5 ms·

> Passkeys is the way to go. Password manager support for passkeys is getting really good. I set up a passkey for github at some point, and apparently saved it

> Passkeys is the way to go. Password manager support for passkeys is getting really good. I set up a passkey for github at some point, and apparently saved it in Chrome. When I try to "use passkey for auth" with github, I get a popup from Chrome asking me to enter my google password manager's pin. I don't know what that pin is. I have no way of resetting that pin - there's nothing about the pin in my google profile, password manager page, security settings, etc.

Hnrobert42 1y ago
That is unfortunate, but that sounds more like a chrome problem than a passkey problem. You would have the same issue if chrome saved your password.
- kmac_ 1y ago
  Passkey is a great example of how five kitchen chefs can't make scrambled eggs. Horrible user experience, terrible marketing, no mental model like "your phone is THE key," no tangible or even symbolic presentation of the key.
  - acdha 1y ago
    That’s a lot of anger without a substantial argument. For Apple users, for example, the user experience is very smooth and the mental model is “I use iCloud to store my passcode just like I use iCloud to store my passwords”. If you use 1Password, you’re changing iCloud for 1Password instead.
    - emushack 1y ago
      "You lost me the moment you mentioned iCloud". At least that's the way the majority of people I know react to this line of thinking. The "cloud" is still mysterious and complicated to a good number of people. Passwords are easy to understand.
      - otterley 1y ago
        Most people use the cloud without even knowing it. If you instead say it’s seamlessly replicated among all your devices, that is a good enough explanation and conveys the benefits to customers.
      - acdha 1y ago
        Most Apple users are used to using their account for everything - that’s how they buy apps, use things like music or photos, etc. and, of course, passwords. Switching to passkeys doesn’t change that much other than being a bit faster.
      - emushack 1y ago
        Yeah that's right! If you simply say that this syncs to all my devices, it papers over, or abstracts if you will, the complexity of: secure enclaves/TPMs, symmetric sync keys wrapping asymmetrically encrypted passkeys, resident keys that support backup, keys that do NOT support backup, how biometrics are used, etc. etc. With a password, I can write it down on a piece of paper and put it in my safe. One of these systems is not like the other.
uyzstvqs 1y ago
Passkeys are the pinnacle of bad UX. It just works, until the user tries to switch devices, accounts or platforms. The slogan of passkeys should be something like "I don't have a password, it usually just works, but now I changed X and it doesn't work anymore". Even worse is hardware-based 2FA built into smartphones (also FIDO), as you lose your phone in a lake and now you can't access anything anymore. The way to go is an encrypted password manager + strong unique random passwords + TOTP 2FA. It's human-readable. Yes, that makes it susceptible to phishing, but it also provides very critical UX that makes it universal and simple.
- johncolanduoni 1y ago
  Apple’s works fine, including when I’m logging on to my windows machine. Opening the camera app is a little annoying, but I don’t have to do it frequently. 1Password works well too and it runs on everything. There’s open source options, but I can’t attest to their UX.
  - smallerfish 1y ago
    That's fine, but Chrome has 67% market share, and the majority of people will pick the default option for passkeys if prompted. For passkeys to replace passwords it's got to be seamless and easily recoverable without compromising security.
    - yunwal 1y ago
      > the majority of people will pick the default option for passkeys if prompted Especially since Google doesn’t allow you to change your personal default which is what convinced me to go and switch all my accounts off of Google SSO
      - johncolanduoni 1y ago
        I’m not sure what you mean; I have multiple passkeys on different platforms for my Google account (and a few similarly important ones).
spixy 1y ago
Google password manager's pin? On my Windows laptop that is Windows Hello PIN, not sure about other OSs. And it can be disabled.
PaulKeeble 1y ago
I really dislike how passkeys have generally been used. Once KeepassXC got proper support of them and in the browser plugin its been a bit more sensible. KeepassXC means I can transfer them between devices and its protected the same way my passwords are so no additional pins and logins I don't want, it solves a lot of the issues I have around them. Now its just a long random password. I wouldn't have minded if we moved to a scheme like SSH logins with public and private keys I own either, that I can store securely but load as I please and again would work well with a local password manager.
- jp191919 1y ago
  KeepassXC's passkey integration has been excellent for me. No vendor lock-in is important to me.
- arccy 1y ago
  passkeys are public / private keys. it's just a new pair for every log in.
dathinab 1y ago
the "the app tries to trick me into using the service of the company behind it so that they can consolidate the market" problem it's not quite new, as a dump example depending where in android contacts you click on a address it might always force open google maps (2/3 cases) or (1/3 cases) propelry goes through the intend system and gives users a choice stuff like that has been constantly getting worse with google products, but it's not like Microsoft or apple are foreign to it

Hnrobert42 1y ago

That is unfortunate, but that sounds more like a chrome problem than a passkey problem. You would have the same issue if chrome saved your password.

kmac_ 1y ago
Passkey is a great example of how five kitchen chefs can't make scrambled eggs. Horrible user experience, terrible marketing, no mental model like "your phone is THE key," no tangible or even symbolic presentation of the key.
- acdha 1y ago
  That’s a lot of anger without a substantial argument. For Apple users, for example, the user experience is very smooth and the mental model is “I use iCloud to store my passcode just like I use iCloud to store my passwords”. If you use 1Password, you’re changing iCloud for 1Password instead.
  - emushack 1y ago
    "You lost me the moment you mentioned iCloud". At least that's the way the majority of people I know react to this line of thinking. The "cloud" is still mysterious and complicated to a good number of people. Passwords are easy to understand.
    - otterley 1y ago
      Most people use the cloud without even knowing it. If you instead say it’s seamlessly replicated among all your devices, that is a good enough explanation and conveys the benefits to customers.
    - acdha 1y ago
      Most Apple users are used to using their account for everything - that’s how they buy apps, use things like music or photos, etc. and, of course, passwords. Switching to passkeys doesn’t change that much other than being a bit faster.
    - emushack 1y ago
      Yeah that's right! If you simply say that this syncs to all my devices, it papers over, or abstracts if you will, the complexity of: secure enclaves/TPMs, symmetric sync keys wrapping asymmetrically encrypted passkeys, resident keys that support backup, keys that do NOT support backup, how biometrics are used, etc. etc. With a password, I can write it down on a piece of paper and put it in my safe. One of these systems is not like the other.

uyzstvqs 1y ago

Passkeys are the pinnacle of bad UX. It just works, until the user tries to switch devices, accounts or platforms. The slogan of passkeys should be something like "I don't have a password, it usually just works, but now I changed X and it doesn't work anymore". Even worse is hardware-based 2FA built into smartphones (also FIDO), as you lose your phone in a lake and now you can't access anything anymore. The way to go is an encrypted password manager + strong unique random passwords + TOTP 2FA. It's human-readable. Yes, that makes it susceptible to phishing, but it also provides very critical UX that makes it universal and simple.

johncolanduoni 1y ago
Apple’s works fine, including when I’m logging on to my windows machine. Opening the camera app is a little annoying, but I don’t have to do it frequently. 1Password works well too and it runs on everything. There’s open source options, but I can’t attest to their UX.
- smallerfish 1y ago
  That's fine, but Chrome has 67% market share, and the majority of people will pick the default option for passkeys if prompted. For passkeys to replace passwords it's got to be seamless and easily recoverable without compromising security.
  - yunwal 1y ago
    > the majority of people will pick the default option for passkeys if prompted Especially since Google doesn’t allow you to change your personal default which is what convinced me to go and switch all my accounts off of Google SSO
    - johncolanduoni 1y ago
      I’m not sure what you mean; I have multiple passkeys on different platforms for my Google account (and a few similarly important ones).

spixy 1y ago

Google password manager's pin? On my Windows laptop that is Windows Hello PIN, not sure about other OSs. And it can be disabled.

PaulKeeble 1y ago

I really dislike how passkeys have generally been used. Once KeepassXC got proper support of them and in the browser plugin its been a bit more sensible. KeepassXC means I can transfer them between devices and its protected the same way my passwords are so no additional pins and logins I don't want, it solves a lot of the issues I have around them. Now its just a long random password. I wouldn't have minded if we moved to a scheme like SSH logins with public and private keys I own either, that I can store securely but load as I please and again would work well with a local password manager.

jp191919 1y ago
KeepassXC's passkey integration has been excellent for me. No vendor lock-in is important to me.
arccy 1y ago
passkeys are public / private keys. it's just a new pair for every log in.

dathinab 1y ago

the "the app tries to trick me into using the service of the company behind it so that they can consolidate the market" problem it's not quite new, as a dump example depending where in android contacts you click on a address it might always force open google maps (2/3 cases) or (1/3 cases) propelry goes through the intend system and gives users a choice stuff like that has been constantly getting worse with google products, but it's not like Microsoft or apple are foreign to it