4 ms·

It's more likely for them to accidentally be deleted (or otherwise lost access): in my experience approximately zero users actually understand where their passk

by rcxdude 8mo ago

It's more likely for them to accidentally be deleted (or otherwise lost access): in my experience approximately zero users actually understand where their passkeys are stored, and they can be all over the place: the number one question I get is 'why can't I log in?' because they've accepted a passkey setup dialog on one machine without really reading it and now can't log in on another. Sometimes it's on the same machine but in different contexts. No passkeys should be considered something that the average user is going to reliably hold onto (in large part because the industry has been so keen to foist them on users but not very keen at all to educate them on how they work. This also makes them a lot less useful from a security point of view because it means you can't get rid of the recovery process, which tends to be the weaker link).

pibaker 8mo ago
> in my experience approximately zero users actually understand where their passkeys are stored Passkeys are designed to be hidden from the user. The author of this article even went on GitHub telling an open source implementation to not let users copy the private key. https://github.com/keepassxreboot/keepassxc/issues/10407 https://github.com/keepassxreboot/keepassxc/issues/10407 There is a good reason for it. If you can copy and paste your passkey, then a phishing site can just ask you for it, making the phishing protection passkeys provide moot. But the consequence is people, including many technical users on this website, cannot get a grasp on passkeys both as a concept and in a literal sense. How can you perceive, let alone understand, something that is designed to be hidden from you? It also doesn't help that it was pushed on users with little explanation and comes with many seemingly incompatible implementations. Unless passkeys are redesigned to solve the intangibility problem, grannies will keep losing their accounts for no good reason and we will keep arguing about it on HN.
- kingstnap 8mo ago
  I cannot believe this guy. > You absolutely should be preventing users from being able to copy a private key! > Asking you to put basic protections in place and collaborate with the ecosystem/industry is hardly "anti-user-choice mentality". > the lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations). Does this guy deflate his neighbors tires before going to work to save them from car accidents? I cannot believe he has this ridiculous paternalistic behaviour while simultaneously having these bullet points on his personal website that he linked to. > digital identity ● urban mobility user choice ● boston bruins
  - Telaneo 8mo ago
    I'm curious how much this one guy, all on his own, has stalled passkey adoption. In theory, this issue could never touch average users. It's only power users who use standalone open-source password managers. All the options normal users are funnelled into aren't going to expose passkeys in plain text (except maybe Firefox?), and thus aren't going to be phishable in any meaningful sense. But this guy opted to tell the open-source community that having exportable passkeys is wrong, full stop, and that open-source implementations might get banned for allowing this, planting a gigantic red flag right next to the very idea of passkeys, making every single power user who sees that post (which is linked on every thread which touches on passkeys) either completely reject the idea, or approach it with extreme caution. And thus no power user will recommend it to anybody else, not to mention the general usability problems they have. I guess if it weren't him, the same ideas would have been made clear in other ways.
  - timmyc123 8mo ago
    Hey I'm the guy you're talking about. Always easy to crap on people when you selectively quote what they said. The core pieces you left out are: > I don't quite understand why requiring file protection/encryption can't be a temporary minimum bar here. > or at a minimum require file protection/encryption. If you think helping users to be safe online (which includes putting basic safeguards in place, like not leaving hundreds of unencrypted private keys on someone's desktop or downloads folder in plain text) isn't an important part of designing solutions for global scale, then we think about things very differently.
    - kingstnap 8mo ago
      What we see different is that I don't collude *text stored inside a password manager* with *plaintext files left on someone's desktop or downloads folder*. You clearly do, and even apply this philosophy to highly technical users. What I find ridiculous is that being able to copy sensitive information out of it is like 99% of what I do with password managers. It's the primary use case.
chihuahua 8mo ago
This is 100% spot on. Passkeys are a mystery, and no one bothers to explain what they are, what it means, how it works, what to do, what to avoid. I'm not an average user - MA in Mathematics, Ph.D. in Computer Science, 27 years of experience as a developer. I have a vague idea that a passkey is like a password, but you don't see it and don't type it and it's stored "somehow, somewhere." I can't make much sense of that. How is an "average user" suppose to make sense of that? When I try to find out how passkeys work, I get some incomprehensible gibberish about self-signed certificates, public/private key pairs, challenges, and on and on. In short, a Monad is just a monoid in the category of endofunctors of X, with product (X) replaced by composition of endofunctors and unit set by the identity endofunctor. What's the big deal? Since any device that stores a passkey can be lost or destroyed at any moment, I assume any passkey can be lost at any moment, and there had better be a way to recover from that. Is there? Who knows.

by rcxdude 8mo ago

pibaker 8mo ago

> in my experience approximately zero users actually understand where their passkeys are stored Passkeys are designed to be hidden from the user. The author of this article even went on GitHub telling an open source implementation to not let users copy the private key. https://github.com/keepassxreboot/keepassxc/issues/10407 https://github.com/keepassxreboot/keepassxc/issues/10407 There is a good reason for it. If you can copy and paste your passkey, then a phishing site can just ask you for it, making the phishing protection passkeys provide moot. But the consequence is people, including many technical users on this website, cannot get a grasp on passkeys both as a concept and in a literal sense. How can you perceive, let alone understand, something that is designed to be hidden from you? It also doesn't help that it was pushed on users with little explanation and comes with many seemingly incompatible implementations. Unless passkeys are redesigned to solve the intangibility problem, grannies will keep losing their accounts for no good reason and we will keep arguing about it on HN.

kingstnap 8mo ago
I cannot believe this guy. > You absolutely should be preventing users from being able to copy a private key! > Asking you to put basic protections in place and collaborate with the ecosystem/industry is hardly "anti-user-choice mentality". > the lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations). Does this guy deflate his neighbors tires before going to work to save them from car accidents? I cannot believe he has this ridiculous paternalistic behaviour while simultaneously having these bullet points on his personal website that he linked to. > digital identity ● urban mobility user choice ● boston bruins
- Telaneo 8mo ago
  I'm curious how much this one guy, all on his own, has stalled passkey adoption. In theory, this issue could never touch average users. It's only power users who use standalone open-source password managers. All the options normal users are funnelled into aren't going to expose passkeys in plain text (except maybe Firefox?), and thus aren't going to be phishable in any meaningful sense. But this guy opted to tell the open-source community that having exportable passkeys is wrong, full stop, and that open-source implementations might get banned for allowing this, planting a gigantic red flag right next to the very idea of passkeys, making every single power user who sees that post (which is linked on every thread which touches on passkeys) either completely reject the idea, or approach it with extreme caution. And thus no power user will recommend it to anybody else, not to mention the general usability problems they have. I guess if it weren't him, the same ideas would have been made clear in other ways.
- timmyc123 8mo ago
  Hey I'm the guy you're talking about. Always easy to crap on people when you selectively quote what they said. The core pieces you left out are: > I don't quite understand why requiring file protection/encryption can't be a temporary minimum bar here. > or at a minimum require file protection/encryption. If you think helping users to be safe online (which includes putting basic safeguards in place, like not leaving hundreds of unencrypted private keys on someone's desktop or downloads folder in plain text) isn't an important part of designing solutions for global scale, then we think about things very differently.
  - kingstnap 8mo ago
    What we see different is that I don't collude *text stored inside a password manager* with *plaintext files left on someone's desktop or downloads folder*. You clearly do, and even apply this philosophy to highly technical users. What I find ridiculous is that being able to copy sensitive information out of it is like 99% of what I do with password managers. It's the primary use case.

chihuahua 8mo ago

This is 100% spot on. Passkeys are a mystery, and no one bothers to explain what they are, what it means, how it works, what to do, what to avoid. I'm not an average user - MA in Mathematics, Ph.D. in Computer Science, 27 years of experience as a developer. I have a vague idea that a passkey is like a password, but you don't see it and don't type it and it's stored "somehow, somewhere." I can't make much sense of that. How is an "average user" suppose to make sense of that? When I try to find out how passkeys work, I get some incomprehensible gibberish about self-signed certificates, public/private key pairs, challenges, and on and on. In short, a Monad is just a monoid in the category of endofunctors of X, with product (X) replaced by composition of endofunctors and unit set by the identity endofunctor. What's the big deal? Since any device that stores a passkey can be lost or destroyed at any moment, I assume any passkey can be lost at any moment, and there had better be a way to recover from that. Is there? Who knows.