20 ms·

Microsoft Confirms Password Deletion for 1B Users

248 points by elorant 2y ago

theyknowitsxmas 2y ago
Border security and thief's wet dream.
jeisc 2y ago
the only secure device is turned off
jsnell 2y ago
Blogspam for https://www.microsoft.com/en-us/security/blog/2024/12/12/convincing-a-billion-users-to-love-passkeys-ux-design-insights-from-microsoft-to-boost-adoption-and-security/ https://www.microsoft.com/en-us/security/blog/2024/12/12/con... The title is inaccurate. Microsoft doesn't actually "confirm password deletion for 1B users". They confirm it for millions. They have a concept of a plan for getting >billion people on passkeys as an auth factor, and will be able to get some of them to go passkey-only.
- mellow-lake-day 2y ago
  > Our experiments show that people love passkeys and are ready for them. Really? I somehow doubt that. > If they don’t enroll when you first ask, don’t assume their decision is permanent No is supposed to mean no
  - aeim 2y ago
    Er, isn't it a bit manipulative to equate changing a software system with the more serious uses of that phrase?
    - e3bc54b2 2y ago
      It is manipulative to constantly harass users with 'prompts' until they break down and give up.
      - hulitu 2y ago
        > It is manipulative to constantly harass users with 'prompts' until they break down and give up. "If it works for Google, it shall also work for us". Regards, Microsoft /s
      - result2vino 2y ago
        [flagged]
      - rcxdude 2y ago
        Indeed. My biggest bugbear with this is google's "location accuracy" service, which implicitly sends them not only your location, but a detailed map of any networks around you. It takes active effort to keep it turned off (and doing so actually breaks quite a few UI flows in google maps!), and still I've accidentally turned it on a few times and only noticed because I actively check for it. There is no reasonable definition of 'consent' which can be derived from that setting.
    - result2vino 2y ago
      [flagged]
    - Nifty3929 2y ago
      I never took that phrase to be reserved for sexual situations - in fact my mom used to use it with me all the time over toys, ice cream, etc. "Come ON, PLEEEASE?!" "No means no..." I think it's a phrase that is often applied in sexual situations, but not intended to be exclusive to them.
    - mystified5016 2y ago
      No, it's exactly the same tactic that sexual predators use. Nag and whine and wear down the target until they agree to make you shut up. It's predatory behavior pure and simple. Call it what it is and stop apologizing for abusers.
  - hulitu 2y ago
    [flagged]
  - paweladamczuk 2y ago
    > No is supposed to mean no One counterargument is that nobody forces you to use their services. I think the root problem is that nobody produces personal hardware over which the average person could conveivably assume full control. I'm not even sure it's possible, given how advanced the computer technology is.
    - majewsky 2y ago
      > One counterargument is that nobody forces you to use their services. Not specifically Microsoft, but more and more government services are accessible only through apps that are only offered through Apple's App Store or Google's Play Store. (Either directly, or because a generically eID app is used.) So in this case, I am absolutely forced to agree to either Apple's or Google's ToS to interact with my government.
      - mistrial9 2y ago
        no you are seeing the easy ramp access pushed on you.. government is unique (in the USA) that it is required by law to be accessible to citizens including disability etc.. you can do almost anything using some (terrible,slow,error filled) paper process IMHO .. and there is a systemic reason why this will remain true, even as they push "one phone,one person" dystopia
        hahn-kev 2y ago
        There are other countries
      - eikenberry 2y ago
        I'm assuming those applications are hardcoded to use either Apple or Google (respectively) as the passkey service provider? IE. that the problem is that they don't allow you to configure your own 3rd party passkey service?
    - mystified5016 2y ago
      No one is holding a gun to your head, no. But ij a lot of ways, you are required to use these services to participate in society. My job forces me to use Google and Microsoft because that's what the entire industry is built on. Should I uproot my entire family's lives so I can move across state to find a new job? Is that a reasonable compromise to make so I don't have to complain about windows?
  - deleted 2y ago
    [deleted]
  - nijave 2y ago
    I don't mind passkeys and Bitwarden will take care of them for me. I enrolled most important stuff with hardware tokens and it's the same services now offering passkeys so I haven't migrated but probably eventually will. Microsoft only started supporting webauthn in the last couple years so it's surprising they're actually rolling out passkeys. Maybe they finally gave up on smart cards
    - eikenberry 2y ago
      Do you run your own Bitwarden server? If so are there any issues you've come across?
  - rk06 2y ago
    They are really good. And but my android phone (on android 13) doesn't support it. So what should I do? Buy another phone?
- Nifty3929 2y ago
  I just had a great, novel business idea. I'm going to start writing brief, ad-laden, content-free articles all about someone else's blog post. Glad I thought of that before anyone else did. Please don't steal my idea.
porridgeraisin 2y ago
> And once that’s done, the data suggests there will be no turning back: > Users are three times more successful signing in with passkeys than with passwords (98% versus 32%). > 99% of users who start the passkey registration flow complete it.” I suspect this is because primarily tech oriented folks use passkeys today, and they are fairly unlikely to have trouble logging in with any method.
- noname120 2y ago
  Passkeys are already standard, enabled by default in all the popular web browsers, and thus already widely used by non-technical people (path of least resistance).
- maeil 2y ago
  Hilariously that 32% may well include all the bots doing stuffing attacks.
  - grraaaaahhh 2y ago
    Also probably includes all the times my company has made me change my password. It always takes a good week before I remember that my old password isn't the one anymore.
- acdha 2y ago
  It’s because it’s easier. Here’s what an Apple user experiences for creating an account or signing in: 1. Tap the login with Face ID button 2. Tap to approve it It’s even faster than using a password manager without MFA but safer than password+MFA, and you aren’t spending any time goofing around with some poser’s password complexity policy or rotating your password when their servers are breached.
  - thousand_nights 2y ago
    for real, it's so much better i've started using it everywhere, to the point where if a service asks me for a password i get really annoyed. no i don't remember this random string i typed in months ago and no i don't want to have to type in the password to unlock my password manager for the 82349th time this whole thread is perplexing, a forum full of tech people bitching about something that's more secure and more convenient
lausbub 2y ago
What are passkeys?
- badgersnake 2y ago
  Another way for Google to collect your credentials.
  - ghjfrdghibt 2y ago
    And Microsoft, as per the case here. Or Apple.
  - maeil 2y ago
    Moreso another way to promote vendor lockin and planned obsolence.
- whstl 2y ago
  They're an authentication method that uses public/private keys instead of passwords. In websites the standard name is called WebAuthn. This is similar to SSH or git operates when you disable passwords and use keys in ~/.ssh, for example. You can store the private keys in YubiKeys or in password managers.
- stonemetal12 2y ago
  It is public key cryptography. You give websites your public key, and keep your private key hidden. When you sign in to a website, they send you a nonce. You then digitally sign the nonce with your private key. They verify that the signature was signed with your private key, allowing you to log in. There is no private info (aka a password) going out in public so you don't have to trust anyone to keep your password secret. It greatly reduces the attack surface of logging in, but the attack surface is moved to the weakest part of the system, aka the user.
Tistron 2y ago
so OTP with the seeds backed up somewhere, and then passkeys on the devices I use often? Seems like this will also be difficult for a lot of non-technical ppl. Though I guess not much worse than forgotten passwords? In Scandinavia we have authenticators tied to the banking system (MitID in dk and BankID in sv), where if you lose it, you can get it renewed by going to your bank, or you can have a special hardware device at home that helps you renew it. Does this exist other places? These are used on more and more sites around here, where your real identity is important (everything utilities, banking, insurance, banking etc).
kazinator 2y ago
So Microsoft blocks password attacks. A blocked password attack will never be successful. And they have to block a measly 7,000 of such attacks per second across the entire organization. Wow ... how not to convince me that passwords are a problem.
- hyeonwho4 2y ago
  I wonder how the internal metrics even define "password attacks". I have a 15 year old Skype account (with a long password) which I lost access to because Microsoft suddenly started requesting verification, insisting on 2FA via SMS to a 10-year-old phone number. Are all ten of my attempted logins counted in that statistic?
  - kazinator 2y ago
    I imagine it has to be a certain number of attempts, because it's counting the password attacks that are stopped. You don't identify and stop a password attack after just two or three attempts. Let's say that the threshold is 20 attempts. So that's 7,000 * 20 = 140,000 password attempts per second. That's not very fast. It will not uncover strong passwords in any reasonable timeframe.
- jsnell 2y ago
  False negatives are a thing. If they've got a 99.9% success rate at blocking password attacks, it means there's 7 qps of successes. That's 500k hijacked accounts per day, 200M per year. That is a very large number. And not a lot of systems have 99.9% recall, without trading away absurd amounts of precision...
  - kazinator 2y ago
    If they suspend an account after, say, 20 password attempts, they're success rate at stopping password guessing will be vanishingly close to 100%. Especially if they've instigated strong passwords. If passwords cannot contain dictionary words and must be mixed case with at least one special character in digit, there's no freaking way anybody's going to guess their way in, with a small number of tries before the account is frozen. The number of penetrations from that is going to be so tiny, it's not worth worrying about. The bigger worry are stolen password hashes being cracked surreptitiously, where the attacker has an unlimited number of tries whose rate is only limited by their hardware.
deleted 2y ago
[deleted]
avhception 2y ago
I'm really skeptical about passkeys. This blog post talks about it in detail: https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/ https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt... Also discussed on HN at the time: https://news.ycombinator.com/item?id=40165998 https://news.ycombinator.com/item?id=40165998 I think I'm fine with my uf2 / webauthn devices as second factor, thanks. (Edit: to be clear, I'm not the author of said blog post)
- growse 2y ago
  Passkeys are webauthn credentials.
fbnlsr 2y ago
The problem with passkey is that it's obscure for the common folk. I'm a developer, yet for some odd reason I'm having a hard time understanding passkeys. Are they synced between devices? Do I need to set up a passkey per device? What happens if I have a single passkey on my phone and it gets lost? Do I lose access to that service? So many questions that need a clear and concise answer.
- vbezhenar 2y ago
  Most implementations sync passkeys to the respective clouds.
  - hulitu 2y ago
    > Most implementations sync passkeys to the respective clouds. So, in the end, the old Microsoft mantra: "Your security is very important for us". Besides Microsoft, NSA, CIA, the five eyes and friends, no one has access to your passkey, this means is secure.
    - acdha 2y ago
      No. If you read the documentation, they only synchronize encrypted data.
  - ghusto 2y ago
    Do the keys need passwords to work, or is the key itself sufficient? i.e. Is it like an SSH key without or with a password?
    - TheNewsIsHere 2y ago
      The key itself, but the standard explicitly supports platforms, browsers, or password managers handling authentication to permit key use. For example you can have a passkey where the private key is on a security token protected with a PIN or biometry. You can have a private key live in a secure element on an endpoint too. You could make a browser plugin that requires no auth whatsoever if you wished.
drawfloat 2y ago
Until they are successfully explaining how to use these in a way that 70 year olds on eBay can understand, this should not be forced on users.
- josteink 2y ago
  «Activate login via FaceID». «OK». Congratulations. You have a passkey. Was that easy enough?
  - jedberg 2y ago
    What happens when they lose or break the phone, or switch phones, which my parents do every two or so years?
    - jf 2y ago
      If they have a Google or Apple account on their Android or iOS device, then nothing happens.
      - jedberg 2y ago
        I mean in the interim. How do they get into their email to find their support contract to get another phone if they can't get into email without their phone?
        jf 2y ago
        For Apple at least, you walk into an Apple Store, buy a new phone, and have them help you log into it again.
        jedberg 2y ago
        What if you're traveling and there is no Apple Store nearby? And now you can't log into your email to get your travel itinerary or your transportation receipt? The greater point is not the specific edge cases, it's that they haven't been worked through. Even a sophisticated user like myself doesn't want to use passkeys exclusively yet because of this very reason. I'm not confident that I won't get completely locked out when it's absolutely critical that I get in.
figassis 2y ago
I really just want passkeys to exist for a decade and all lockout/lock-in edge cases being resolved before I retire my password manager, and before I tell my mother to move to passkeys.
- josteink 2y ago
  Why not use both? There are several password managers which supports passkeys. That’s where I have mine.
  - jedberg 2y ago
    That's fine for me, but my parents not so much.
- fuzzfactor 2y ago
  Looks like they're beginning to work on it as we speak, how is this not supposed to be proven as stupid as possible by now :\ >At the moment, export/import is not part of the "Passkey" standard. The FIDO Alliance has a draft of the Credential Exchange Protocol that would allow such actions. If it's already a standard, and it's that deeply faulty because it's been brain-dead since the beginning, then for a user having valuable data, they may be best advised to run the other way forever. Simple. When you have an alliance of previous competitors and they are either incompetent or user-hostile enough from the beginning to leave out the most important factor in recovering from disaster -- personal backup & recovery -- I would want to wait a good ten years until after everyone as untrustworthy as that has been banished from any security work that could be the least bit consequential. You can't have adequate security with untrustworthy people building the foundation no matter what they say otherwise. People are the real problem, but clueless "security" people with initiatives this half-baked are more of a threat to average users' valuable data than millions of other clueless users are.
gwbas1c 2y ago
> Passkeys not only offer an improved user experience by letting you sign in faster with your ... PIN, but they also aren’t susceptible to the same kinds of attacks as passwords. I don't know about you, but a PIN is pretty much a password in my book. Once I figured out that I can use a password with Windows, I stopped using my PIN. (I didn't use Windows for about a decade.) It's much easier to remember. Even worse, on Windows, I'll only use passkeys on sites where I can use a Yubikey. If the passkey requires a PIN, I don't bother. I just can't be bothered to remember it. Otherwise, on Mac, my passkey supports my fingerprint sensor. Much easier.
- stetrain 2y ago
  The Windows PIN is just a local password that isn't tied to a cloud account or ever sent across the network. Mine is a full text password, it doesn't have to be numeric. I haven't tried it but it should also work with "Windows Hello" supported face or fingerprint recognition.
  - gwbas1c 2y ago
    That is not mentioned anywhere, neither in the article, or when setting up a PIN. The common definition of a PIN is for things like using an ATM, where the PIN is for the account, not the card itself.
    - lxgr 2y ago
      The PIN is also for the card itself. The smartcard chip inside the card can validate it for offline transactions (although that's not as common in the US). I think a reasonable modern definition for a PIN is "a password that can safely be short"; more here: https://news.ycombinator.com/item?id=42446015 https://news.ycombinator.com/item?id=42446015
      - gwbas1c 2y ago
        PIN stands for "Personal Identification Number." It can't have letters / symbols in it. If they're calling a password a PIN, that's the wrong word and will confuse the ^%$^#% out of people who expect PIN to mean numbers only.
Havoc 2y ago
Is there a good ELI5 for passkeys somewhere? A quick google got me to a site that says: >Passkeys use Bluetooth technology, which requires physical proximity, to help verify the user. Which I somehow doubt is accurate.
- somat 2y ago
  You probably know most of this, so sorry for the over simplification. but you asked. A passkey is an implementation of public key authentication. The private part should stay with you, this is your identity. The public part gets shared with others, they can use this to verify your identity. "microsoft passkey" wraps all this up into a simple tool that just looks like you are putting in a pin number. The vague thousand foot mechanism is. someone who wants to verify your identity will ask you to sign a unique number. because only you have the private part needed to to do this, only you can sign it correctly. they can then use the public part to verify the signature is correct. and know it is really you they are talking to. The private part is usually protected by a device, something to prevent others from using it. this is often just a password, in this case a PIN. but some times is a dedicated usb dongle. this only has to have local security guarantees not global network security guarantees. so a simple password like a PIN is not considered a problem. The primary advantage over a simple password based system is that the thing that is shared(the public part) is unable to be used as your identity so it can't be stolen like a password. or perhaps more accurately, it does not matter if the public part is stolen(it is already public knowledge) And now the irony, I have no proof, however I have a suspicion that because loosing the private part is the same as loosing your identity, that is, a big deal and a huge hassle to recover the account. I suspect microsoft is storing them internally. which means your account security degrades to a password based system where the password is basically pubic knowledge, that is, your so called security questions. what is your favorite color? is not a good password.
  - vaylian 2y ago
    Just to add to your explanations: 1. Passkeys contain the username and the domain of the service that you have registered with 2. Because passkeys contain the domain, it provides very strong phishing protections, because a look-alike website still has a different domain. Passkeys are resident keys. They take up storage space, which is a problem for dedicated hardware tokens which usually have limited storage space. A much nicer solution are non-residential keys that get recomputed on the fly based on the domain name that you want to authenticate against.
hooverd 2y ago
The FIDO Alliance can eat it until they support exporting passkeys and stop passive-aggressively threatening, "why don't we talk about this privately" anyone who tries to implement that.
- TheNewsIsHere 2y ago
  There’s a recently released draft for an export/exchange protocol. Multiple vendors have already signaled work on implementation.
  - hooverd 2y ago
    Oh, that's good news!
  - kbelder 2y ago
    Does it allow me to export my credentials to my own machine for me to do with as I will, or is it only allowed for particular authorized vendors?
iandanforth 2y ago
Passkeys are a terrible idea. They are security theater and a disaster for users waiting to happen. Imagine you're on vacation and have lost your phone. You want to go to a cafe and log into a chat app, an email service, whatever to contact your family. In the world that passkey advocates want this is impossible via the passkey flow. If you can't authenticate via a primary device that contains your private key, you're f-ed. Service providers know this so of course they will provide recovery mechanisms. (Not consistent recovery mechanisms of course, each will have their own convoluted and likely to be broken ones). If the recovery mechanism allows for knowledge based recovery (challenge questions) then you're basically telling people that they need N passwords rather than one password. Maybe that challenge question is just a long password (recovery key). Maybe it requires access to another system, which you likely don't have in this circumstance. So you're either back to having passwords, or you're f-ed. Security theater or a disaster. A service only has value if I can access it. I should be able to sit down at any computer in the world with the knowledge in my head and get access to any online service to which I subscribe.
- deleted 2y ago
  [deleted]
- d4mi3n 2y ago
  You’re not wrong, but I think you’re presenting this as a dichotomy when there’s a lot of value to be had between the two extremes (passkeys all the way or passwords all the way). The big benefit to a passkey for a service provider is that when you see a user using one, you can assert things about that session—that this is the users device, that the session isn’t likely to be spoofed, etc. These are useful things to know if you want to implement any kind of context-aware access! Passkeys certainly aren’t a silver bullet, and I don’t think they’re really marketed or implemented well a lot of the time, but I’d caution against writing off the tech as a whole .
- GoblinSlayer 2y ago
  How do you log in anywhere without a computer? You have a wifi receiver implanted in your head?
jmclnx 2y ago
Unless this is 100% free, easy and no PI, I will tell people to move to Linux
- RevEng 2y ago
  That won't solve anything when make online services that we all rely on start moving to this.
boohoo123 2y ago
"Passwords are no longer safe, the future is passkeys. Thus you can log in with face, touch or a PIN" PIN - a personal identification number (aka a password) This is one of those times where there is usually an ulterior motive behind this decision. Most cases in the form of power and/or control.
- acdha 2y ago
  If you’re going to speculate about ulterior motives, fill in the supporting details so people can tell you’re not just promulgating conspiracy theories.
  - 015a 2y ago
    Its a lot harder to share the passkey for e.g. your Netflix account among friends.
    - acdha 2y ago
      So you think that Netflix has gone to Microsoft to start a multi-year industry-wide standardization process to change how people login because that’s easier than looking at their own log files? Netflix didn’t crack down on shared passwords when they were growing rapidly but that’s not because they couldn’t.
      - 015a 2y ago
        I don't, but yes; many seriously actually believe this is why the industry is moving to passkeys. It isn't logical, it isn't reasonable, but these are your customers.
        acdha 2y ago
        So that sounds like an argument for better education, not recirculating baseless conspiracy theories.
        2y ago
galleywest200 2y ago
My company uses Azure SSO so I am curious if this is just coincidence... but just this morning I had two (2!) separate desktop support technicians reach out to me today asking if I got my passkey set up for the company portals.
015a 2y ago
The software industry has zero concept of how much pain and suffering passkeys are going to cause the average person, almost entirely because the average American has an iPhone and a Windows laptop and there's literally nothing built-in to iOS or Windows that will sync passkeys between these two devices. The world's most popular password managers are Excel and Apple Notes, in that order; these apps do not support Passkeys. Passkeys are not going to happen, and its the industry's fault. Its a bad standard that solves some problems the industry itself has, by creating more problems for consumers. If you force consumers to move to only-passkeys, you're going to lose customers, and it might not even be their choice, you're just making the decision to lock people out.
- josteink 2y ago
  > The software industry has zero concept of how much pain and suffering passkeys are going to cause the average person, almost entirely because the average American has an iPhone and a Windows laptop and there's literally nothing built-in to iOS or Windows that will sync passkeys between these two devices Then you register multiple passkeys for the website, just like you would register several Yubikeys. It’s a 1-click process, and no HW-token required. Most people will be fine.
  - spencerflem 2y ago
    How do you log in on the other device to set up the second passkey?
    - growse 2y ago
      Using the "passkey on other device" flow, which usually involves QR codes.
      - hbn 2y ago
        What if my phone irreparably broke?
        2y ago
thedanbob 2y ago
If Microsoft really wants to push passkeys, why do they require Microsoft Authenticator for passwordless accounts? I already have a passkey set up and I'd be perfectly happy to delete my password, but I can't because I don't want yet another authenticator app exclusively for an account I barely use.
- snailmailman 2y ago
  I was tempted to set this up, as I’ve been using passkeys everywhere that I can. But yeah, I’m not going to use Microsoft Authenticator for this one single account. I even already have a passkey for my Microsoft account.
tialaramex 2y ago
From the HN pushback I think this will end up like IPv6. I get to have nice things and some others likewise - many people get to repeatedly say "Nice things are impossible" and roll their eyes. I guess they're having fun in their own way? It's nice when we build a non-brainer technology which gets adopted at scale by default, as happened for TLS 1.3, or even when other motives overwhelm the instinctive conservatism (e.g. Let's Encrypt) but that can't always happen and it looks like for WebAuthn the conservatives are going to stick by passwords "From my cold dead hands" etc. One problem with HN in particular is that there are a lot more decision makers here, so more people whose conservatism means they're going to build, promote and demand worse solutions since the better option is in their minds impossible. That's unfortunate, it means there's a good chance that over the next years I'm going to be using more important services which have terrible authentication on account of somebody senior said "Passwords are good, we should require passwords" and anybody disagreeing was hushed or worse fired. So that's not great, but it is what it is. Anyway, for the few people who get why this is a good thing but understandably don't trust Microsoft (or Apple, Google, Facebook, I dunno, Epic Games?) I have a suggestion: All of this technology also works fine with a Security Key, which is a thing you can buy from Yubico (or several other outfits, but Yubico is easiest if you have no idea what you're doing) for like $25. And if you - like me - use Security Keys those "But what if I lose it?" questions can be answered by Technology Connections' favourite: The magic of buying two of them.
- lxgr 2y ago
  Security keys (i.e. "roaming authenticators" in WebAuthN language) have significant practical usability and availability downsides. > "But what if I lose it?" questions can be answered by Technology Connections' favourite: The magic of buying two of them. And the magic of having to access both of them every time you create a new account anywhere, which probably means you'll keep them both close by – increasing the availability risk. A more realistic recommendation would be to use an open source FIDO backend such as Bitwarden or Strongbox that let you cross-platform sync and, worst case, export your credentials if the vendor goes down a bad path.
  - tialaramex 2y ago
water-data-dude 2y ago
Wait. “In the two years since passkeys were announced and made available for consumer use, the FIDO Alliance reported a few weeks ago, “passkey awareness has risen by 50%, from 39% familiar in 2022 to 57% in 2024.” I don’t think that math works? Am I misinterpreting something?
- silentguy 2y ago
  (57-39)/39 ~= 46 I think they meant 50% increase from the 39% .
  - water-data-dude 2y ago
    Ah! It was early, my brain wasn’t working. I appreciate the restraint the HN community exercised in not mocking me, hahaha
- Eisenstein 2y ago
  50% of 39% is 18. Add to 39 to get 57%.
  - deleted 2y ago
    [deleted]
- jedberg 2y ago
  That's why we use points when talking about changes in percentages. :) Imagine it was 100 people. 39 were aware. 50% of that is 20. So now 57 are aware, which is 18 more than before, which is pretty close to 20. So yeah, it was a change in 50%, but it was only 18 points higher.
gavinhoward 2y ago
One thing passkey proponents forget is password-authenticated key exchanges (PAKEs). PAKEs use passwords, and they are unphishable. That is the direction we should go to avoid vendor lock-in.
- jf 2y ago
  Does PAKE protect against scenarios like "password written on sticky note", "fake login page hosted at login.nnicrosoft.com", or "scammer impersonating IT staff"?
  - gavinhoward 2y ago
    From the first, no. It does handle the second and third, IIRC.
    - lima 2y ago
      It doesn't handle these either - what stops the user from entering their password on an attacker-controlled phishing page? Passkeys work because the user can't be tricked into entering their private key on a phishing website.
      - gavinhoward 2y ago
        Browsers could help with this. They just don't.
- growse 2y ago
  Where's the vendor lock-in?
  - gavinhoward 2y ago
    Cloud sync.
    - growse 2y ago
tomjen3 2y ago
Passkeys are an excellent way to lock yourself into your current device and out of your accounts if you ever move away.
addicted 2y ago
I haven’t dug into this but I must be missing something with passkeys. It’s the same issue I had with getting a Yubikey. The odds that I lose a piece of hardware that I’m carrying on me seems orders of magnitude greater than the odds of having my password cracked. How does one recover from a lost device (other then backing up to Apple’s private cloud in which case you’re beholden to them forever to be able to access your own accounts).
- Biganon 2y ago
  I have two Yubikeys, one of them never left my home
  - mgulick 2y ago
    So do I, but this is annoying because I need to have physical access to both of the keys when setting up 2FA on an account, or hope that I remember to add the backup yubikey when I get back home.
  - vorpalhex 2y ago
    The great thing about bitcoin crap is that it's real world public/private keys used by the general public. And oh man tons of almost millionaires have lost their backups. Tons of people still have stolen credentials. Basically nobody can "do it correctly".
  - EvanAnderson 2y ago
    The "have a backup token" workflow seems like tedious make-work. I have to remove it from its "safe place" and keep it proximate to my primary token while I enroll it in everything my primary token is enrolled in. The workflow to enroll a new backup token (when the primary is lost and the backup becomes the primary) also seems like tedious and error-prone make-work. It would great if I could load my backup token's public key into my primary token and export a copy of the primary token's secrets, encrypted with the backup token's public key. When I lose my primary token I would only need to restore my backup token and be back in business. That eliminates the make-work of enrolling on the backup token. Of course, this scheme allows for "cloning" of a token so it'll never be allowed by the "security" nannies who know better than us.
swozey 2y ago
I'd appreciate it if they let me block specific countries, etc from even attempting to log in. You can see the failure attempts somewhere in your user settings and I have them all day long from countries I'll never step foot in and quite a few adversarial.
agentultra 2y ago
Aren't passkeys centrally hosted? So if MS gets breached or decides I don't matter they can just lock me out of my life if I host my passkeys with them?
consumerx 2y ago
[dead]
physicsguy 2y ago
I use Bitwarden. I don’t mind passkeys ending up there. But i want them all in there. I find the UI/UX is really poor with browser extensions, etc. and preferentially trying to use the OS’s password manager to store passkeys.
mgulick 2y ago
I think technical people understand the mechanics of using Passkeys, having them backed up to multiple devices etc, but there's no way my 70 year old father is going to be able to understand that. He barely knows the difference between the computer login and his gmail login. My parents are also not wealthy-enough to have Apple take care of all of this for them. He has a hand-me-down Linux laptop because all he needs is Google Chrome. Thankfully I've been able to teach my parents to write down their passwords in a password book. I can't tell you how many times I've ask my father "what's your google password" and he says "I don't have a google password". I like the idea of eliminating passwords, but inevitably his phone is going to break or his computer is going to crash and he needs a way to recover.
- it_citizen 2y ago
  The password book of every person around me become awful over time. They don’t distinguish between uppercase and lowercase, they write bad notes, most of the content is outdated, sometimes there duplicates and overall cause me more headache than anything. I hate password books. I don’t have a better solution though. For now, I teach them to use chrome password manager for now and log in their chrome account when they need help. It sucks too. But at least I don’t get angry with their notes.
  - akvadrako 2y ago
    A box of index cards with alphabetical tabs is a step up. That way you can update entries without making the book a mess. But it's a small step.
koolba 2y ago
> 99% of users who start the passkey registration flow complete What about the flow where 99% of users don’t know how to back up and restore passkeys and get permanently locked out of their accounts?
choeger 2y ago
And passkeys only work with Microsoft OS, Microsoft Browser or some other thing that Microsoft controls? Not hat I would ever imply that Microsoft has anything than our best interests in mind...
- int_19h 2y ago
  It is an open standard that is supported by all major OSes and browsers. In fact, I would wager that the majority of current passkey users are on iOS (since Apple has been pushing this for a while now, and it's nicely integrated).
Nifty3929 2y ago
https://www.microsoft.com/en-us/security/blog/2024/12/12/convincing-a-billion-users-to-love-passkeys-ux-design-insights-from-microsoft-to-boost-adoption-and-security/ https://www.microsoft.com/en-us/security/blog/2024/12/12/con...
- doublerabbit 2y ago
  > There’s no doubt about it: The password era is ending. No it's not. How am I suppose to login to a console of a air-gapped server with passkeys? > Signing in with a passkey is three times faster than using a traditional password and eight times faster than a password and traditional multifactor authentication. When you sign in to anything Microsoft, you have to go through four different redirects, sure automatically but not not exactly single page sign-in. > We don’t let users permanently opt out of passkey invitations, but we keep the messaging friendly. by friendly you mean Dark-UI to push the user in the corner forcing them to accept as you limit their options one by one with threatening notification and nagging. > We’re proud to be part of this collective effort and hope you will share learnings as well as you progress in your passkey journey. Learnings is a grammatical error. Microsoft is proud to be a collective for part of vendor locked in. The rest of all spunk.
  - samcat116 2y ago
    > How am I suppose to login to a console of a air-gapped server with passkeys? Passkeys don't require the internet to work
    - doublerabbit 2y ago
      I have a crash trolley at my DC where I colocate. It has only a keyboard, mouse and monitor. USB has been disabled for security as I don't own my quater-rack (yet) in which I share with other DC customers. The system is in a critical state where by a reboot would be disastrous. How am I supposed to login with passkeys?
      - samcat116 2y ago
_1tem 2y ago
How do I backup my passkeys? I can print out a hard copy of passwords and even 2FA code generator strings, but I haven’t seen an easy way to export and import passkeys. This is a problem. If it were as simple as printing out a list of QR codes or URL strings I would be happy, but so far no password app I know of supports this.
- justinholt 2y ago
  At the moment, export/import is not part of the "Passkey" standard. The FIDO Alliance has a draft of the Credential Exchange Protocol that would allow such actions. Allowing the trivial export of a passkey would end up defeating the cryptographic protections they offer. https://www.bleepingcomputer.com/news/security/new-fido-proposal-lets-you-securely-move-passkeys-across-platforms/ https://www.bleepingcomputer.com/news/security/new-fido-prop...
  - maple3142 2y ago
    I don't understand how can it really prevents exporting passkeys if it can be implemented by open source implementations like keepass. For example, if keepass do follow the guideline of FIDO Alliance to not implement exporting, but it would still possible to make a fork of keepass that force it to dump the credentials somewhere.
dcchambers 2y ago
If you are comfortable using a cross-platform app like 1password, then passkeys can be a pretty great user experience even across ecosystems. But Passkeys have a huge problem: They assume you will never have your device(s) stolen or broken or otherwise made inaccessible. What happens if you're out of the country on holiday and your phone/laptop gets stolen and you need to log into your account(s) from a brand new device? You're mostly shit out of luck if you use passkeys. Especially because most peoples' backups/account recovery is a google email or icloud account which...requires you to have a known device handy to access them or set them up on a new machine.
apitman 2y ago
A lot of the arguments I'm seeing against passkeys are essentially that they are worse for power users who already have a password manager. But they're not mutually exclusive. I've been using bitwarden to store some passkeys. The UX is excellent. Everything is seamlessly synced across Linux, Android, and Windows. I do worry a bit that using a passkey tends to disable MFA requirements, so basically anyone with access to my bitwarden vault can log into those services.
wkat4242 2y ago
Passkeys are good but giving my access keys to big tech (Google, Apple, Microsoft) is not acceptable to me. There's other passkeys implementations and you can even use regular yubikeys as a passkey. But the problem is, many idiot sites block these implementations. PayPal for example only allows it in Chrome or Safari.
trinsic2 2y ago
Great and the solution is passkeys.. were fucked.
eviks 2y ago
> Passkeys not only offer an improved user experience by letting you sign in faster with your face, fingerprint, or PIN, Just like with a password manager > Plus, passkeys eliminate forgotten passwords and one-time codes.” Again, can't forget what's stored in a password manager
kotaKat 2y ago
"Convincing a billion users to love passkeys" Microsoft's "convincing" is just going to be more months of casual user assault, abuse, and gaslighting with no way to just say "no".
xyst 2y ago
I honestly don’t care about the “passkey” revolution. I use a password manager that generates a unique password for every service for a reason. Then secure it with 2FA (either with TOTP or emailed magic link), if available. I think I have used a digital passkey a few times to try it. Works okay, I guess.
Wowfunhappy 2y ago
> Signing in with a passkey is three times faster than using a traditional password Unless I'm using a password manager. > Users are three times more successful signing in with passkeys than with passwords (98% versus 32%). With my password manager, I almost never fail to sign in. Admittedly, the autofill does mess up on some websites and then I have to spend a few seconds fixing it. On the other hand, I am pretty darn skeptical that only 2% of users with passkeys have trouble signing in. Are they not counting the people whose passkey accidentally got deleted, or who are on the wrong device, since those people (by the nature of passkeys) could not even attempt to sign in?
loeg 2y ago
When will Hacker News adopt passkeys?
richjdsmith 2y ago
My mother has been using it because "now [she] only needs to enter her 4 digit computer pin instead of her long Bitwarden password" Unfortunately she is unwilling to change her Windows pin to anything other than the PIN she uses everywhere else. This has not improved her security at all. Before she switched it from what I assume was a Microsoft prompt, she had (through a bit of coaching from me) been fine with Bitwarden + TOTP
atonse 2y ago
I’m all for alternatives to passwords but what is the pathway for “I lost passkey” Is it sending a reset to a recovery email?
- zsjkadj 2y ago
  multiple passkeys
- vbezhenar 2y ago
  It is outside of passkey scope. Most services will use email to recover access.
  - nottorp 2y ago
    > It is outside of passkey scope. Yeah right, pass along responsability to someone else. And you wonder why people don't trust this "security" solution.
    - vbezhenar 2y ago
      There's no reason not to trust it. It's strictly better than passwords in almost every regard. Of course if you manage your passwords well, you don't get more security with passkeys, because your account is already safe enough. But for someone, who used to write his universal "Johny1987" password on a sticker at his display, passkey provides security and usability benefits. Passkey is just not supposed to solve all the problems in the world. It's supposed to replace login and password and that's about it. Authentication.
      - nottorp 2y ago
        That would be fine if it didn't introduce device dependency and vendor lock in. How do I get my keys out of Apple's wallet again? Or out of a Yubikey for that matter. They are no longer under my control and I depend on Apple's or Yubikey's benevolence to access my services.
AstroJetson 2y ago
If I install all my private-passkeys onto my phone, then I have a new problem of Lost, Stolen, Broken to deal with. I’m device agnostic, I want to get to my account from my phone, tablet, laptop, desktop, all I’m doing is spreading the exposure out by needing to install passkeys everywhere.
- jwrallie 2y ago
  Microsoft will probably tell you that the Microsoft Authenticator supports syncing, so you should set it up on a backup device. This has several problems though, one of them being that they assume you have at least two mobile devices (let's say a phone and a tablet) and another that they assume the OS you run on both your devices is the same. They do not support migrating you passwords between Android and iOS for example!
  - ashleyn 2y ago
    I do not and never will trust cloud storage of credentials.
    - WorldMaker 2y ago
      Microsoft's interesting approach here with Authenticator is that they don't expect you to trust one cloud with all your credentials, they are hoping that you can trust two clouds with partial information. They've (allegedly) got some variant of Shamir's Sharing where some of the data is encrypted in OneDrive and some of it is encrypted in iCloud or Google Drive depending on which phone you use. That's (supposed to be) why there is that "phone-type lock-in" on the automatic backups/transfers because the cloud with the most phone-native/device-specific encryption is phone-vendor dependent today.
    - UltraSane 2y ago
      Do you trust VPNs? Because they are the same idea with a slight twist. VPNs encrypt data before it leaves your computer and decrypts it when it arrives at the destination. 1Password and the like encrypt data before it leaves your computer, stores it for however long you want, and then decrypts it when it the data is copied to your computer.
2Gkashmiri 2y ago
I dont get it. How is changing What you know then what you have then what you are To passkeys any better ? Sure you cant hack them but what happens with losing your phone ?
- arielcostas 2y ago
  They are supposed to be synced, for example by Google's Password Manager, iCloud, or whatever tool you use (bitwarden, 1Password...)
  - perryizgr8 2y ago
    Can they be synced to my paper notebook in my desk drawer?
    - lioeters 2y ago
      Can they be synced to my own server, or my local machine like laptop or PC?
      - vbezhenar 2y ago
        You can self host bitwarden.
    - vbezhenar 2y ago
      Technically you can, but most software will make it impossible or hard. It is not supposed to leave the secure storage.
      - hulitu 2y ago
        > It is not supposed to leave the secure storage. How do they authenticate if they are not leaving the secure storage ? Through telepatic transmission ?
        jsnell 2y ago
hedora 2y ago
I can’t say I’ll care all that much when they delete my MS account password, but LinkedIn and GitHub are going to be more painful.
dp-hackernews 2y ago
adversary-in-the-middle == MITM
- ghusto 2y ago
  I was reading that and thought "Wait, don't we already have a term for this?".
  - skydhash 2y ago
    If they use MITM, that will include themselves. A password manager doesn't try to log in for you. But most passkeys managers are MITM. At least we can audit OpenSSL code, and we don't have to care about our public keys.

248 points by elorant 2y ago

theyknowitsxmas 2y ago

Border security and thief's wet dream.

jeisc 2y ago

the only secure device is turned off

jsnell 2y ago

Blogspam for https://www.microsoft.com/en-us/security/blog/2024/12/12/convincing-a-billion-users-to-love-passkeys-ux-design-insights-from-microsoft-to-boost-adoption-and-security/ https://www.microsoft.com/en-us/security/blog/2024/12/12/con... The title is inaccurate. Microsoft doesn't actually "confirm password deletion for 1B users". They confirm it for millions. They have a concept of a plan for getting >billion people on passkeys as an auth factor, and will be able to get some of them to go passkey-only.

mellow-lake-day 2y ago
> Our experiments show that people love passkeys and are ready for them. Really? I somehow doubt that. > If they don’t enroll when you first ask, don’t assume their decision is permanent No is supposed to mean no
- aeim 2y ago
  Er, isn't it a bit manipulative to equate changing a software system with the more serious uses of that phrase?
  - e3bc54b2 2y ago
    It is manipulative to constantly harass users with 'prompts' until they break down and give up.
    - hulitu 2y ago
      > It is manipulative to constantly harass users with 'prompts' until they break down and give up. "If it works for Google, it shall also work for us". Regards, Microsoft /s
    - result2vino 2y ago
      [flagged]
    - rcxdude 2y ago
      Indeed. My biggest bugbear with this is google's "location accuracy" service, which implicitly sends them not only your location, but a detailed map of any networks around you. It takes active effort to keep it turned off (and doing so actually breaks quite a few UI flows in google maps!), and still I've accidentally turned it on a few times and only noticed because I actively check for it. There is no reasonable definition of 'consent' which can be derived from that setting.
  - result2vino 2y ago
    [flagged]
  - Nifty3929 2y ago
    I never took that phrase to be reserved for sexual situations - in fact my mom used to use it with me all the time over toys, ice cream, etc. "Come ON, PLEEEASE?!" "No means no..." I think it's a phrase that is often applied in sexual situations, but not intended to be exclusive to them.
  - mystified5016 2y ago
    No, it's exactly the same tactic that sexual predators use. Nag and whine and wear down the target until they agree to make you shut up. It's predatory behavior pure and simple. Call it what it is and stop apologizing for abusers.
- hulitu 2y ago
  [flagged]
- paweladamczuk 2y ago
  > No is supposed to mean no One counterargument is that nobody forces you to use their services. I think the root problem is that nobody produces personal hardware over which the average person could conveivably assume full control. I'm not even sure it's possible, given how advanced the computer technology is.
  - majewsky 2y ago
    > One counterargument is that nobody forces you to use their services. Not specifically Microsoft, but more and more government services are accessible only through apps that are only offered through Apple's App Store or Google's Play Store. (Either directly, or because a generically eID app is used.) So in this case, I am absolutely forced to agree to either Apple's or Google's ToS to interact with my government.
    - mistrial9 2y ago
      no you are seeing the easy ramp access pushed on you.. government is unique (in the USA) that it is required by law to be accessible to citizens including disability etc.. you can do almost anything using some (terrible,slow,error filled) paper process IMHO .. and there is a systemic reason why this will remain true, even as they push "one phone,one person" dystopia
      - hahn-kev 2y ago
        There are other countries
    - eikenberry 2y ago
      I'm assuming those applications are hardcoded to use either Apple or Google (respectively) as the passkey service provider? IE. that the problem is that they don't allow you to configure your own 3rd party passkey service?
  - mystified5016 2y ago
    No one is holding a gun to your head, no. But ij a lot of ways, you are required to use these services to participate in society. My job forces me to use Google and Microsoft because that's what the entire industry is built on. Should I uproot my entire family's lives so I can move across state to find a new job? Is that a reasonable compromise to make so I don't have to complain about windows?
- deleted 2y ago
  [deleted]
- nijave 2y ago
  I don't mind passkeys and Bitwarden will take care of them for me. I enrolled most important stuff with hardware tokens and it's the same services now offering passkeys so I haven't migrated but probably eventually will. Microsoft only started supporting webauthn in the last couple years so it's surprising they're actually rolling out passkeys. Maybe they finally gave up on smart cards
  - eikenberry 2y ago
    Do you run your own Bitwarden server? If so are there any issues you've come across?
- rk06 2y ago
  They are really good. And but my android phone (on android 13) doesn't support it. So what should I do? Buy another phone?
Nifty3929 2y ago
I just had a great, novel business idea. I'm going to start writing brief, ad-laden, content-free articles all about someone else's blog post. Glad I thought of that before anyone else did. Please don't steal my idea.

porridgeraisin 2y ago

> And once that’s done, the data suggests there will be no turning back: > Users are three times more successful signing in with passkeys than with passwords (98% versus 32%). > 99% of users who start the passkey registration flow complete it.” I suspect this is because primarily tech oriented folks use passkeys today, and they are fairly unlikely to have trouble logging in with any method.

noname120 2y ago
Passkeys are already standard, enabled by default in all the popular web browsers, and thus already widely used by non-technical people (path of least resistance).
maeil 2y ago
Hilariously that 32% may well include all the bots doing stuffing attacks.
- grraaaaahhh 2y ago
  Also probably includes all the times my company has made me change my password. It always takes a good week before I remember that my old password isn't the one anymore.
acdha 2y ago
It’s because it’s easier. Here’s what an Apple user experiences for creating an account or signing in: 1. Tap the login with Face ID button 2. Tap to approve it It’s even faster than using a password manager without MFA but safer than password+MFA, and you aren’t spending any time goofing around with some poser’s password complexity policy or rotating your password when their servers are breached.
- thousand_nights 2y ago
  for real, it's so much better i've started using it everywhere, to the point where if a service asks me for a password i get really annoyed. no i don't remember this random string i typed in months ago and no i don't want to have to type in the password to unlock my password manager for the 82349th time this whole thread is perplexing, a forum full of tech people bitching about something that's more secure and more convenient

lausbub 2y ago

What are passkeys?

badgersnake 2y ago
Another way for Google to collect your credentials.
- ghjfrdghibt 2y ago
  And Microsoft, as per the case here. Or Apple.
- maeil 2y ago
  Moreso another way to promote vendor lockin and planned obsolence.
whstl 2y ago
They're an authentication method that uses public/private keys instead of passwords. In websites the standard name is called WebAuthn. This is similar to SSH or git operates when you disable passwords and use keys in ~/.ssh, for example. You can store the private keys in YubiKeys or in password managers.
stonemetal12 2y ago
It is public key cryptography. You give websites your public key, and keep your private key hidden. When you sign in to a website, they send you a nonce. You then digitally sign the nonce with your private key. They verify that the signature was signed with your private key, allowing you to log in. There is no private info (aka a password) going out in public so you don't have to trust anyone to keep your password secret. It greatly reduces the attack surface of logging in, but the attack surface is moved to the weakest part of the system, aka the user.

Tistron 2y ago

so OTP with the seeds backed up somewhere, and then passkeys on the devices I use often? Seems like this will also be difficult for a lot of non-technical ppl. Though I guess not much worse than forgotten passwords? In Scandinavia we have authenticators tied to the banking system (MitID in dk and BankID in sv), where if you lose it, you can get it renewed by going to your bank, or you can have a special hardware device at home that helps you renew it. Does this exist other places? These are used on more and more sites around here, where your real identity is important (everything utilities, banking, insurance, banking etc).

kazinator 2y ago

So Microsoft blocks password attacks. A blocked password attack will never be successful. And they have to block a measly 7,000 of such attacks per second across the entire organization. Wow ... how not to convince me that passwords are a problem.

hyeonwho4 2y ago
I wonder how the internal metrics even define "password attacks". I have a 15 year old Skype account (with a long password) which I lost access to because Microsoft suddenly started requesting verification, insisting on 2FA via SMS to a 10-year-old phone number. Are all ten of my attempted logins counted in that statistic?
- kazinator 2y ago
  I imagine it has to be a certain number of attempts, because it's counting the password attacks that are stopped. You don't identify and stop a password attack after just two or three attempts. Let's say that the threshold is 20 attempts. So that's 7,000 * 20 = 140,000 password attempts per second. That's not very fast. It will not uncover strong passwords in any reasonable timeframe.
jsnell 2y ago
False negatives are a thing. If they've got a 99.9% success rate at blocking password attacks, it means there's 7 qps of successes. That's 500k hijacked accounts per day, 200M per year. That is a very large number. And not a lot of systems have 99.9% recall, without trading away absurd amounts of precision...
- kazinator 2y ago
  If they suspend an account after, say, 20 password attempts, they're success rate at stopping password guessing will be vanishingly close to 100%. Especially if they've instigated strong passwords. If passwords cannot contain dictionary words and must be mixed case with at least one special character in digit, there's no freaking way anybody's going to guess their way in, with a small number of tries before the account is frozen. The number of penetrations from that is going to be so tiny, it's not worth worrying about. The bigger worry are stolen password hashes being cracked surreptitiously, where the attacker has an unlimited number of tries whose rate is only limited by their hardware.

deleted 2y ago

[deleted]

avhception 2y ago

I'm really skeptical about passkeys. This blog post talks about it in detail: https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/ https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt... Also discussed on HN at the time: https://news.ycombinator.com/item?id=40165998 https://news.ycombinator.com/item?id=40165998 I think I'm fine with my uf2 / webauthn devices as second factor, thanks. (Edit: to be clear, I'm not the author of said blog post)

growse 2y ago
Passkeys are webauthn credentials.

fbnlsr 2y ago

The problem with passkey is that it's obscure for the common folk. I'm a developer, yet for some odd reason I'm having a hard time understanding passkeys. Are they synced between devices? Do I need to set up a passkey per device? What happens if I have a single passkey on my phone and it gets lost? Do I lose access to that service? So many questions that need a clear and concise answer.

vbezhenar 2y ago
Most implementations sync passkeys to the respective clouds.
- hulitu 2y ago
  > Most implementations sync passkeys to the respective clouds. So, in the end, the old Microsoft mantra: "Your security is very important for us". Besides Microsoft, NSA, CIA, the five eyes and friends, no one has access to your passkey, this means is secure.
  - acdha 2y ago
    No. If you read the documentation, they only synchronize encrypted data.
- ghusto 2y ago
  Do the keys need passwords to work, or is the key itself sufficient? i.e. Is it like an SSH key without or with a password?
  - TheNewsIsHere 2y ago
    The key itself, but the standard explicitly supports platforms, browsers, or password managers handling authentication to permit key use. For example you can have a passkey where the private key is on a security token protected with a PIN or biometry. You can have a private key live in a secure element on an endpoint too. You could make a browser plugin that requires no auth whatsoever if you wished.

drawfloat 2y ago

Until they are successfully explaining how to use these in a way that 70 year olds on eBay can understand, this should not be forced on users.

josteink 2y ago
«Activate login via FaceID». «OK». Congratulations. You have a passkey. Was that easy enough?
- jedberg 2y ago
  What happens when they lose or break the phone, or switch phones, which my parents do every two or so years?
  - jf 2y ago
    If they have a Google or Apple account on their Android or iOS device, then nothing happens.
    - jedberg 2y ago
      I mean in the interim. How do they get into their email to find their support contract to get another phone if they can't get into email without their phone?
      - jf 2y ago
        For Apple at least, you walk into an Apple Store, buy a new phone, and have them help you log into it again.
        jedberg 2y ago
        What if you're traveling and there is no Apple Store nearby? And now you can't log into your email to get your travel itinerary or your transportation receipt? The greater point is not the specific edge cases, it's that they haven't been worked through. Even a sophisticated user like myself doesn't want to use passkeys exclusively yet because of this very reason. I'm not confident that I won't get completely locked out when it's absolutely critical that I get in.

figassis 2y ago

I really just want passkeys to exist for a decade and all lockout/lock-in edge cases being resolved before I retire my password manager, and before I tell my mother to move to passkeys.

josteink 2y ago
Why not use both? There are several password managers which supports passkeys. That’s where I have mine.
- jedberg 2y ago
  That's fine for me, but my parents not so much.
fuzzfactor 2y ago
Looks like they're beginning to work on it as we speak, how is this not supposed to be proven as stupid as possible by now :\ >At the moment, export/import is not part of the "Passkey" standard. The FIDO Alliance has a draft of the Credential Exchange Protocol that would allow such actions. If it's already a standard, and it's that deeply faulty because it's been brain-dead since the beginning, then for a user having valuable data, they may be best advised to run the other way forever. Simple. When you have an alliance of previous competitors and they are either incompetent or user-hostile enough from the beginning to leave out the most important factor in recovering from disaster -- personal backup & recovery -- I would want to wait a good ten years until after everyone as untrustworthy as that has been banished from any security work that could be the least bit consequential. You can't have adequate security with untrustworthy people building the foundation no matter what they say otherwise. People are the real problem, but clueless "security" people with initiatives this half-baked are more of a threat to average users' valuable data than millions of other clueless users are.

gwbas1c 2y ago

> Passkeys not only offer an improved user experience by letting you sign in faster with your ... PIN, but they also aren’t susceptible to the same kinds of attacks as passwords. I don't know about you, but a PIN is pretty much a password in my book. Once I figured out that I can use a password with Windows, I stopped using my PIN. (I didn't use Windows for about a decade.) It's much easier to remember. Even worse, on Windows, I'll only use passkeys on sites where I can use a Yubikey. If the passkey requires a PIN, I don't bother. I just can't be bothered to remember it. Otherwise, on Mac, my passkey supports my fingerprint sensor. Much easier.

stetrain 2y ago
The Windows PIN is just a local password that isn't tied to a cloud account or ever sent across the network. Mine is a full text password, it doesn't have to be numeric. I haven't tried it but it should also work with "Windows Hello" supported face or fingerprint recognition.
- gwbas1c 2y ago
  That is not mentioned anywhere, neither in the article, or when setting up a PIN. The common definition of a PIN is for things like using an ATM, where the PIN is for the account, not the card itself.
  - lxgr 2y ago
    The PIN is also for the card itself. The smartcard chip inside the card can validate it for offline transactions (although that's not as common in the US). I think a reasonable modern definition for a PIN is "a password that can safely be short"; more here: https://news.ycombinator.com/item?id=42446015 https://news.ycombinator.com/item?id=42446015
    - gwbas1c 2y ago
      PIN stands for "Personal Identification Number." It can't have letters / symbols in it. If they're calling a password a PIN, that's the wrong word and will confuse the ^%$^#% out of people who expect PIN to mean numbers only.

Havoc 2y ago

Is there a good ELI5 for passkeys somewhere? A quick google got me to a site that says: >Passkeys use Bluetooth technology, which requires physical proximity, to help verify the user. Which I somehow doubt is accurate.

somat 2y ago
You probably know most of this, so sorry for the over simplification. but you asked. A passkey is an implementation of public key authentication. The private part should stay with you, this is your identity. The public part gets shared with others, they can use this to verify your identity. "microsoft passkey" wraps all this up into a simple tool that just looks like you are putting in a pin number. The vague thousand foot mechanism is. someone who wants to verify your identity will ask you to sign a unique number. because only you have the private part needed to to do this, only you can sign it correctly. they can then use the public part to verify the signature is correct. and know it is really you they are talking to. The private part is usually protected by a device, something to prevent others from using it. this is often just a password, in this case a PIN. but some times is a dedicated usb dongle. this only has to have local security guarantees not global network security guarantees. so a simple password like a PIN is not considered a problem. The primary advantage over a simple password based system is that the thing that is shared(the public part) is unable to be used as your identity so it can't be stolen like a password. or perhaps more accurately, it does not matter if the public part is stolen(it is already public knowledge) And now the irony, I have no proof, however I have a suspicion that because loosing the private part is the same as loosing your identity, that is, a big deal and a huge hassle to recover the account. I suspect microsoft is storing them internally. which means your account security degrades to a password based system where the password is basically pubic knowledge, that is, your so called security questions. what is your favorite color? is not a good password.
- vaylian 2y ago
  Just to add to your explanations: 1. Passkeys contain the username and the domain of the service that you have registered with 2. Because passkeys contain the domain, it provides very strong phishing protections, because a look-alike website still has a different domain. Passkeys are resident keys. They take up storage space, which is a problem for dedicated hardware tokens which usually have limited storage space. A much nicer solution are non-residential keys that get recomputed on the fly based on the domain name that you want to authenticate against.

hooverd 2y ago

The FIDO Alliance can eat it until they support exporting passkeys and stop passive-aggressively threatening, "why don't we talk about this privately" anyone who tries to implement that.

TheNewsIsHere 2y ago
There’s a recently released draft for an export/exchange protocol. Multiple vendors have already signaled work on implementation.
- hooverd 2y ago
  Oh, that's good news!
- kbelder 2y ago
  Does it allow me to export my credentials to my own machine for me to do with as I will, or is it only allowed for particular authorized vendors?

iandanforth 2y ago

Passkeys are a terrible idea. They are security theater and a disaster for users waiting to happen. Imagine you're on vacation and have lost your phone. You want to go to a cafe and log into a chat app, an email service, whatever to contact your family. In the world that passkey advocates want this is impossible via the passkey flow. If you can't authenticate via a primary device that contains your private key, you're f-ed. Service providers know this so of course they will provide recovery mechanisms. (Not consistent recovery mechanisms of course, each will have their own convoluted and likely to be broken ones). If the recovery mechanism allows for knowledge based recovery (challenge questions) then you're basically telling people that they need N passwords rather than one password. Maybe that challenge question is just a long password (recovery key). Maybe it requires access to another system, which you likely don't have in this circumstance. So you're either back to having passwords, or you're f-ed. Security theater or a disaster. A service only has value if I can access it. I should be able to sit down at any computer in the world with the knowledge in my head and get access to any online service to which I subscribe.

deleted 2y ago
[deleted]
d4mi3n 2y ago
You’re not wrong, but I think you’re presenting this as a dichotomy when there’s a lot of value to be had between the two extremes (passkeys all the way or passwords all the way). The big benefit to a passkey for a service provider is that when you see a user using one, you can assert things about that session—that this is the users device, that the session isn’t likely to be spoofed, etc. These are useful things to know if you want to implement any kind of context-aware access! Passkeys certainly aren’t a silver bullet, and I don’t think they’re really marketed or implemented well a lot of the time, but I’d caution against writing off the tech as a whole .
GoblinSlayer 2y ago
How do you log in anywhere without a computer? You have a wifi receiver implanted in your head?

jmclnx 2y ago

Unless this is 100% free, easy and no PI, I will tell people to move to Linux

RevEng 2y ago
That won't solve anything when make online services that we all rely on start moving to this.

boohoo123 2y ago

"Passwords are no longer safe, the future is passkeys. Thus you can log in with face, touch or a PIN" PIN - a personal identification number (aka a password) This is one of those times where there is usually an ulterior motive behind this decision. Most cases in the form of power and/or control.

acdha 2y ago
If you’re going to speculate about ulterior motives, fill in the supporting details so people can tell you’re not just promulgating conspiracy theories.
- 015a 2y ago
  Its a lot harder to share the passkey for e.g. your Netflix account among friends.
  - acdha 2y ago
    So you think that Netflix has gone to Microsoft to start a multi-year industry-wide standardization process to change how people login because that’s easier than looking at their own log files? Netflix didn’t crack down on shared passwords when they were growing rapidly but that’s not because they couldn’t.
    - 015a 2y ago
      I don't, but yes; many seriously actually believe this is why the industry is moving to passkeys. It isn't logical, it isn't reasonable, but these are your customers.
      - acdha 2y ago
        So that sounds like an argument for better education, not recirculating baseless conspiracy theories.
        2y ago

galleywest200 2y ago

My company uses Azure SSO so I am curious if this is just coincidence... but just this morning I had two (2!) separate desktop support technicians reach out to me today asking if I got my passkey set up for the company portals.

015a 2y ago

The software industry has zero concept of how much pain and suffering passkeys are going to cause the average person, almost entirely because the average American has an iPhone and a Windows laptop and there's literally nothing built-in to iOS or Windows that will sync passkeys between these two devices. The world's most popular password managers are Excel and Apple Notes, in that order; these apps do not support Passkeys. Passkeys are not going to happen, and its the industry's fault. Its a bad standard that solves some problems the industry itself has, by creating more problems for consumers. If you force consumers to move to only-passkeys, you're going to lose customers, and it might not even be their choice, you're just making the decision to lock people out.

josteink 2y ago
> The software industry has zero concept of how much pain and suffering passkeys are going to cause the average person, almost entirely because the average American has an iPhone and a Windows laptop and there's literally nothing built-in to iOS or Windows that will sync passkeys between these two devices Then you register multiple passkeys for the website, just like you would register several Yubikeys. It’s a 1-click process, and no HW-token required. Most people will be fine.
- spencerflem 2y ago
  How do you log in on the other device to set up the second passkey?
  - growse 2y ago
    Using the "passkey on other device" flow, which usually involves QR codes.
    - hbn 2y ago
      What if my phone irreparably broke?
      - 2y ago

thedanbob 2y ago

If Microsoft really wants to push passkeys, why do they require Microsoft Authenticator for passwordless accounts? I already have a passkey set up and I'd be perfectly happy to delete my password, but I can't because I don't want yet another authenticator app exclusively for an account I barely use.

snailmailman 2y ago
I was tempted to set this up, as I’ve been using passkeys everywhere that I can. But yeah, I’m not going to use Microsoft Authenticator for this one single account. I even already have a passkey for my Microsoft account.

tialaramex 2y ago

From the HN pushback I think this will end up like IPv6. I get to have nice things and some others likewise - many people get to repeatedly say "Nice things are impossible" and roll their eyes. I guess they're having fun in their own way? It's nice when we build a non-brainer technology which gets adopted at scale by default, as happened for TLS 1.3, or even when other motives overwhelm the instinctive conservatism (e.g. Let's Encrypt) but that can't always happen and it looks like for WebAuthn the conservatives are going to stick by passwords "From my cold dead hands" etc. One problem with HN in particular is that there are a lot more decision makers here, so more people whose conservatism means they're going to build, promote and demand worse solutions since the better option is in their minds impossible. That's unfortunate, it means there's a good chance that over the next years I'm going to be using more important services which have terrible authentication on account of somebody senior said "Passwords are good, we should require passwords" and anybody disagreeing was hushed or worse fired. So that's not great, but it is what it is. Anyway, for the few people who get why this is a good thing but understandably don't trust Microsoft (or Apple, Google, Facebook, I dunno, Epic Games?) I have a suggestion: All of this technology also works fine with a Security Key, which is a thing you can buy from Yubico (or several other outfits, but Yubico is easiest if you have no idea what you're doing) for like $25. And if you - like me - use Security Keys those "But what if I lose it?" questions can be answered by Technology Connections' favourite: The magic of buying two of them.

lxgr 2y ago
Security keys (i.e. "roaming authenticators" in WebAuthN language) have significant practical usability and availability downsides. > "But what if I lose it?" questions can be answered by Technology Connections' favourite: The magic of buying two of them. And the magic of having to access both of them every time you create a new account anywhere, which probably means you'll keep them both close by – increasing the availability risk. A more realistic recommendation would be to use an open source FIDO backend such as Bitwarden or Strongbox that let you cross-platform sync and, worst case, export your credentials if the vendor goes down a bad path.
- tialaramex 2y ago

water-data-dude 2y ago

Wait. “In the two years since passkeys were announced and made available for consumer use, the FIDO Alliance reported a few weeks ago, “passkey awareness has risen by 50%, from 39% familiar in 2022 to 57% in 2024.” I don’t think that math works? Am I misinterpreting something?

silentguy 2y ago
(57-39)/39 ~= 46 I think they meant 50% increase from the 39% .
- water-data-dude 2y ago
  Ah! It was early, my brain wasn’t working. I appreciate the restraint the HN community exercised in not mocking me, hahaha
Eisenstein 2y ago
50% of 39% is 18. Add to 39 to get 57%.
- deleted 2y ago
  [deleted]
jedberg 2y ago
That's why we use points when talking about changes in percentages. :) Imagine it was 100 people. 39 were aware. 50% of that is 20. So now 57 are aware, which is 18 more than before, which is pretty close to 20. So yeah, it was a change in 50%, but it was only 18 points higher.

gavinhoward 2y ago

One thing passkey proponents forget is password-authenticated key exchanges (PAKEs). PAKEs use passwords, and they are unphishable. That is the direction we should go to avoid vendor lock-in.

jf 2y ago
Does PAKE protect against scenarios like "password written on sticky note", "fake login page hosted at login.nnicrosoft.com", or "scammer impersonating IT staff"?
- gavinhoward 2y ago
  From the first, no. It does handle the second and third, IIRC.
  - lima 2y ago
    It doesn't handle these either - what stops the user from entering their password on an attacker-controlled phishing page? Passkeys work because the user can't be tricked into entering their private key on a phishing website.
    - gavinhoward 2y ago
      Browsers could help with this. They just don't.
growse 2y ago
Where's the vendor lock-in?
- gavinhoward 2y ago
  Cloud sync.
  - growse 2y ago

tomjen3 2y ago

Passkeys are an excellent way to lock yourself into your current device and out of your accounts if you ever move away.

addicted 2y ago

I haven’t dug into this but I must be missing something with passkeys. It’s the same issue I had with getting a Yubikey. The odds that I lose a piece of hardware that I’m carrying on me seems orders of magnitude greater than the odds of having my password cracked. How does one recover from a lost device (other then backing up to Apple’s private cloud in which case you’re beholden to them forever to be able to access your own accounts).

Biganon 2y ago
I have two Yubikeys, one of them never left my home
- mgulick 2y ago
  So do I, but this is annoying because I need to have physical access to both of the keys when setting up 2FA on an account, or hope that I remember to add the backup yubikey when I get back home.
- vorpalhex 2y ago
  The great thing about bitcoin crap is that it's real world public/private keys used by the general public. And oh man tons of almost millionaires have lost their backups. Tons of people still have stolen credentials. Basically nobody can "do it correctly".
- EvanAnderson 2y ago
  The "have a backup token" workflow seems like tedious make-work. I have to remove it from its "safe place" and keep it proximate to my primary token while I enroll it in everything my primary token is enrolled in. The workflow to enroll a new backup token (when the primary is lost and the backup becomes the primary) also seems like tedious and error-prone make-work. It would great if I could load my backup token's public key into my primary token and export a copy of the primary token's secrets, encrypted with the backup token's public key. When I lose my primary token I would only need to restore my backup token and be back in business. That eliminates the make-work of enrolling on the backup token. Of course, this scheme allows for "cloning" of a token so it'll never be allowed by the "security" nannies who know better than us.

swozey 2y ago

I'd appreciate it if they let me block specific countries, etc from even attempting to log in. You can see the failure attempts somewhere in your user settings and I have them all day long from countries I'll never step foot in and quite a few adversarial.

agentultra 2y ago

Aren't passkeys centrally hosted? So if MS gets breached or decides I don't matter they can just lock me out of my life if I host my passkeys with them?

consumerx 2y ago

[dead]

physicsguy 2y ago

I use Bitwarden. I don’t mind passkeys ending up there. But i want them all in there. I find the UI/UX is really poor with browser extensions, etc. and preferentially trying to use the OS’s password manager to store passkeys.

mgulick 2y ago

I think technical people understand the mechanics of using Passkeys, having them backed up to multiple devices etc, but there's no way my 70 year old father is going to be able to understand that. He barely knows the difference between the computer login and his gmail login. My parents are also not wealthy-enough to have Apple take care of all of this for them. He has a hand-me-down Linux laptop because all he needs is Google Chrome. Thankfully I've been able to teach my parents to write down their passwords in a password book. I can't tell you how many times I've ask my father "what's your google password" and he says "I don't have a google password". I like the idea of eliminating passwords, but inevitably his phone is going to break or his computer is going to crash and he needs a way to recover.

it_citizen 2y ago
The password book of every person around me become awful over time. They don’t distinguish between uppercase and lowercase, they write bad notes, most of the content is outdated, sometimes there duplicates and overall cause me more headache than anything. I hate password books. I don’t have a better solution though. For now, I teach them to use chrome password manager for now and log in their chrome account when they need help. It sucks too. But at least I don’t get angry with their notes.
- akvadrako 2y ago
  A box of index cards with alphabetical tabs is a step up. That way you can update entries without making the book a mess. But it's a small step.

koolba 2y ago

> 99% of users who start the passkey registration flow complete What about the flow where 99% of users don’t know how to back up and restore passkeys and get permanently locked out of their accounts?

choeger 2y ago

And passkeys only work with Microsoft OS, Microsoft Browser or some other thing that Microsoft controls? Not hat I would ever imply that Microsoft has anything than our best interests in mind...

int_19h 2y ago
It is an open standard that is supported by all major OSes and browsers. In fact, I would wager that the majority of current passkey users are on iOS (since Apple has been pushing this for a while now, and it's nicely integrated).

Nifty3929 2y ago

https://www.microsoft.com/en-us/security/blog/2024/12/12/convincing-a-billion-users-to-love-passkeys-ux-design-insights-from-microsoft-to-boost-adoption-and-security/ https://www.microsoft.com/en-us/security/blog/2024/12/12/con...

doublerabbit 2y ago
> There’s no doubt about it: The password era is ending. No it's not. How am I suppose to login to a console of a air-gapped server with passkeys? > Signing in with a passkey is three times faster than using a traditional password and eight times faster than a password and traditional multifactor authentication. When you sign in to anything Microsoft, you have to go through four different redirects, sure automatically but not not exactly single page sign-in. > We don’t let users permanently opt out of passkey invitations, but we keep the messaging friendly. by friendly you mean Dark-UI to push the user in the corner forcing them to accept as you limit their options one by one with threatening notification and nagging. > We’re proud to be part of this collective effort and hope you will share learnings as well as you progress in your passkey journey. Learnings is a grammatical error. Microsoft is proud to be a collective for part of vendor locked in. The rest of all spunk.
- samcat116 2y ago
  > How am I suppose to login to a console of a air-gapped server with passkeys? Passkeys don't require the internet to work
  - doublerabbit 2y ago
    I have a crash trolley at my DC where I colocate. It has only a keyboard, mouse and monitor. USB has been disabled for security as I don't own my quater-rack (yet) in which I share with other DC customers. The system is in a critical state where by a reboot would be disastrous. How am I supposed to login with passkeys?
    - samcat116 2y ago

_1tem 2y ago

How do I backup my passkeys? I can print out a hard copy of passwords and even 2FA code generator strings, but I haven’t seen an easy way to export and import passkeys. This is a problem. If it were as simple as printing out a list of QR codes or URL strings I would be happy, but so far no password app I know of supports this.

justinholt 2y ago
At the moment, export/import is not part of the "Passkey" standard. The FIDO Alliance has a draft of the Credential Exchange Protocol that would allow such actions. Allowing the trivial export of a passkey would end up defeating the cryptographic protections they offer. https://www.bleepingcomputer.com/news/security/new-fido-proposal-lets-you-securely-move-passkeys-across-platforms/ https://www.bleepingcomputer.com/news/security/new-fido-prop...
- maple3142 2y ago
  I don't understand how can it really prevents exporting passkeys if it can be implemented by open source implementations like keepass. For example, if keepass do follow the guideline of FIDO Alliance to not implement exporting, but it would still possible to make a fork of keepass that force it to dump the credentials somewhere.

dcchambers 2y ago

If you are comfortable using a cross-platform app like 1password, then passkeys can be a pretty great user experience even across ecosystems. But Passkeys have a huge problem: They assume you will never have your device(s) stolen or broken or otherwise made inaccessible. What happens if you're out of the country on holiday and your phone/laptop gets stolen and you need to log into your account(s) from a brand new device? You're mostly shit out of luck if you use passkeys. Especially because most peoples' backups/account recovery is a google email or icloud account which...requires you to have a known device handy to access them or set them up on a new machine.

apitman 2y ago

A lot of the arguments I'm seeing against passkeys are essentially that they are worse for power users who already have a password manager. But they're not mutually exclusive. I've been using bitwarden to store some passkeys. The UX is excellent. Everything is seamlessly synced across Linux, Android, and Windows. I do worry a bit that using a passkey tends to disable MFA requirements, so basically anyone with access to my bitwarden vault can log into those services.

wkat4242 2y ago

Passkeys are good but giving my access keys to big tech (Google, Apple, Microsoft) is not acceptable to me. There's other passkeys implementations and you can even use regular yubikeys as a passkey. But the problem is, many idiot sites block these implementations. PayPal for example only allows it in Chrome or Safari.

trinsic2 2y ago

Great and the solution is passkeys.. were fucked.

eviks 2y ago

> Passkeys not only offer an improved user experience by letting you sign in faster with your face, fingerprint, or PIN, Just like with a password manager > Plus, passkeys eliminate forgotten passwords and one-time codes.” Again, can't forget what's stored in a password manager

kotaKat 2y ago

"Convincing a billion users to love passkeys" Microsoft's "convincing" is just going to be more months of casual user assault, abuse, and gaslighting with no way to just say "no".

xyst 2y ago

I honestly don’t care about the “passkey” revolution. I use a password manager that generates a unique password for every service for a reason. Then secure it with 2FA (either with TOTP or emailed magic link), if available. I think I have used a digital passkey a few times to try it. Works okay, I guess.

Wowfunhappy 2y ago

> Signing in with a passkey is three times faster than using a traditional password Unless I'm using a password manager. > Users are three times more successful signing in with passkeys than with passwords (98% versus 32%). With my password manager, I almost never fail to sign in. Admittedly, the autofill does mess up on some websites and then I have to spend a few seconds fixing it. On the other hand, I am pretty darn skeptical that only 2% of users with passkeys have trouble signing in. Are they not counting the people whose passkey accidentally got deleted, or who are on the wrong device, since those people (by the nature of passkeys) could not even attempt to sign in?

loeg 2y ago

When will Hacker News adopt passkeys?

richjdsmith 2y ago

My mother has been using it because "now [she] only needs to enter her 4 digit computer pin instead of her long Bitwarden password" Unfortunately she is unwilling to change her Windows pin to anything other than the PIN she uses everywhere else. This has not improved her security at all. Before she switched it from what I assume was a Microsoft prompt, she had (through a bit of coaching from me) been fine with Bitwarden + TOTP

atonse 2y ago

I’m all for alternatives to passwords but what is the pathway for “I lost passkey” Is it sending a reset to a recovery email?

zsjkadj 2y ago
multiple passkeys
vbezhenar 2y ago
It is outside of passkey scope. Most services will use email to recover access.
- nottorp 2y ago
  > It is outside of passkey scope. Yeah right, pass along responsability to someone else. And you wonder why people don't trust this "security" solution.
  - vbezhenar 2y ago
    There's no reason not to trust it. It's strictly better than passwords in almost every regard. Of course if you manage your passwords well, you don't get more security with passkeys, because your account is already safe enough. But for someone, who used to write his universal "Johny1987" password on a sticker at his display, passkey provides security and usability benefits. Passkey is just not supposed to solve all the problems in the world. It's supposed to replace login and password and that's about it. Authentication.
    - nottorp 2y ago
      That would be fine if it didn't introduce device dependency and vendor lock in. How do I get my keys out of Apple's wallet again? Or out of a Yubikey for that matter. They are no longer under my control and I depend on Apple's or Yubikey's benevolence to access my services.

AstroJetson 2y ago

If I install all my private-passkeys onto my phone, then I have a new problem of Lost, Stolen, Broken to deal with. I’m device agnostic, I want to get to my account from my phone, tablet, laptop, desktop, all I’m doing is spreading the exposure out by needing to install passkeys everywhere.

jwrallie 2y ago
Microsoft will probably tell you that the Microsoft Authenticator supports syncing, so you should set it up on a backup device. This has several problems though, one of them being that they assume you have at least two mobile devices (let's say a phone and a tablet) and another that they assume the OS you run on both your devices is the same. They do not support migrating you passwords between Android and iOS for example!
- ashleyn 2y ago
  I do not and never will trust cloud storage of credentials.
  - WorldMaker 2y ago
    Microsoft's interesting approach here with Authenticator is that they don't expect you to trust one cloud with all your credentials, they are hoping that you can trust two clouds with partial information. They've (allegedly) got some variant of Shamir's Sharing where some of the data is encrypted in OneDrive and some of it is encrypted in iCloud or Google Drive depending on which phone you use. That's (supposed to be) why there is that "phone-type lock-in" on the automatic backups/transfers because the cloud with the most phone-native/device-specific encryption is phone-vendor dependent today.
  - UltraSane 2y ago
    Do you trust VPNs? Because they are the same idea with a slight twist. VPNs encrypt data before it leaves your computer and decrypts it when it arrives at the destination. 1Password and the like encrypt data before it leaves your computer, stores it for however long you want, and then decrypts it when it the data is copied to your computer.

2Gkashmiri 2y ago

I dont get it. How is changing What you know then what you have then what you are To passkeys any better ? Sure you cant hack them but what happens with losing your phone ?

arielcostas 2y ago
They are supposed to be synced, for example by Google's Password Manager, iCloud, or whatever tool you use (bitwarden, 1Password...)
- perryizgr8 2y ago
  Can they be synced to my paper notebook in my desk drawer?
  - lioeters 2y ago
    Can they be synced to my own server, or my local machine like laptop or PC?
    - vbezhenar 2y ago
      You can self host bitwarden.
  - vbezhenar 2y ago
    Technically you can, but most software will make it impossible or hard. It is not supposed to leave the secure storage.
    - hulitu 2y ago
      > It is not supposed to leave the secure storage. How do they authenticate if they are not leaving the secure storage ? Through telepatic transmission ?
      - jsnell 2y ago

hedora 2y ago

I can’t say I’ll care all that much when they delete my MS account password, but LinkedIn and GitHub are going to be more painful.

dp-hackernews 2y ago

adversary-in-the-middle == MITM

ghusto 2y ago
I was reading that and thought "Wait, don't we already have a term for this?".
- skydhash 2y ago
  If they use MITM, that will include themselves. A password manager doesn't try to log in for you. But most passkeys managers are MITM. At least we can audit OpenSSL code, and we don't have to care about our public keys.