8 ms·

Yep, Passkeys Still Have Problems

192 points by todsacerdoti 11mo ago

jqpabc123 11mo ago
So in other words, Passkeys are over engineered and simply too complicated for most users. Succumbing to lock-in can smooth some (but not all) rough edges and creates it's own restrictions and risks. TOTP for the win --- it's the simpler practical alternative.
- timhh 11mo ago
  TOTP is really annoying IMO but at least you control it so you can make it one-factor again if it's foisted on you. I made a Chrome extension to do that: https://chromewebstore.google.com/detail/lazyotp/eoihmklnjkngifajbdlfhhajdcdpmplb https://chromewebstore.google.com/detail/lazyotp/eoihmklnjkn...
Mindwipe 11mo ago
Really great article. I also think there's still an enormous ignorance from passkey devs that lots of people want to occasionally log into personal services from locked down corporate machines, and the flow to deal this is at best terrible but more often non-existent, and developers with typically enhanced privileges just aren't able to conceive how difficult this is.
- oasisbob 11mo ago
  As someone who has enhanced privileges, I'm having problems thinking of what all the the issues here are. Corporate installs disable all USB functionality, and remove the ability to sync profiles? Something like that?
  - spencerflem 11mo ago
    If you’re not using bitwarden or equivalent they can’t be moved off a device you own at all, and even with it you’d need to download bitwarden which might be impossible
- nine_k 11mo ago
  > log into personal services from locked down corporate machines This is usually a bad idea, and is sometimes expressly forbidden. But. more generally, there must be a flow for accessing your account when the passkey is not available, and possibly cannot be recovered.
  - AndrewDucker 11mo ago
    I'm limited in what applications I can install at work. I am not limited in what websites I can access on my lunch break (within reason).
    - timmyc123 11mo ago
      This is one of the core use cases for why FIDO Cross-Device Authentication was created. To be able to use a passkey to sign in on a shared device, a device you don't control, or a device where you just need temporary access to something.
      - AndrewDucker 11mo ago
        Just tried that. Logged into Passkeys.io on my phone, and created a passkey. Then tried to log in to it on my Windows desktop, using the "With my phone" option. First time around it failed to connect to my phone. Future times it connected, but told me that the phone had no appropriate passkeys on it. At which point I gave up. Edit: I then tried on GitHub, and it worked perfectly! Okay, that's pretty awesome.
- timmyc123 11mo ago
  This is one of the core use cases for why FIDO Cross-Device Authentication was created. To be able to use a passkey to sign in on a shared device, a device you don't control, or a device where you just need temporary access to something.
  - crazygringo 11mo ago
    On the one hand, that seems really important and I'm happy to know it exists. On the other hand, I thought I had fully researched how passkeys work and literally never came across it. So it kind of just continues to support my concern that passkeys are just too complicated to understand. If I'm at another device I need to log into, I would have just assumed I couldn't. There needs to be a simple mental model for users. I'm not saying passkeys can't underlie that, but I think the UX still just hasn't been fully figured out yet.
    - timmyc123 11mo ago
      I used the technical name for the capability, but you've likely run into it before. If there is no passkey on the local device, a QR code will appear which you can scan with your phone or tablet, and use the passkey for the account from that device. It just kind of happens, typically without the user having to do anything special. I will say though, corporate devices can be a bit of a wildcard as they are usually configured and locked down for a specific purpose. But the cross-device flow is generally not blocked by organizations.
      - crazygringo 11mo ago
        I don't use passkeys, so I haven't run into it. It seems like that screen would be gated behind entering an e-mail address or username that is already registered with a passkey on another device. What I'm saying is, I thought I had the right mental model of how passkeys work, after researching them, and that mental model told me you wouldn't be able to log in on a different device without going through a whole procedure to set up a new passkey, which you wouldn't want to do for something temporary. The mental complexity is just too much for me to trust that if I adopt them, they'll work when I need them. The fact that I got this thing wrong means there's probably other things I'm still getting wrong. I understand passwords and password managers and even 2FA. I feel like I can plan how to use them right so it all works and I don't need to worry about not being able to access my accounts. I just don't have that confidence with passkeys.
- tzs 11mo ago
  Logging in to a personal service from your locked down corporate machine with a passkey works like this: 1. Start to login to the site. 2. When it gets to the point that you would choose to use a passkey if you were logging in at home, there should be some option that lets you say you want to use a passkey on another device. You can use that to tell it you want to use a passkey that is on your phone. 3. It gives you a QR code to scan with the phone, and then you complete the login using the passkey manager on the phone.
secabeen 11mo ago
The "Vendors Can Lock You Out" part is what makes passkeys entirely a non-starter for me. Especially the additional risk when someone passes away and the heirs are trying to get access to the deceased's accounts. Vendors are well known for saying "we had an agreement with Samantha, and with her death, that agreement has terminated, and no one can be given access that was not pre-designated."
- teeray 11mo ago
  > "we had an agreement with Samantha, and with her death, that agreement has terminated, and no one can be given access that was not pre-designated." It would be nice if you could use some legal apparatus to ratchet these agreements into a trust. Corps would hate it though, so it will probably be illegal to do.
  - dpark 11mo ago
    It’s “illegal” in the sense that you could write whatever you want in your will but it wouldn’t be binding. You cannot force a party into a legal obligation they do not agree to. The government can, though. I’m not sure if there’s any existing laws pertaining to transfer of or access to general accounts after death (as opposed to bank accounts which I’m pretty sure there are laws about). My will says that my executor can access my accounts which alleviates Apple from legal risk if they do grant access but I’m pretty sure they are not obligated to do so.
    - Terr_ 11mo ago
      This reminds me of some past political debates around same-sex marriage, where I encountered some folks claiming government-involvement wasn't really necessary because Free Contract could take care of everything. (This was some years back before the US Libertarian party imploded.) It was rather frustrating to watch: "You're a huge fan of X but don't know how X works?" For example, two people can't make a contract between them that gives one the right to visit the other in a hospital, nor the right to make medical-care/power-of-attorney decisions. You also can't contract-away the guardianship (or ownership) of children, etc.
1970-01-01 11mo ago
Totally agree with this. Passkeys are a solution but not the sole solution. There is absolutely a misconception for seeing them as newest and therefore the best choice.
alyandon 11mo ago
I'm a bit of a curmudgeon about this. Until service providers are no longer allowed to: 1) force the type of passkey stores used (e.g. hardware vs software) when I am providing the passkey store 2) force me to MFA (e.g. forcing touch ID, entering pin or unlock password, etc) when attempting to use a passkey I'll continue to stick to plain old boring password + TOTP. I fully understand the security trade-offs like phishing resistance but password + TOTP is secure enough for me.
- Groxx 11mo ago
  Many/all? also need to have some form of manual input as a backup, so you're not forced to sync all your passwords to e.g. a library's computer just to log in, if your house burns down or something. Which probably looks a lot like a password.
- jesseendahl 11mo ago
  (1) is already true today. There is no way for services to enforce whether a passkey is stored in software or hardware. (2) I understand you don't like the user experience. But to make a technical clarification: requiring a user action to prove there's a human involved in the login action (e.g. by clicking a button in UI or requiring Touch ID) does not necessarily mean there's another factor involved at all (MFA). What you are describing is more of a "liveness check" than a separate factor/separate credential.
  - deleted 11mo ago
    [deleted]
  - spencerflem 11mo ago
    Liveness check is fine, but I’ve always seen it as requiring Microsoft Hello or equivalent explicitly, and not whatever check I would prefer to use
  - alyandon 11mo ago
    (1) is already true today. There is no way for services to enforce whether a passkey is stored in software or hardware. Challenge: Go and try to register a non-blessed passkey type with PayPal and come back and share your experience. (2) I understand you don't like the user experience Pretty much my complaint. Passkeys allow for service providers to do dumb things that result in terrible UX. With Password + TOTP, I don't get asked to touch a sensor, enter a PIN, enter an unlock password, etc.
everfrustrated 11mo ago
The biggest problem I have with passkeys is being tied to a single device you still need a flow to reset/get in _without_ the passkey. As you're only as secure as your weakest link passkeys don't add any security. That said, if you have a mac with a fingerprint scanner they sure are very convenient option. And don't get me started on terrible vendors like Rippling that only support a single passkey! Madness.
- mmsimanga 11mo ago
  I dropped my phone and it literally fell apart. As a result I have been locked out of my AWS account. The get a phone call verification just does not work. Only saving grace is that it was an account I used to test things.
- jmsgwd 11mo ago
  I keep hearing it repeated, but where does this "tied to a single device" idea come from? The default, built-for-the-masses implementation of passkeys is called "synced passkeys". They are designed to sync between all your enrolled devices, ideally using end-to-end encryption. You authenticate with whatever device you happen to be using at the time - phone, tablet, laptop, desktop - doesn't matter. If you lose one, you replace that device and re-enroll - then all your passkeys magically re-appear on the new device. If you're cross-platform, modern password managers work across ecosystems - for example, 1Password syncs passkeys between Mac, Windows, iOS, Android, and Linux. If you're all-in on Apple, their native passkey implementation syncs passkeys between all your Apple devices. I thought Google and Microsoft do something similar now. It's a real mystery why people believe passkeys have to be stored on your phone only.
  - spencerflem 11mo ago
    Because by default, they do, and you have to explicitly install software to let it be moved. And even if you do, it’s discouraged and the spec is allowed to deny you access.
    - timmyc123 11mo ago
jason_s 11mo ago
Please don't use fixed-width fonts to write text. Please use fixed-width fonts to write code.
- dantillberg 11mo ago
  I think part of the distress experienced by readers is due to mixing the fixed-width font with "text-align: justify". So it's close but not exactly fixed/consistent.
  - miloignis 11mo ago
    Ah, thank you for pointing that out! I was wondering what it was.
- dpifke 11mo ago
  Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting. (quoting https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html)
- nine_k 11mo ago
  Firefox Reader Mode makes such sites more readable.
kemotep 11mo ago
2 things about passkeys I wish would be fixed. 1. Passkey prompts asking if I want to use a phone or security key when I only have one (or neither!) registered. The UI for this gets in the way and should only ever present itself if I happen to have both kinds of devices registered. 2. Passkeys should have had the portability and flexibility that ssh keys have from the start. Making it so your grandparents can use public key cryptography and gain a significant advantage in securing their accounts in a user friendly manner should have been the priority. Seems like vendor lock-in was the goal from the start.
- lapcat 11mo ago
  > Seems like vendor lock-in was the goal from the start. Exactly. The passkey vendors state that the goal was to make phishing not just difficult but impossible. This means plaintext access to your credentials is forbidden forever, regardless of your level of expertise, and regardless of the complexity of the process to export/import them. The purpose of the so-called "secure credential exchange" is once again to prevent you from directly accessing your credentials. You can go from one passkey vendor to another, but you're always locked in to one passkey vendor or another. Any credential system that makes it impossible to write something down on a piece of paper, take it to a new computer, and login to a website is just a gateway to vendor lock-in. You can manually manage your own ssh keys but for some reason not your passkeys. As an Apple Mac user, what annoys me the most is that the use of passkeys in Safari requires iCloud Keychain, which of course requires iCloud and an Apple Account. [EDIT: Obviously I'm talking about built-in support. I'm well aware of third-party software, so everyone can stop replying to this now, please!] You can't do local-only passkeys, not even if you take responsibility for backing up your own Mac. The passkey vendors took some good theoretical ideas, such as site-specific credentials and public-key cryptography, and totally mangled the implementation, making it hostile to everyone except themselves.
  - mroche 11mo ago
    This is obviously kicking the can down the road, but I "solve" this problem by storing passkeys in a third-party credential manager that supports them. That way I can use them on any device that I've installed the client app or browser extension on. I have this working on Fedora, macOS, Windows, and iOS. But again, kicking the can down the road.
stalfosknight 11mo ago
Passkeys are a completely seamless experience on Apple platforms in my experience so far.
- freehorse 11mo ago
  Not that seamless if you do not want to be locked into a single platform, though. This is what the article mostly talks about.
  - growse 11mo ago
    Why are you locked into a single platform? I use bitwarden, Google and a yubikey for passkeys. Which of these am I locked into?
  - happyopossum 11mo ago
    Apple has offered an “iCloud for windows” app for ages that literally syncs your iCloud Keychain (passwords and passkeys) to a windows box where you can use browser extensions for chrome, edge, etc. You’re still not platform locked…
dfabulich 11mo ago
The author still has one last misconception about passkeys, namely that if you lose a passkey, you have "no recourse." People wrongly think passkeys are like Bitcoin wallets, where losing them means there's absolutely nothing you can do, your account is simply lost forever. Losing a passkey is exactly like losing your password, which is to say, that for 99% of services, you can reset your password/passkey really easily. There's a prominent "Reset Password" button right on the login form. It sends you an email or an SMS, you click it, and it lets you reset right then and there. You can reset your passkey in exactly the same way. It is not that easy to reset if you lose your password to your Apple, Google, Facebook, etc. They all have a bunch of factors that they use to authenticate you if you reset your password, and they don't even document which ones they use. So, if you care about those accounts, you've got to make sure you have backup access. They all let you generate and print "backup codes" (emergency passwords) and store them in a fireproof safe or a literal bank vault. Do that! As everybody knows, you can't store all of your passwords in a password manager. You need something outside of the password manager to login to the manager itself. That's why 1Password/LastPass is called that; you still need one last password that you keep and manage yourself. That's true of passkeys, too. You can login to Google with passkey, but if Google is your password manager that stores your passkey, you need something else outside of Google's password manager to login to Google. Whether it's a password, a backup code, a YubiKey, whatever, you need one more thing to login to Google, ideally more than one, so you can back it up and keep it safe.
- novok 11mo ago
  Pre-passkeys, was this lockout issue a true issue with apple and google accounts? Or have passkeys added a general lockout issue that didn't exist before? Also passkeys in their current implementation are not possible to back up or export yourself, unlike passwords in the past. Security engineers are prioritizing preventing key copying over lockout issues, unilaterally, on literally billions of people. It improves their metrics internally, at the cost of an externality on the entire world. This kind of stuff invites odious regulation as more and more stories of lockout with no recourse surface. And unlike passwords, there is no good provider migration story. There is a roach motel issue. Yes it is being 'worked on', but passkeys and such have been out for many years, the willful denial whenever you ask people running these standards about these issues is incredibly irritating. The fact they tend to avoid questions about this like politicians decreases trust in the motives of such standards.
quantummagic 11mo ago
It's not really passkeys that are the problem, it's trusting your passkey to a third-party. But this is still a minor part of the market today, a much bigger problem to warn people about is the "log in with your google/facebook/etc account". Where you're handing everything over to a third-party as well, because it's so easy and convenient. Passkeys, stored in Bitwarden, give a lot of the same convenience, but without the vendor lock-in. We shouldn't be scaring people away from passkeys, when commonly used alternatives are much worse.
- XorNot 11mo ago
  It's the fact that there's no physical artifact that's the problem - there's no file. You can't back up your passkeys and wind up with something you put in a safe on a USB key or something and vendors have been aggressively trying to make that harder.
  - quantummagic 11mo ago
    You can export them from Bitwarden and back them up.
voidfunc 11mo ago
Passkey just suck, end of story. The UX for them is so bad. I have no idea how many active pass keys I have. I just have to trust the provider knows what they're doing. Sometimes my authenticator app seems to forget my pass keys which is even more annoying. Stop the insanity.
arjie 11mo ago
Password + TOTP have served me well so far. To port from device to device I just need to log into my Bitwarden account. It is unclear to me what device loss would do to a passkey and the passkey never communicates that information to me. If I set up a passkey on my iPhone, the site prompts me on my Linux desktop. I understand it's fine for people who use single platforms for everything. But as far as I can tell there is no advantage over Password + TOTP. I really hope Passkeys don't become mandatory. I only use them for sites I don't care about or when I've accidentally said yes to setting one up.
- Groxx 11mo ago
  Device loss: If you had multiple devices set up on the site (each site must have done this individually), you just use a different device. If you had synced your passkeys somewhere (note that the spec allows sites to block this, though I'm not aware of any actually doing so), you sync them to the new thing and log in normally. If you did none of those, it's gone forever. Do the account recovery process, if one exists. So it degrades to equal or worse than passwords in all cases (which cannot block backups or syncing, and you can enter them individually by hand so you're not exposing all your passwords to the device, and you can communicate them over the phone or in writing), for device loss purposes. Restoring access in this scenario is imo one of their worst qualities.
0x457 11mo ago
Everyone pretends that you're force to only have 1 passkey. I use 3 "passkey managers": Passwords.app, Bitwarden, YubiKey hardware key. I usually add all 3 or just two (skipping YubiKey). On Apple devices I get neat experience out of the box, on Linux (+Firefox) I forced to use Bitwarden because Mozilla is being Mozilla. Never had any issues ever with passkeys.
- stouset 11mo ago
  Yep. I use Apple’s direct support which works out of the box. I also create a second passkey in 1Password. And for truly important accounts (1Password itself, Apple, Google), I have a third copy on a YubiKey stored in a safe deposit box.
- XorNot 11mo ago
  3 technological devices which I can't validate by checking if the physical piece of paper is still legible in a safe.
andrewmcwatters 11mo ago
I don't care what you other people in auth do, I work in auth too, please stop making signing into anything 5 steps. 1. First I get redirected to a special sign-in page. 2. Then I sign-in with my email only. 3. Then it finally asks me for a password, even for services that would never reasonably use SSO or have another post-email receive process. 4. Then I get redirected again to enter 2fa. 5. Then these websites ask if I want to create a passkey. No, I never want to create a passkey, and you keep asking me anyway. 6. Then, and only then, do I get to finally go back to using the service I wanted, and by then, you've lost whatever my `?originalUrl=` was, and I have to find it again. No, don't send me a magic link. Because then I have to go do 4 more steps with Gmail or another mailbox provider and now signing in has become 10 or more steps. No, don't tell me getting rid of passwords will help most of the population, and then force all of us to do the above, and blatantly lie to us that it's better. Stop it. Get some help.
- eddyg 11mo ago
  If you created a passkey, it would be one step.
  - andrewmcwatters 11mo ago
    [dead]
- magnetowasright 11mo ago
  I still find myself stuck on step 0: find the fucking log in button that is for some reason tiny/looks disabled/not easily discernible as a button
  - andrewmcwatters 11mo ago
    [dead]
eddyg 11mo ago
Passkeys are fantastic for the vast majority of the population. They solve oodles of problems. No more teaching ${FAMILY_MEMBER} about good passwords, password re-use, trying to explain how to use a password manager, etc. Instead: create passkey, done. Then it's seamless login whether they're on their computer, phone or tablet. As a tech-savvy user fully aware of the underlying machinations involved with passkeys, I greatly prefer their simple, fast login experience over: username submit password submit TOTP submit, and especially over the much-worse "we've emailed you a code" login slog.
- 201984 11mo ago
  It's great until they break their phone, or spill coffee on it, or just lose it, and now they are locked out of EVERYTHING with no good way to get back in. Passwords on a piece of paper for better or worse do not have that problem.
  - eli 11mo ago
    Android syncs them to your Google account and iPhone to your iCloud account by default. Which isn't a perfect solution but, again, is pretty good for most people.
    - 201984 11mo ago
      And I just found out recently that you can't log into Google on a desktop without responding to a prompt on your Android phone. Which, if you broke said phone, you can't do. This is without 2fa enabled on my Google account.
      - Groxx 11mo ago
        There are a few alternate options like email or sms (I've used them several times, you have no option if you erase your only actively-used phone occasionally), but yeah. Google effectively forces 2FA whether you like it or not.
      - eli 11mo ago
fusslo 11mo ago
I feel like a boomer. I dont want to use google/apple/microsoft for any credential manager because: google is evil; apple has locked me out of my apple id (and lost things like the recordings of conversations with my father during his hospice); microsoft keeps getting worse and more annoying to use. So ok, I need some credential manager. I used keepass previously... but how do I vet other credential managers? I dont want an online backup. I want my credentials to only be on my computers. So now I gotta learn about which apps are ok, don't have cloud synching, can export files, and be compatible with MacOS. And I have to learn what is FIDO? Like FICO? why do I need to synch with FIDO? what is it? will it give my credential store to others? How is this easier or more convenient than a user/pass with 2fa? I feel like I am going to accidentally leak my credentials and have no way of knowing
- scblock 11mo ago
  In your case it's literally the same "complexity" as user/pass with 2FA. You need something to manage the passkeys, just like you need something to manage your second factor. Everything else you list as a worry is already in play. FIDO is a standards body which produces specifications used by these systems.
- jmsgwd 11mo ago
  > I dont want an online backup. I want my credentials to only be on my computers. So now I gotta learn about which apps are ok, don't have cloud synching If an "online" password manager uses end-to-end encryption, then the credentials really are only on your computers. The only thing "in the cloud" is encrypted blobs of data being moved around for the purpose of device sync and backup. This insistence on using local non-syncing password managers is a masochistic exercise in making life difficult for yourself with no security benefit.
  - jmsgwd 11mo ago
    That came across more snarky than I intended! Let me rephrase: for the majority of users, the usability and resilience benefits of synced credentials are enormous, and the security costs are marginal at best. But this rests on a number of assumptions. YMMV.
shantara 11mo ago
Vendor lock-in a serious concern. Just reading through this KeePass issue again and seeing how much pressure the industry is trying to exert to prevent the users from being able to export their own private keys should be concerning. I come back to this discussion every time I see someone arguing in favor of passkey adoption. >The unfortunate piece is that your product choices can have both positive and negative impacts on the ecosystem as a whole. I've already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers https://github.com/keepassxreboot/keepassxc/issues/10407 https://github.com/keepassxreboot/keepassxc/issues/10407
- timmyc123 11mo ago
  Hi! I'm the commenter on that post that keeps being brought up! I don't think requiring an encrypted backup (with a key or secret that YOU control) by default is "preventing users from being able to export their own private keys".
  - shantara 11mo ago
    Hi! I have no issue with having the backup being encrypted by default, except the discussion returns again and again to disallowing any cleartext export, even when specifically requested by the end user. And on a separate note, I fundamentally disagree for political reasons with the idea that the websites should be able to block specific passkey providers.
  - deleted 11mo ago
    [deleted]
  - Groxx 11mo ago
    You say "requiring by default". That makes no sense in this context (or most) - you can either require something (which is not "by default") or you do not (at which point you can encourage something as strongly as you like, but it's still not required). The github issue is quite clear about "requiring", not "by default", which is a restriction on what someone does with their own data. Particularly since AFAICT there is still no spec for data exchange over flat files. CXP is a probably-reasonable more-safe option to encourage, but it really shouldn't be the only option. (arguably CXF only defines non-encrypted files, since it doesn't even recommend encryption options or provide a way to communicate what was used, except to say that it "MUST" encrypt or coordinate over CXP)
polalavik 11mo ago
Passkeys need a marketing campaign and UX overhaul. I’m a technical guy, but I really don’t understand what the fuck is going on when I use a passkey. All I know is one day it appeared as an option and it let me login to things. I don’t really understand where it lives, what device it’s tied to, how scanning a QR code on Google Chrome on my phone magically logs me in, etc etc. The user was not educated on this. Hacker News is the top 1% of computer power users. You gotta understand to someone’s grandma or mom or brother who works in real estate none of this makes any sense nor will they educate themselves on what it is.
- timmyc123 11mo ago
  when you create or use a passkey, the UI on all platforms tells you where it is going to be saved or where it is coming from.
  - crazygringo 11mo ago
    Right now, when I go to the security section of my Amazon account in Chrome, it (unasked) prompts me to add a passkey, and the popup on my Mac says, verbatim: > Add a passkey? "amazon.com" supports passkeys, a stronger alternative to passwords that cannot be leaked or stolen. A passkey for "xxxxx@xxxxx.com" will be saved in "Passwords". Touch ID to Save Passkey Cancel I don't have the slightest idea what "Passwords" is as the destination. My iCloud keychain? My Google account? My 1Password?
    - timmyc123 11mo ago
      Passwords is the name of the app on your Mac.
      - crazygringo 11mo ago
        OK, on the one hand TIL -- thank you! That's a super-meaningful piece of information. On the other hand, you can understand why that is not remotely clear from the message. It's a generic term in quotes. If it said it would be saved "in the Passwords application (and synced to iCloud)", then I'd actually understand it. So Apple is either being intentionally obtuse or incompetently confusing here, and I don't know which is worse. And it's UX crap like this which is why I still won't use passkeys, because I don't know where anything is going.
commandersaki 11mo ago
Passkey is a great avenue for hackers because they represent an optional authentication mechanism that users overloook.
inerte 11mo ago
I update a spreadsheet with all my accounts and money and their values so I know my net worth and its changes, and oh boy every month getting these numbers is such a chore. Since it's been a few days, sometimes I am logged out of either bank/traders and also the password manager. So it's open the bank site, click on login/password, password manager browser extension asks to login. Type password manager password. It asks for 2FA. Unlock phone with face. Find app, open app, unlock app with face. Approve password manager login. Click on bank login/password again. I am in! No, bank wants to 2FA with mobile. Unlock phone with face. Open bank mobile app, unlock with face. Get code or approve login. Back to computer, type code or click approve. Repeat that 12 times for all the accounts, and by the end of it I have neck pain with all the "pick up phone to face unlock" motions. I am a bit paranoid so I turn on 2FA and passkeys and whatnot, but all of this makes me want to use `123password` everywhere and never change it.
- XorNot 11mo ago
  For me everything goes in Keepass. And the only thing I want in life is the ability to change a password from Keepass in a standardized way. Instead we've got Passkeys and the general promise by omission that I will be banned from using Keepass to store and backup my passwords as I see fit on my own devices. People want me to trust the corporate overlords who at every turn have practiced lock in and rent seeking tactics.
bakies 11mo ago
starting to really hate these, regret ever using one
rekabis 11mo ago
I have been working with computers since 82, on the Internet since 88, on the web since 92 and in the IT industry since 97. I have yet to see any solid, significant evidence that passkeys are materially more secure than a random 32-character password + TOTP 2FA. If a site or app refuses to let me create my own login and forces me to use a provider, I’m not going to be a customer under any circumstances. If a site or app refuses to let me use a password+TOTP combination (as in, it forces passkeys), I am similarly out. That’s not to say I don’t use passkeys. I have them on my Microsoft accounts, for one. But that is only after I have fully set up the account, and that the account plays very nice with the Microsoft Authenticator app, even going so far as to do challenge-response auth in coordination with the app, and plumping TOTP up to 8 characters. Will I switch to passkeys elsewhere? Not for some time to come. My passwords make use of the entire two-byte UTF-8 character set, in that less than ½ of all characters typically generated can be found on a U.S. keyboard. So long as websites don’t restrict password length to moronically short values, a 32-character password with 2,048 possibilities for every character ought to be reasonably difficult to crack. And then, of course, comes TOTP 2FA.
- jotaen 11mo ago
  > I have yet to see any solid, significant evidence that passkeys are materially more secure than a random 32-character password + TOTP 2FA. I think the main selling point of passkeys is their ability to prevent phishing. A 32-character password + TOTP can still be entered on a phishing website, e.g. if you happen to follow a fabricated link. With passkeys, this is not possible by design.
  - rekabis 11mo ago
    > A 32-character password + TOTP can still be entered on a phishing website, e.g. if you happen to follow a fabricated link. …How? The password manager only permits exact links. If the URL does not have the UTF-8-identical characters to the correct url - at which time, IT IS the correct URL - it will simply not populate the username and password fields.
- Marsymars 11mo ago
  > I have yet to see any solid, significant evidence that passkeys are materially more secure than a random 32-character password + TOTP 2FA. Not more secure, but some sites mandate email/SMS 2FA, don't support TOTP, and have added passkey support. For these sites, using passkeys is materially more convenient than copying 2FA codes from email/SMS.
deleted 11mo ago
[deleted]
emadda 11mo ago
Related: I released a hosted sign in page for passkey auth today. Take a look: https://passkeybot.com https://passkeybot.com
kouru225 11mo ago
One thing I genuinely hate about modern tech is that it punishes you for planning ahead. I purposely spent time getting a password manager and implementing 2fa protocols that would both speed up my time and keep me safe. Then suddenly every company decided it was time to go passwordless or do passkeys and all my work (researching different products, setting each one up, making sure hey work on all my devices, etc etc) suddenly goes down the drain
cheeseburgerz 11mo ago
I'm tired, boss.
- cindyllm 11mo ago
  [dead]
pabs3 11mo ago
Hmm, does not mention that you can't use Passkeys if you don't have JavaScript enabled.
kim100 10mo ago
I lost about $10,000 USD in bitcoin, which put me in a tight spot. I was inconsolable and believed that I had reached my lowest moment, with no possibility of getting my money back. Everything changed drastically when I discovered Coin Hack. The company intervened and promptly helped me get my full refund. Their services are highly recommended You can reach them on coinhackrecovery (@) gmail com for a help if you are having issues.

192 points by todsacerdoti 11mo ago

So in other words, Passkeys are over engineered and simply too complicated for most users. Succumbing to lock-in can smooth some (but not all) rough edges and creates it's own restrictions and risks. TOTP for the win --- it's the simpler practical alternative.

timhh 11mo ago
TOTP is really annoying IMO but at least you control it so you can make it one-factor again if it's foisted on you. I made a Chrome extension to do that: https://chromewebstore.google.com/detail/lazyotp/eoihmklnjkngifajbdlfhhajdcdpmplb https://chromewebstore.google.com/detail/lazyotp/eoihmklnjkn...

Mindwipe 11mo ago

Really great article. I also think there's still an enormous ignorance from passkey devs that lots of people want to occasionally log into personal services from locked down corporate machines, and the flow to deal this is at best terrible but more often non-existent, and developers with typically enhanced privileges just aren't able to conceive how difficult this is.

oasisbob 11mo ago
As someone who has enhanced privileges, I'm having problems thinking of what all the the issues here are. Corporate installs disable all USB functionality, and remove the ability to sync profiles? Something like that?
- spencerflem 11mo ago
  If you’re not using bitwarden or equivalent they can’t be moved off a device you own at all, and even with it you’d need to download bitwarden which might be impossible
nine_k 11mo ago
> log into personal services from locked down corporate machines This is usually a bad idea, and is sometimes expressly forbidden. But. more generally, there must be a flow for accessing your account when the passkey is not available, and possibly cannot be recovered.
- AndrewDucker 11mo ago
  I'm limited in what applications I can install at work. I am not limited in what websites I can access on my lunch break (within reason).
  - timmyc123 11mo ago
    This is one of the core use cases for why FIDO Cross-Device Authentication was created. To be able to use a passkey to sign in on a shared device, a device you don't control, or a device where you just need temporary access to something.
    - AndrewDucker 11mo ago
      Just tried that. Logged into Passkeys.io on my phone, and created a passkey. Then tried to log in to it on my Windows desktop, using the "With my phone" option. First time around it failed to connect to my phone. Future times it connected, but told me that the phone had no appropriate passkeys on it. At which point I gave up. Edit: I then tried on GitHub, and it worked perfectly! Okay, that's pretty awesome.
timmyc123 11mo ago
This is one of the core use cases for why FIDO Cross-Device Authentication was created. To be able to use a passkey to sign in on a shared device, a device you don't control, or a device where you just need temporary access to something.
- crazygringo 11mo ago
  On the one hand, that seems really important and I'm happy to know it exists. On the other hand, I thought I had fully researched how passkeys work and literally never came across it. So it kind of just continues to support my concern that passkeys are just too complicated to understand. If I'm at another device I need to log into, I would have just assumed I couldn't. There needs to be a simple mental model for users. I'm not saying passkeys can't underlie that, but I think the UX still just hasn't been fully figured out yet.
  - timmyc123 11mo ago
    I used the technical name for the capability, but you've likely run into it before. If there is no passkey on the local device, a QR code will appear which you can scan with your phone or tablet, and use the passkey for the account from that device. It just kind of happens, typically without the user having to do anything special. I will say though, corporate devices can be a bit of a wildcard as they are usually configured and locked down for a specific purpose. But the cross-device flow is generally not blocked by organizations.
    - crazygringo 11mo ago
      I don't use passkeys, so I haven't run into it. It seems like that screen would be gated behind entering an e-mail address or username that is already registered with a passkey on another device. What I'm saying is, I thought I had the right mental model of how passkeys work, after researching them, and that mental model told me you wouldn't be able to log in on a different device without going through a whole procedure to set up a new passkey, which you wouldn't want to do for something temporary. The mental complexity is just too much for me to trust that if I adopt them, they'll work when I need them. The fact that I got this thing wrong means there's probably other things I'm still getting wrong. I understand passwords and password managers and even 2FA. I feel like I can plan how to use them right so it all works and I don't need to worry about not being able to access my accounts. I just don't have that confidence with passkeys.
tzs 11mo ago
Logging in to a personal service from your locked down corporate machine with a passkey works like this: 1. Start to login to the site. 2. When it gets to the point that you would choose to use a passkey if you were logging in at home, there should be some option that lets you say you want to use a passkey on another device. You can use that to tell it you want to use a passkey that is on your phone. 3. It gives you a QR code to scan with the phone, and then you complete the login using the passkey manager on the phone.

secabeen 11mo ago

The "Vendors Can Lock You Out" part is what makes passkeys entirely a non-starter for me. Especially the additional risk when someone passes away and the heirs are trying to get access to the deceased's accounts. Vendors are well known for saying "we had an agreement with Samantha, and with her death, that agreement has terminated, and no one can be given access that was not pre-designated."

teeray 11mo ago
> "we had an agreement with Samantha, and with her death, that agreement has terminated, and no one can be given access that was not pre-designated." It would be nice if you could use some legal apparatus to ratchet these agreements into a trust. Corps would hate it though, so it will probably be illegal to do.
- dpark 11mo ago
  It’s “illegal” in the sense that you could write whatever you want in your will but it wouldn’t be binding. You cannot force a party into a legal obligation they do not agree to. The government can, though. I’m not sure if there’s any existing laws pertaining to transfer of or access to general accounts after death (as opposed to bank accounts which I’m pretty sure there are laws about). My will says that my executor can access my accounts which alleviates Apple from legal risk if they do grant access but I’m pretty sure they are not obligated to do so.
  - Terr_ 11mo ago
    This reminds me of some past political debates around same-sex marriage, where I encountered some folks claiming government-involvement wasn't really necessary because Free Contract could take care of everything. (This was some years back before the US Libertarian party imploded.) It was rather frustrating to watch: "You're a huge fan of X but don't know how X works?" For example, two people can't make a contract between them that gives one the right to visit the other in a hospital, nor the right to make medical-care/power-of-attorney decisions. You also can't contract-away the guardianship (or ownership) of children, etc.

1970-01-01 11mo ago

Totally agree with this. Passkeys are a solution but not the sole solution. There is absolutely a misconception for seeing them as newest and therefore the best choice.

alyandon 11mo ago

I'm a bit of a curmudgeon about this. Until service providers are no longer allowed to: 1) force the type of passkey stores used (e.g. hardware vs software) when I am providing the passkey store 2) force me to MFA (e.g. forcing touch ID, entering pin or unlock password, etc) when attempting to use a passkey I'll continue to stick to plain old boring password + TOTP. I fully understand the security trade-offs like phishing resistance but password + TOTP is secure enough for me.

Groxx 11mo ago
Many/all? also need to have some form of manual input as a backup, so you're not forced to sync all your passwords to e.g. a library's computer just to log in, if your house burns down or something. Which probably looks a lot like a password.
jesseendahl 11mo ago
(1) is already true today. There is no way for services to enforce whether a passkey is stored in software or hardware. (2) I understand you don't like the user experience. But to make a technical clarification: requiring a user action to prove there's a human involved in the login action (e.g. by clicking a button in UI or requiring Touch ID) does not necessarily mean there's another factor involved at all (MFA). What you are describing is more of a "liveness check" than a separate factor/separate credential.
- deleted 11mo ago
  [deleted]
- spencerflem 11mo ago
  Liveness check is fine, but I’ve always seen it as requiring Microsoft Hello or equivalent explicitly, and not whatever check I would prefer to use
- alyandon 11mo ago
  (1) is already true today. There is no way for services to enforce whether a passkey is stored in software or hardware. Challenge: Go and try to register a non-blessed passkey type with PayPal and come back and share your experience. (2) I understand you don't like the user experience Pretty much my complaint. Passkeys allow for service providers to do dumb things that result in terrible UX. With Password + TOTP, I don't get asked to touch a sensor, enter a PIN, enter an unlock password, etc.

everfrustrated 11mo ago

The biggest problem I have with passkeys is being tied to a single device you still need a flow to reset/get in _without_ the passkey. As you're only as secure as your weakest link passkeys don't add any security. That said, if you have a mac with a fingerprint scanner they sure are very convenient option. And don't get me started on terrible vendors like Rippling that only support a single passkey! Madness.

mmsimanga 11mo ago
I dropped my phone and it literally fell apart. As a result I have been locked out of my AWS account. The get a phone call verification just does not work. Only saving grace is that it was an account I used to test things.
jmsgwd 11mo ago
I keep hearing it repeated, but where does this "tied to a single device" idea come from? The default, built-for-the-masses implementation of passkeys is called "synced passkeys". They are designed to sync between all your enrolled devices, ideally using end-to-end encryption. You authenticate with whatever device you happen to be using at the time - phone, tablet, laptop, desktop - doesn't matter. If you lose one, you replace that device and re-enroll - then all your passkeys magically re-appear on the new device. If you're cross-platform, modern password managers work across ecosystems - for example, 1Password syncs passkeys between Mac, Windows, iOS, Android, and Linux. If you're all-in on Apple, their native passkey implementation syncs passkeys between all your Apple devices. I thought Google and Microsoft do something similar now. It's a real mystery why people believe passkeys have to be stored on your phone only.
- spencerflem 11mo ago
  Because by default, they do, and you have to explicitly install software to let it be moved. And even if you do, it’s discouraged and the spec is allowed to deny you access.
  - timmyc123 11mo ago

jason_s 11mo ago

Please don't use fixed-width fonts to write text. Please use fixed-width fonts to write code.

dantillberg 11mo ago
I think part of the distress experienced by readers is due to mixing the fixed-width font with "text-align: justify". So it's close but not exactly fixed/consistent.
- miloignis 11mo ago
  Ah, thank you for pointing that out! I was wondering what it was.
dpifke 11mo ago
Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting. (quoting https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html)
nine_k 11mo ago
Firefox Reader Mode makes such sites more readable.

kemotep 11mo ago

2 things about passkeys I wish would be fixed. 1. Passkey prompts asking if I want to use a phone or security key when I only have one (or neither!) registered. The UI for this gets in the way and should only ever present itself if I happen to have both kinds of devices registered. 2. Passkeys should have had the portability and flexibility that ssh keys have from the start. Making it so your grandparents can use public key cryptography and gain a significant advantage in securing their accounts in a user friendly manner should have been the priority. Seems like vendor lock-in was the goal from the start.

lapcat 11mo ago
> Seems like vendor lock-in was the goal from the start. Exactly. The passkey vendors state that the goal was to make phishing not just difficult but impossible. This means plaintext access to your credentials is forbidden forever, regardless of your level of expertise, and regardless of the complexity of the process to export/import them. The purpose of the so-called "secure credential exchange" is once again to prevent you from directly accessing your credentials. You can go from one passkey vendor to another, but you're always locked in to one passkey vendor or another. Any credential system that makes it impossible to write something down on a piece of paper, take it to a new computer, and login to a website is just a gateway to vendor lock-in. You can manually manage your own ssh keys but for some reason not your passkeys. As an Apple Mac user, what annoys me the most is that the use of passkeys in Safari requires iCloud Keychain, which of course requires iCloud and an Apple Account. [EDIT: Obviously I'm talking about built-in support. I'm well aware of third-party software, so everyone can stop replying to this now, please!] You can't do local-only passkeys, not even if you take responsibility for backing up your own Mac. The passkey vendors took some good theoretical ideas, such as site-specific credentials and public-key cryptography, and totally mangled the implementation, making it hostile to everyone except themselves.
- mroche 11mo ago
  This is obviously kicking the can down the road, but I "solve" this problem by storing passkeys in a third-party credential manager that supports them. That way I can use them on any device that I've installed the client app or browser extension on. I have this working on Fedora, macOS, Windows, and iOS. But again, kicking the can down the road.

stalfosknight 11mo ago

Passkeys are a completely seamless experience on Apple platforms in my experience so far.

freehorse 11mo ago
Not that seamless if you do not want to be locked into a single platform, though. This is what the article mostly talks about.
- growse 11mo ago
  Why are you locked into a single platform? I use bitwarden, Google and a yubikey for passkeys. Which of these am I locked into?
- happyopossum 11mo ago
  Apple has offered an “iCloud for windows” app for ages that literally syncs your iCloud Keychain (passwords and passkeys) to a windows box where you can use browser extensions for chrome, edge, etc. You’re still not platform locked…

dfabulich 11mo ago

The author still has one last misconception about passkeys, namely that if you lose a passkey, you have "no recourse." People wrongly think passkeys are like Bitcoin wallets, where losing them means there's absolutely nothing you can do, your account is simply lost forever. Losing a passkey is exactly like losing your password, which is to say, that for 99% of services, you can reset your password/passkey really easily. There's a prominent "Reset Password" button right on the login form. It sends you an email or an SMS, you click it, and it lets you reset right then and there. You can reset your passkey in exactly the same way. It is not that easy to reset if you lose your password to your Apple, Google, Facebook, etc. They all have a bunch of factors that they use to authenticate you if you reset your password, and they don't even document which ones they use. So, if you care about those accounts, you've got to make sure you have backup access. They all let you generate and print "backup codes" (emergency passwords) and store them in a fireproof safe or a literal bank vault. Do that! As everybody knows, you can't store all of your passwords in a password manager. You need something outside of the password manager to login to the manager itself. That's why 1Password/LastPass is called that; you still need one last password that you keep and manage yourself. That's true of passkeys, too. You can login to Google with passkey, but if Google is your password manager that stores your passkey, you need something else outside of Google's password manager to login to Google. Whether it's a password, a backup code, a YubiKey, whatever, you need one more thing to login to Google, ideally more than one, so you can back it up and keep it safe.

novok 11mo ago
Pre-passkeys, was this lockout issue a true issue with apple and google accounts? Or have passkeys added a general lockout issue that didn't exist before? Also passkeys in their current implementation are not possible to back up or export yourself, unlike passwords in the past. Security engineers are prioritizing preventing key copying over lockout issues, unilaterally, on literally billions of people. It improves their metrics internally, at the cost of an externality on the entire world. This kind of stuff invites odious regulation as more and more stories of lockout with no recourse surface. And unlike passwords, there is no good provider migration story. There is a roach motel issue. Yes it is being 'worked on', but passkeys and such have been out for many years, the willful denial whenever you ask people running these standards about these issues is incredibly irritating. The fact they tend to avoid questions about this like politicians decreases trust in the motives of such standards.

quantummagic 11mo ago

It's not really passkeys that are the problem, it's trusting your passkey to a third-party. But this is still a minor part of the market today, a much bigger problem to warn people about is the "log in with your google/facebook/etc account". Where you're handing everything over to a third-party as well, because it's so easy and convenient. Passkeys, stored in Bitwarden, give a lot of the same convenience, but without the vendor lock-in. We shouldn't be scaring people away from passkeys, when commonly used alternatives are much worse.

XorNot 11mo ago
It's the fact that there's no physical artifact that's the problem - there's no file. You can't back up your passkeys and wind up with something you put in a safe on a USB key or something and vendors have been aggressively trying to make that harder.
- quantummagic 11mo ago
  You can export them from Bitwarden and back them up.

voidfunc 11mo ago

Passkey just suck, end of story. The UX for them is so bad. I have no idea how many active pass keys I have. I just have to trust the provider knows what they're doing. Sometimes my authenticator app seems to forget my pass keys which is even more annoying. Stop the insanity.

arjie 11mo ago

Password + TOTP have served me well so far. To port from device to device I just need to log into my Bitwarden account. It is unclear to me what device loss would do to a passkey and the passkey never communicates that information to me. If I set up a passkey on my iPhone, the site prompts me on my Linux desktop. I understand it's fine for people who use single platforms for everything. But as far as I can tell there is no advantage over Password + TOTP. I really hope Passkeys don't become mandatory. I only use them for sites I don't care about or when I've accidentally said yes to setting one up.

Groxx 11mo ago
Device loss: If you had multiple devices set up on the site (each site must have done this individually), you just use a different device. If you had synced your passkeys somewhere (note that the spec allows sites to block this, though I'm not aware of any actually doing so), you sync them to the new thing and log in normally. If you did none of those, it's gone forever. Do the account recovery process, if one exists. So it degrades to equal or worse than passwords in all cases (which cannot block backups or syncing, and you can enter them individually by hand so you're not exposing all your passwords to the device, and you can communicate them over the phone or in writing), for device loss purposes. Restoring access in this scenario is imo one of their worst qualities.

0x457 11mo ago

Everyone pretends that you're force to only have 1 passkey. I use 3 "passkey managers": Passwords.app, Bitwarden, YubiKey hardware key. I usually add all 3 or just two (skipping YubiKey). On Apple devices I get neat experience out of the box, on Linux (+Firefox) I forced to use Bitwarden because Mozilla is being Mozilla. Never had any issues ever with passkeys.

stouset 11mo ago
Yep. I use Apple’s direct support which works out of the box. I also create a second passkey in 1Password. And for truly important accounts (1Password itself, Apple, Google), I have a third copy on a YubiKey stored in a safe deposit box.
XorNot 11mo ago
3 technological devices which I can't validate by checking if the physical piece of paper is still legible in a safe.

andrewmcwatters 11mo ago

I don't care what you other people in auth do, I work in auth too, please stop making signing into anything 5 steps. 1. First I get redirected to a special sign-in page. 2. Then I sign-in with my email only. 3. Then it finally asks me for a password, even for services that would never reasonably use SSO or have another post-email receive process. 4. Then I get redirected again to enter 2fa. 5. Then these websites ask if I want to create a passkey. No, I never want to create a passkey, and you keep asking me anyway. 6. Then, and only then, do I get to finally go back to using the service I wanted, and by then, you've lost whatever my `?originalUrl=` was, and I have to find it again. No, don't send me a magic link. Because then I have to go do 4 more steps with Gmail or another mailbox provider and now signing in has become 10 or more steps. No, don't tell me getting rid of passwords will help most of the population, and then force all of us to do the above, and blatantly lie to us that it's better. Stop it. Get some help.

eddyg 11mo ago
If you created a passkey, it would be one step.
- andrewmcwatters 11mo ago
  [dead]
magnetowasright 11mo ago
I still find myself stuck on step 0: find the fucking log in button that is for some reason tiny/looks disabled/not easily discernible as a button
- andrewmcwatters 11mo ago
  [dead]

eddyg 11mo ago

Passkeys are fantastic for the vast majority of the population. They solve oodles of problems. No more teaching ${FAMILY_MEMBER} about good passwords, password re-use, trying to explain how to use a password manager, etc. Instead: create passkey, done. Then it's seamless login whether they're on their computer, phone or tablet. As a tech-savvy user fully aware of the underlying machinations involved with passkeys, I greatly prefer their simple, fast login experience over: username submit password submit TOTP submit, and especially over the much-worse "we've emailed you a code" login slog.

201984 11mo ago
It's great until they break their phone, or spill coffee on it, or just lose it, and now they are locked out of EVERYTHING with no good way to get back in. Passwords on a piece of paper for better or worse do not have that problem.
- eli 11mo ago
  Android syncs them to your Google account and iPhone to your iCloud account by default. Which isn't a perfect solution but, again, is pretty good for most people.
  - 201984 11mo ago
    And I just found out recently that you can't log into Google on a desktop without responding to a prompt on your Android phone. Which, if you broke said phone, you can't do. This is without 2fa enabled on my Google account.
    - Groxx 11mo ago
      There are a few alternate options like email or sms (I've used them several times, you have no option if you erase your only actively-used phone occasionally), but yeah. Google effectively forces 2FA whether you like it or not.
    - eli 11mo ago

fusslo 11mo ago

I feel like a boomer. I dont want to use google/apple/microsoft for any credential manager because: google is evil; apple has locked me out of my apple id (and lost things like the recordings of conversations with my father during his hospice); microsoft keeps getting worse and more annoying to use. So ok, I need some credential manager. I used keepass previously... but how do I vet other credential managers? I dont want an online backup. I want my credentials to only be on my computers. So now I gotta learn about which apps are ok, don't have cloud synching, can export files, and be compatible with MacOS. And I have to learn what is FIDO? Like FICO? why do I need to synch with FIDO? what is it? will it give my credential store to others? How is this easier or more convenient than a user/pass with 2fa? I feel like I am going to accidentally leak my credentials and have no way of knowing

scblock 11mo ago
In your case it's literally the same "complexity" as user/pass with 2FA. You need something to manage the passkeys, just like you need something to manage your second factor. Everything else you list as a worry is already in play. FIDO is a standards body which produces specifications used by these systems.
jmsgwd 11mo ago
> I dont want an online backup. I want my credentials to only be on my computers. So now I gotta learn about which apps are ok, don't have cloud synching If an "online" password manager uses end-to-end encryption, then the credentials really are only on your computers. The only thing "in the cloud" is encrypted blobs of data being moved around for the purpose of device sync and backup. This insistence on using local non-syncing password managers is a masochistic exercise in making life difficult for yourself with no security benefit.
- jmsgwd 11mo ago
  That came across more snarky than I intended! Let me rephrase: for the majority of users, the usability and resilience benefits of synced credentials are enormous, and the security costs are marginal at best. But this rests on a number of assumptions. YMMV.

shantara 11mo ago

Vendor lock-in a serious concern. Just reading through this KeePass issue again and seeing how much pressure the industry is trying to exert to prevent the users from being able to export their own private keys should be concerning. I come back to this discussion every time I see someone arguing in favor of passkey adoption. >The unfortunate piece is that your product choices can have both positive and negative impacts on the ecosystem as a whole. I've already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers https://github.com/keepassxreboot/keepassxc/issues/10407 https://github.com/keepassxreboot/keepassxc/issues/10407

timmyc123 11mo ago
Hi! I'm the commenter on that post that keeps being brought up! I don't think requiring an encrypted backup (with a key or secret that YOU control) by default is "preventing users from being able to export their own private keys".
- shantara 11mo ago
  Hi! I have no issue with having the backup being encrypted by default, except the discussion returns again and again to disallowing any cleartext export, even when specifically requested by the end user. And on a separate note, I fundamentally disagree for political reasons with the idea that the websites should be able to block specific passkey providers.
- deleted 11mo ago
  [deleted]
- Groxx 11mo ago
  You say "requiring by default". That makes no sense in this context (or most) - you can either require something (which is not "by default") or you do not (at which point you can encourage something as strongly as you like, but it's still not required). The github issue is quite clear about "requiring", not "by default", which is a restriction on what someone does with their own data. Particularly since AFAICT there is still no spec for data exchange over flat files. CXP is a probably-reasonable more-safe option to encourage, but it really shouldn't be the only option. (arguably CXF only defines non-encrypted files, since it doesn't even recommend encryption options or provide a way to communicate what was used, except to say that it "MUST" encrypt or coordinate over CXP)

polalavik 11mo ago

Passkeys need a marketing campaign and UX overhaul. I’m a technical guy, but I really don’t understand what the fuck is going on when I use a passkey. All I know is one day it appeared as an option and it let me login to things. I don’t really understand where it lives, what device it’s tied to, how scanning a QR code on Google Chrome on my phone magically logs me in, etc etc. The user was not educated on this. Hacker News is the top 1% of computer power users. You gotta understand to someone’s grandma or mom or brother who works in real estate none of this makes any sense nor will they educate themselves on what it is.

timmyc123 11mo ago
when you create or use a passkey, the UI on all platforms tells you where it is going to be saved or where it is coming from.
- crazygringo 11mo ago
  Right now, when I go to the security section of my Amazon account in Chrome, it (unasked) prompts me to add a passkey, and the popup on my Mac says, verbatim: > Add a passkey? "amazon.com" supports passkeys, a stronger alternative to passwords that cannot be leaked or stolen. A passkey for "xxxxx@xxxxx.com" will be saved in "Passwords". Touch ID to Save Passkey Cancel I don't have the slightest idea what "Passwords" is as the destination. My iCloud keychain? My Google account? My 1Password?
  - timmyc123 11mo ago
    Passwords is the name of the app on your Mac.
    - crazygringo 11mo ago
      OK, on the one hand TIL -- thank you! That's a super-meaningful piece of information. On the other hand, you can understand why that is not remotely clear from the message. It's a generic term in quotes. If it said it would be saved "in the Passwords application (and synced to iCloud)", then I'd actually understand it. So Apple is either being intentionally obtuse or incompetently confusing here, and I don't know which is worse. And it's UX crap like this which is why I still won't use passkeys, because I don't know where anything is going.

commandersaki 11mo ago

Passkey is a great avenue for hackers because they represent an optional authentication mechanism that users overloook.

inerte 11mo ago

I update a spreadsheet with all my accounts and money and their values so I know my net worth and its changes, and oh boy every month getting these numbers is such a chore. Since it's been a few days, sometimes I am logged out of either bank/traders and also the password manager. So it's open the bank site, click on login/password, password manager browser extension asks to login. Type password manager password. It asks for 2FA. Unlock phone with face. Find app, open app, unlock app with face. Approve password manager login. Click on bank login/password again. I am in! No, bank wants to 2FA with mobile. Unlock phone with face. Open bank mobile app, unlock with face. Get code or approve login. Back to computer, type code or click approve. Repeat that 12 times for all the accounts, and by the end of it I have neck pain with all the "pick up phone to face unlock" motions. I am a bit paranoid so I turn on 2FA and passkeys and whatnot, but all of this makes me want to use `123password` everywhere and never change it.

XorNot 11mo ago
For me everything goes in Keepass. And the only thing I want in life is the ability to change a password from Keepass in a standardized way. Instead we've got Passkeys and the general promise by omission that I will be banned from using Keepass to store and backup my passwords as I see fit on my own devices. People want me to trust the corporate overlords who at every turn have practiced lock in and rent seeking tactics.

bakies 11mo ago

starting to really hate these, regret ever using one

rekabis 11mo ago

I have been working with computers since 82, on the Internet since 88, on the web since 92 and in the IT industry since 97. I have yet to see any solid, significant evidence that passkeys are materially more secure than a random 32-character password + TOTP 2FA. If a site or app refuses to let me create my own login and forces me to use a provider, I’m not going to be a customer under any circumstances. If a site or app refuses to let me use a password+TOTP combination (as in, it forces passkeys), I am similarly out. That’s not to say I don’t use passkeys. I have them on my Microsoft accounts, for one. But that is only after I have fully set up the account, and that the account plays very nice with the Microsoft Authenticator app, even going so far as to do challenge-response auth in coordination with the app, and plumping TOTP up to 8 characters. Will I switch to passkeys elsewhere? Not for some time to come. My passwords make use of the entire two-byte UTF-8 character set, in that less than ½ of all characters typically generated can be found on a U.S. keyboard. So long as websites don’t restrict password length to moronically short values, a 32-character password with 2,048 possibilities for every character ought to be reasonably difficult to crack. And then, of course, comes TOTP 2FA.

jotaen 11mo ago
> I have yet to see any solid, significant evidence that passkeys are materially more secure than a random 32-character password + TOTP 2FA. I think the main selling point of passkeys is their ability to prevent phishing. A 32-character password + TOTP can still be entered on a phishing website, e.g. if you happen to follow a fabricated link. With passkeys, this is not possible by design.
- rekabis 11mo ago
  > A 32-character password + TOTP can still be entered on a phishing website, e.g. if you happen to follow a fabricated link. …How? The password manager only permits exact links. If the URL does not have the UTF-8-identical characters to the correct url - at which time, IT IS the correct URL - it will simply not populate the username and password fields.
Marsymars 11mo ago
> I have yet to see any solid, significant evidence that passkeys are materially more secure than a random 32-character password + TOTP 2FA. Not more secure, but some sites mandate email/SMS 2FA, don't support TOTP, and have added passkey support. For these sites, using passkeys is materially more convenient than copying 2FA codes from email/SMS.

deleted 11mo ago

[deleted]

emadda 11mo ago

Related: I released a hosted sign in page for passkey auth today. Take a look: https://passkeybot.com https://passkeybot.com

kouru225 11mo ago

One thing I genuinely hate about modern tech is that it punishes you for planning ahead. I purposely spent time getting a password manager and implementing 2fa protocols that would both speed up my time and keep me safe. Then suddenly every company decided it was time to go passwordless or do passkeys and all my work (researching different products, setting each one up, making sure hey work on all my devices, etc etc) suddenly goes down the drain

cheeseburgerz 11mo ago

I'm tired, boss.

cindyllm 11mo ago
[dead]

pabs3 11mo ago

Hmm, does not mention that you can't use Passkeys if you don't have JavaScript enabled.

kim100 10mo ago

I lost about $10,000 USD in bitcoin, which put me in a tight spot. I was inconsolable and believed that I had reached my lowest moment, with no possibility of getting my money back. Everything changed drastically when I discovered Coin Hack. The company intervened and promptly helped me get my full refund. Their services are highly recommended You can reach them on coinhackrecovery (@) gmail com for a help if you are having issues.