3 ms·

> I’m going to assume that you know what passkeys are and that you’ve used them with your Google, PayPal, or TikTok account, or some other online account. That

> I’m going to assume that you know what passkeys are and that you’ve used them with your Google, PayPal, or TikTok account, or some other online account. That's the biggest mistake that passkey advocates make: assuming that if you've used passkeys, you know what passkeys are. Or that you can watch a short video explanation describing the benefits of passkeys, and then you "know what a passkey is." Here's what a passkey is: Passkeys are randomly generated passwords that are required to be managed by a password manager. All the major password managers support them, including Apple, Google, Microsoft, Mozilla, and 1Password. Passkeys can be public/private keypairs, or they can just be secret passwords. Webauthn is designed by committee, so there's always more than one way to do it. By requiring the passkey to be managed by a password manager, you get some anti-phishing protection. A passkey includes metadata, including the website domain that created it, and the password managers simply won't provide the passkey to the wrong domain. They provide no way for you to copy and paste the passkey into a website, as you can with a password; there's no social-engineering technique someone can use to get you to copy and paste your passkey to an enemy. A passkey manager is morally required to do an extra factor of authentication (e.g. fingerprint, Face ID, hardware keys, etc.) when you login to a website, but the website has no way of knowing/proving whether that happened; they just get the password. You reset your passkey the same way you reset your password, because passkeys are just passwords that have to be managed with a password manager. Some sites make it easy to reset your password, some make it hard. You know the drill; there's nothing new or different there. If your site/app is comfortable with magic links, or a simple "forgot my password" email, then it would also make sense to let users add a passkey by clicking a link in an email. If your site/app doesn't have a "forgot my password" flow, you don't need one for passkeys, either. (But, surely you have something in place…? Even Yubikeys/SSH/PGP private keys can be lost.) If you're happy with your password manager, there's no real need to switch, but even very "sophisticated" password users have been known to fall prey to social-engineered phishing attacks. Are you sure you're never going to copy-and-paste your password into the wrong hands? I don't trust myself that much. Passkeys make it harder to switch password managers because the password managers are designed not to let you copy-and-paste a passkey, including from Google's Password Manager to Apple's Password Manager. I think all the password managers kinda like that lock in, and there's something good and bad about it. Instead, password managers recommend that sites/apps allow each user to have multiple passkeys. Sites/apps may or may not actually allow that, but that's the only way to be sure a given user can login with both Google's password manager and Apple's password manager: give each password manager its own passkey for each site. I think Ricky is completely right in this case that if you're a site like 404 Media using magic links today, passkeys are just better. As a user, if your passkey doesn't work or gets lost, you can just click "forgot my passkey" and get another magic link, and set up a new passkey.

mtrovo 2y ago
Thanks for the write up, that's a really nice way to explain passkeys, better than most of the guides found online. It’s tough to convey just how big a leap passkeys can be to folks in the tech bubble, because they’re often disconnected from the everyday password headaches most people deal with. For example, I was helping my mom pay a bill online the other day, and it turned into a circus of scribbled passwords in a notebook, adding minor tweaks to a common master password, having to rely on "forgot my password" emails just to also need to confirm via sms codes, too bad if you can’t access your phone. It was wild. Introducing passkeys into her workflow would totally remove these frictions. Of course the way password managers are being treated like a new walled garden is not the best but this cannot be used to discredit what really looks like a valid solution to the problem of having to remember too many credentials.

mtrovo 2y ago

Thanks for the write up, that's a really nice way to explain passkeys, better than most of the guides found online. It’s tough to convey just how big a leap passkeys can be to folks in the tech bubble, because they’re often disconnected from the everyday password headaches most people deal with. For example, I was helping my mom pay a bill online the other day, and it turned into a circus of scribbled passwords in a notebook, adding minor tweaks to a common master password, having to rely on "forgot my password" emails just to also need to confirm via sms codes, too bad if you can’t access your phone. It was wild. Introducing passkeys into her workflow would totally remove these frictions. Of course the way password managers are being treated like a new walled garden is not the best but this cannot be used to discredit what really looks like a valid solution to the problem of having to remember too many credentials.