ago
Same thing with google app on ios. My wife saved a password to a site on her phone and we were trying to find it to log in again. Since she had navigated to the site through the Google app, the password ended up in her google account instead of the iPhone keychain - unlike in every other app on the iPhone.
gcr 3y ago
Odd! I've been able to sign into desktops running Chrome both on Windows and Mac. Both times Chrome will show a QR code that my iPhone scans. The actual passkey is stored in 1Password. The dark pattern about signing up for google pay is absolutely inexcusable though. Sorry you're going through that.
- whywhywhywhy 3y ago
  I think they changed it recently to offer a QR code because checking now it's offering it. But I absolutely had the issue for the first few months of the year.
flaminHotSpeedo 3y ago
The lock in is intentional, security theater touted as a feature in the shitty, ambiguous spec. Unfortunately, the folks who contribute to the spec are more concerned about threatening projects that have the audacity to use common sense instead: https://github.com/keepassxreboot/keepassxc/issues/10407 https://github.com/keepassxreboot/keepassxc/issues/10407 (and https://github.com/keepassxreboot/keepassxc/issues/10406 https://github.com/keepassxreboot/keepassxc/issues/10406)
Szpadel 3y ago
> Then had to like type in the CCV to retrieve the card but then it also charged my bank account 1c for the privilege of autocompleting the card each time. I believe those transactions are never confirmed and are reverted after 7 days or something like that
guappa 3y ago
I think your mistake is not using firefox.

Groxx 3y ago

Yep, this is why I don't use passkeys. I tried. The power-grabbing garbage was immediately apparent and sent me straight for "heck no, I'll just use passwords until they figure this out, at least that can't control my password manager". In principle I should be very in favor of them, but the wild variety of lack of support for basics, and the built-in-the-spec ability for site X to control how I store and sync stuff is utterly bonkers. It's feeling like the OpenID promise -> OAuth platform lock-in cycle all over again, but compressed into v1.

sroussey 3y ago
I use 1Password which supports Passkeys, and don’t have an issue across mobile or desktop. I don’t get what the issues people have really are. I never experience them (fortunately!).
- MrDrMcCoy 3y ago
  1Password is a closed-source, cloud-hosted service. At any time, for any reason, they can close and delete your account, leaving you high and dry. Self-hosted, multi-device password managers are the only real solution. Thankfully, Vaultwarden and KeePassXC fill this role perfectly. Now if we could just get the other providers that require insecure email/SMS 2FA to follow suit, that would be great...
  - gcr 3y ago
    For others reading this thread, looks like KeePassXC announced passkey support last October! Does it work well?
  - ceinewydd 3y ago
    I’m really not sure the “only real solution” is every human needs to selfhost a password manager. That’s ill-advised; an extreme take. The vast majority of the population will do a worse job on the availability and security of a selfhost solution than 1Password, whose core business and value proposition is password management. I’m a very happy user of 1Password for Families and consider it the likely the best ~$50 a year that I spend on hosted technologies.
    - sroussey 3y ago
      Agreed. I self hosted the key 100 bitcoin in like 2010. Machine crashed. Oops.
      - littlestymaar 3y ago
        That's a fundamental problem with cryptographic security: you cannot trust people to manage your keys for you (because due to lack of regulation preventing that companies have this bad habit of pulling the rug under their customers' feet) but you cannot trust yourself doing that either, because you can, and will, make mistakes.
        pydry 3y ago
        I've always wanted a decentralized solution that lets me trust my friends instead.
        eru 3y ago
        You can use a threshold secret sharing scheme to distribute your keys amongst your friends (and amongst companies). This way you don't need to trust any single one of your friends to be 100% honest nor 100% available.

marssaxman 3y ago

> and shut down my Google Pay account I never knew I had Google loves that nonsense, don't they? It's as though they think so highly of themselves that they cannot imagine they might not be strictly doing us all a favor by signing us up for their services. Fifteen years later, I still have friends occasionally sending messages to a GMail address I never asked for, never used, and didn't even know about for most of a year while it was virally spreading through people's address books, silently diverting mail away from my actual address. The only time I used this account, after I discovered that it existed, was to delete it - but GMail apparently still suggests it when people type my name, because I get an "oops, sent this to the wrong address" forward every few months. No I will not be knowingly using any Google passkey service, but perhaps I will someday find that they have signed me up for it anyway.

Atotalnoob 3y ago
Why don’t you setup the Gmail account to forward? I know it’s a hassle, but will resolve the issue
- macintux 3y ago
  That seems like an invitation for long-term pain if Google changes their policies, requiring someone to log in every X months or have their gmail account locked, for example, or some AI enforcement tool locks the account for inscrutable reasons.
  - qingcharles 3y ago
    I'm locked out of my Gmail and it still forwards to the recovery email address, but I can't get in to change the settings. They also won't allow me to download all my data, as required by statute, because I can't log in.
  - duskwuff 3y ago
    I've got some active GMail forwarding addresses that I haven't logged into for 10+ years. I don't think they could change how that worked now even if they wanted to.

twobitshifter 3y ago

Same thing with google app on ios. My wife saved a password to a site on her phone and we were trying to find it to log in again. Since she had navigated to the site through the Google app, the password ended up in her google account instead of the iPhone keychain - unlike in every other app on the iPhone.

gcr 3y ago

Odd! I've been able to sign into desktops running Chrome both on Windows and Mac. Both times Chrome will show a QR code that my iPhone scans. The actual passkey is stored in 1Password. The dark pattern about signing up for google pay is absolutely inexcusable though. Sorry you're going through that.

whywhywhywhy 3y ago
I think they changed it recently to offer a QR code because checking now it's offering it. But I absolutely had the issue for the first few months of the year.

flaminHotSpeedo 3y ago

The lock in is intentional, security theater touted as a feature in the shitty, ambiguous spec. Unfortunately, the folks who contribute to the spec are more concerned about threatening projects that have the audacity to use common sense instead: https://github.com/keepassxreboot/keepassxc/issues/10407 https://github.com/keepassxreboot/keepassxc/issues/10407 (and https://github.com/keepassxreboot/keepassxc/issues/10406 https://github.com/keepassxreboot/keepassxc/issues/10406)

Szpadel 3y ago

> Then had to like type in the CCV to retrieve the card but then it also charged my bank account 1c for the privilege of autocompleting the card each time. I believe those transactions are never confirmed and are reverted after 7 days or something like that

guappa 3y ago

I think your mistake is not using firefox.