16 ms·

Passkeys were invented by engineers with zero understanding of consumer brain

• voidmain0001 3mo ago
  It just so happened that Microsoft sent an email today to our M365 tenant administrators that SMS and voice for 2FA is being removed 1-Feb-2027 and that automatic enrollment to passkeys starts 1-Sep-2026. Bring on the passkey overlords. Although, LLMs say that passkeys are superior to passwords since it includes a public/private key setup with the private key saved to a device that requires a PIN or biometric to access the private key.
  • SirFatty 3mo ago
    That's if you're using Authenticator.
    • josteink 3mo ago
      Clarification: Microsoft Authenticator. You can’t use any random password-manager with passkey support. I use Bitwarden for everything and have to have MS Authenticator installed just for this 1 login. Super annoying.
      • SirFatty 3mo ago
        I have Duo in our environment. Authenticator not required.
      • timmyc123 3mo ago
        You can use any credential manager you choose for Microsoft Account passkey.
    • voidmain0001 3mo ago
      The use of a passkey doesn’t require Authenticator or other OTP app. Gemini said that an OTP app can be used as a vault for the passkey, but it’s not the mechanism that permits the check of the private key. Rather, that’s the PIN or biometric. Now, perhaps I don’t understand your statement and you can clarify if that’s the case.
  • pjc50 3mo ago
    How is one supposed to let an LLM log in with passkey?
• bflesch 3mo ago
  My tinfoil hat take is that there's significant interest to keep everything digital, always-online and connected to the major providers, so it can easily be snooped by five eyes using their omnipresent backdoors. Passkey biometrics also allow you to confirm certain person is holding the device right in this very moment, and not receiving a TOTP via walkie-talkie. Especially important for kinetic sanctions. If you check out their Terramare group of companies those guys are still using typewriters. Unless you're US/UK millionaire I recommend to stay as analog as possible with physical password book and TOTP/yubikey. Same with the push for "post-quantum crypto" and elliptic curves. I feel my systems get significantly more attention when using 8k RSA than any of its modern replacements. While I love wireguard the transition to ED25519 felt way too smooth..
  • forsalebypwner 3mo ago
    the fact that some nebulous "group of companies" still uses typewriters does not mean that all modern cryptography is flawed
    • bflesch 3mo ago
      Diversity is resilience; no need to standardize on curves or "post-quantum" IBM bullshit if other approaches still work perfectly fine. And if the pros are using typewriters in 2026 it's not a signal for me to put even more eggs into the US-megacorp dominated basket who treat me like an NPC who can be droned at will.
      • forsalebypwner 3mo ago
        An important skill to develop is determining whether somebody is bullshitting you. Because it would be impossible for any one human to perfectly understand all of these concepts, right? So when I read this person's blog post, I felt I could trust him, based on what I know about work he's done previously. I'm not saying you should trust me on this, or even blindly trust him, but look at his body of work, and the sources he cites, and make the call for yourself: https://words.filippo.io/crqc-timeline/ https://words.filippo.io/crqc-timeline/
• coldpie 3mo ago
  Passkeys are a vector for locking your logins to Big Tech ecosystems. They support device attestation, which means the service you are logging in to can require you to only use certain Passkey clients such as those provided by Google, Apple or Microsoft. The Passkey spec authors also maintain a list of "naughty clients"[1], which are clients that allow the user to manage their own data how they want. Services could choose to block those clients for "security reasons," justifying the decision to force you to use one of the Big Tech providers. Until device attestation is removed or strongly curtailed in the spec, I suggest you do not create any Passkeys. Which sucks, because it's otherwise a pretty cool tech. [1] https://passkeys.dev/docs/reference/known-issues/ https://passkeys.dev/docs/reference/known-issues/ More sources here: https://www.smokingonabike.com/2025/01/04/passkey-marketing-is-lying-to-you/ https://www.smokingonabike.com/2025/01/04/passkey-marketing-...
• IceHegel 3mo ago
  I think there are probably sinister motives behind some of the push to pass keys, but you'd think that if that were true, they would make it really quite easy to add one and to use. That is not the case. The entire setup/enrollment/add a passkey to your account processing is DMV inspired.
  • postalrat 3mo ago
    Its a lot easier to track email and phone numbers used across multiple sites than it is passkey used on multiple sites.
• datakan 3mo ago
  Passkeys are just SSH keys in how they work. We've been doing this since the 90's. The only people that use SSH keys are the Linux savvy users and those who are forced to via an enterprise solution for vaulting. The average person doesn't know anything about this stuff nor do they care. I also have yet to see a Passkey solution that didn't also have a password on it and a nice little box letting people choose to use the password instead of the passkey. They just added a new layer on top of all the old ones and created confusion. Now people use password and passkey interchangably in conversations and no one knows what they are talking about.
  • account42 3mo ago
    SMS 2FA was also optional everywhere until it wasn't.
    • NetMageSCW 3mo ago
      It is still optional most places.
      • rustcleaner 3mo ago
        Not for Chase, not for Schwab, not for my DOCSIS provider, not for my cellular provider, etc. They don't offer TOTP either, just SMS for 2FA. It's going to require a law: if you require 2FA, then TOTP or HOTP must be offered as an option.
  • cpburns2009 3mo ago
    I can find my ssh keys in `~/.ssh`. No such place exists for passkeys.
    • microflash 3mo ago
      It depends on the app you’re using to save passkeys. Use Keepass and it saves the passkeys into kdbx file (similar to SSH keys).
• gortok 3mo ago
  I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand: I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use LastPass. If I accidentally set up a passkey on my phone (let’s say I use Safari one day instead of my go-to, Brave), can I still log in without that passkey on other devices? Is there a way to ensure that passkey can be used on other devices? Can I add another passkey on another device? How many passkeys can I set up for a particular site/app? I have at least 6 different combination of browser/devices in use. I don’t want to use Passkeys because I don’t the answers to those questions, and I don’t know whether each website/app that has set up Passkeys has decided the answers to those questions in the same way as the others. For now, I’m going to stick with LastPass and use Passwords; because no matter whether I lose my device or not or whether I’m on my own devices or not, I can be sure I’ll be able to get into a site/app. Edit: One final consideration, my spouse and I share user/name passwords for some things (notably Pandora and our Amazon Prime account) since they don’t handle things like family logins well; how do both my wife and I use amazon or Pandora with passkeys? Do we each set up passkeys? How do I get her Pass if that’s not an option?
  • marysol5 3mo ago
    Everything you ask is nothing to do with PassKeys, but to do with whatever platform you use authentication flow...
  • cpburns2009 3mo ago
    This is the main reason I've avoided passkeys. I have these exact questions and there's no a clear explanation given for these. I don't want to lose access to important accounts.
    • dijit 3mo ago
      Agreed, it's the exact same as me, I haven't seen someone put it into such succint words before, so bravo. I think the reason is because I've anchored passkeys into my understanding of how 2FA works, and the pain of migrating 2FA from one phone to another. So, I don't want to bother with it.
• exabrial 3mo ago
  With physical U2F key, I could explain to my 78 year-old-parents "this is a physical key needed to access your account. Think of it like the front door key to your house. Don't lose it or lend it to anyone. We should have a couple of backup keys too." And they got completely understood and added it to all of their accounts. This was not hard. People assumed consumers were too stupid to do this without even giving them a chance.
  • JohnFen 3mo ago
    > Don't lose it or lend it to anyone. We should have a couple of backup keys too. Honestly, this is one of the two things that make me hate passkeys. The key management is a high-friction pain in the ass.
  • xur17 3mo ago
    I never found a comfortable way to ensure all of my accounts had more than one U2F key associated with them. I always wished there was a way to have 2 physical U2F keys, one on me, and by adding one to an account, both would work. As is, I had to either: - Keep both on me, and add both - I am at risk of losing both at the same time - Keep one one me, one in a safe - I have to keep track of which device I've added to which service, and periodically take the backup one out of the safe and iterate through the "new" services I was never satisfied with either approach, so I ended up with an OTP app with backups.
    • epistasis 3mo ago
      If you're comfortable with OTP with backups, does a password manager like 1password, with backups, fit your needs? Or would you prefer to self-manage your backups on your own storage? I ask because I'm curious about others' practices and desires here, not with any promise of a better solution!
      • xur17 3mo ago
        Yeah, 1password or keepass are both fine solutions for password managers in my mind.
• programmertote 3mo ago
  Like some folks already commented here, even as someone who has been working in tech for 20+ years, I find Passkey confusing. I understand the key aspect in computer science term, but I don't know how to use it across devices. Another big worry is that if I tie that to a physical key, then I might lose it (because it's physical) and never get it back.
  • reddalo 3mo ago
    Exactly, I always refuse to add a passkey because I'm afraid I won't be able to easily login again. Also, I don't want to be locked in to a vendor.
    • rib3ye 3mo ago
      You can use a passkey that's tied to a Yubikey.
      • avh02 3mo ago
        The problem here is i want to have more than 1 yubikey, so if i lose it, all is not lost... I can't do that with the current implementations unless i present N yubikeys to every new account i make. Which makes an off-site backup yubikey impossible. With my current yubikey usage with password store, my "offline" yubikey can be brought in whenever i want to decrypt the passwords, including ones inserted while the key was in storage. Also yubikeys have limited passkey slots (100, 25 with old firmware)
        • pllbnk 3mo ago
          Also, where do I store the backup Yubikey, or any other pass key owning device for that matter? It has to be easily accessible to set up the pass keys, but also safe from accidents like house fire. There's a strange tension where I want to use pass keys because they are easy to use but also they are easy to lose, so I choose a KeePass synced over cloud and deal with a bit of a hassle by having to copy/paste my passwords.
        • 3mo ago
• varispeed 3mo ago
  I find it difficult to explain how to use password manager to non-IT person. Whatever I say, they say it is not secure. No amount of explanation will change their mind. They prefer to keep their passwords in their physical note book hidden in the safe (yes, they open the safe etc each time they need to log in somewhere when they get logged out). As someone with ADHD a passkey is something I can lose easily and I don't want my accounts to be tied to any specific device. What if I have to upgrade my laptop tomorrow because one I use got bricked? Sounds like an absolute nightmare. Password on the other hand I can remember for dozens of services, each very long.
  • jerf 3mo ago
    If the person you describe really is doing that for all their passwords, then they are correct. Their password store is more secure than a password manager by nearly every metric that counts. The one thing I would ding that approach on is recoverability, though. If a fire burns that down, it's gone.
  • cpburns2009 3mo ago
    I mean, they're right. I wouldn't trust any online password manager even if it was iCloud.
  • deleted 3mo ago
    [deleted]
  • vinay_ys 3mo ago
    They should buy a Yubikey (a physical key) and keep their passkeys resident on that. Then they can truly keep that physical key locked up in their safe. And it is truly safer than their physical notebook because they are safe from being tricked into entering their password in the wrong place.
    • NetMageSCW 3mo ago
      How do they tell their significant other how to logon to a shared account when they aren’t together? How do they use the Yubikey with their phone, laptop and tablet conveniently?
• ElijahLynn 3mo ago
  I only use pass keys by storing them in 1password. Then I don't have to worry about the whole "lose/broke/replace a device" thing, which is inevitable. Then just be really good about keeping your backup codes etc with 1pass solid.
• mullingitover 3mo ago
  You’d think a head of product at a tech company would embrace a “it’s literally impossible to have your password stolen if you use this” technology.
  • Tarq0n 3mo ago
    You can still get your session cookies stolen. If you have good password hygiene passkeys only protect you in extremely niche scenarios.
    • kbar13 3mo ago
      if you have good password hygiene is doing a lot of work here. such a large population of the world does not have this, credential stuffing is a huge class of vuln
• rsyring 3mo ago
  FWIW: I find passkeys to be a very simple and easy to use concept. Simple: it's like a password that I don't have to type in Easy to use: because I use 1Password and just have it installed on everything. On Android, it can be set as the default passkey provider so, even on mobile, I am using passkeys shared across devices. Is this "less secure" because I'm sharing the keys through 1Password. I suppose, at some level. But before that, I was simply sharing passwords through 1Password in the exact same way. So, I don't think my security posture has changed any. What has changed is the UX and IMO for the better. Now I don't have to generate/fill/copy-paste text strings for user names or passwords. 1Password knows what site I'm on and usually responds automatically when I'm in a passkey context. If I have more than one passkey available, because I have multiple accounts (for something like Google Workspace), it shows me options and I pick the one I want. Honestly, it's mostly a "just works" system and I like it a lot better than passwords. YMMV, of course.
  • Tarq0n 3mo ago
    OK now say you're on a work/library/friend's computer and you want to look up an account in 1password on your phone so you can type in the password. Passkeys don't support this very basic and common workflow. Meanwhile there's no real security benefit over password manager generated complex and not reused passwords.
    • vel0city 3mo ago
      If I'm on someone else's computer and I want to use a passkey on my phone, the computer will display a QR code. I scan the QR code with my phone, the phone signs the login request and posts it to the service's callback. Then I'm logged in on that new device. If my phone's camera is broken but both devices have bluetooth, it can do the handshake over bluetooth. If I'm on someone else's computer and I want to use a passkey on my authenticator on my keychain, I'll just plug it in and then tap the button on the authenticator. Meanwhile, if I logged in with the password and the account only has a password then they have a full copy of my entire authenticator to the account. With the passkey, once the session is invalidated the access is gone.
• inquirerGeneral 3mo ago
  [dead]
• usernametaken29 3mo ago
  I don’t understand this point at all. I think the author has himself confused with the average consumer. For the first time in a decade or so you can buy a PHYSICAL key and use it to sign into websites. I can explain this to any grandma out there. Likewise, I’m an Apple user. Once you’re in Apple universe passkeys are extremely easy. Tap your thumb on the scanner, done. Now we can put on the tinfoil hat and say how this fosters vendor lock in yadda yadda but the last thing I would say is that it has terrible user ergonomics. LOL
  • RHSeeger 3mo ago
    > Once you’re in Apple universe And there's your blocker. Being limited to only devices from a single vendor is horrible, and a firm no from a lot of people. > Now we can put on the tinfoil hat and say how this fosters vendor lock The fact that you call it a tinfoil hat type issue is just insane to me. Literally every person in my household has some apple devices and some other ones (android, windows, etc). And some of them have switched back and forth. Plus, the "ergonomics" of logging into a website on a random device to check something are awful.
    • usernametaken29 3mo ago
      I literally presented you with the solution in the sentence before. Buy a usb c dongle key. You pay 20 euros to NEVER have to remember a single password ever again. Seems like an ok trade off to me. Likewise you can register multiple passkeys for multiple devices, so long as you do it in sequence (first Apple, then Android) etc. Really it takes very little getting used to. Ever tried to fill out a crap password form which wants 7 special characters but no dashes but uppercase but not uppercase Y and so forth.
      • NetMageSCW 3mo ago
        How does that USB-C dongle work on my corporate computer that has USB blocked? How does it work with my iPhone or my iPad or my Kindle?
• schmichael 3mo ago
  I mostly love passkeys to be honest even though I use multiple browsers across multiple devices and OSes (iOS, Chromebook, Linux, macOS, Xbox, etc). Bitwarden’s support is (finally) pretty good. My problem is that I manage a lot of accounts for my family which makes passkeys a nightmare. If I’m out and a kid gets chucked into a login flow that happens to require a passkey, I can’t text a password and TOTP code to the adult with them. I know that’s terrible opsec but the reality is people share accounts and passkeys are designed to thwart that.
• ranger207 3mo ago
  The website for my HSA required me to set up a passkey last time I logged in. I set it up on my work laptop and my work password manager, which means I can now no longer access my account from my personal computer. This is fantastic, just what I wanted
  • cpburns2009 3mo ago
    This is exactly a scenario that worries me. Proponents of passkeys imply you can setup a bunch of passkeys. Evidently that's not always the case.
    • AlexandrB 3mo ago
      "But that's just a bad implementation, many other sites do it right!" And many sites block paste from password managers. Passkeys have so many ways to do them wrong that we're going to see all kinds of new and exciting failure modes that lock you out of your account in the future.
  • rdsubhas 3mo ago
    I think the irony here is missed.
  • nitwit005 3mo ago
    And then you call them up, and they allow you in after asking some identity questions, and you learn there's no real security.
  • sphars 3mo ago
    Are you also using HealthEquity for your HSA? I'm the same boat, they're forcing passkeys on me. I can still login using my employer's SSO but I've been putting off setting up the passkey until I have to.
    • ranger207 3mo ago
      yep
• herf 3mo ago
  I think portability is very confusing: they rolled out passkeys with no device portability (device-bound) and only recently added it (CXP). So for anyone with multiple devices it was a relative disaster - why should my Windows PC hold a device-bound passkey to anything? How do I login on Linux or macOS? Picking a password manager to do portability also means another kind of lockin, though maybe you can live with that kind if you really trust the company. Even so, the password managers all seem to be competing to have relaxed security, so that vault and account passwords are the same, or you are asked to type your master password into a webpage - surely we didn't replace per-site passwords with this?
• mnls 3mo ago
  I’ve read all the answers. I still don’t get it. I find it WAY more complicated than copy/paste or a browser extension that does that for me. I hope it won’t become mandatory. (I honestly doubt).
• yegle 3mo ago
  I don't know how to rationalize it: is passkey so good that even the banking apps start pushing it, or is it all a big conspiracy theory with a hidden agenda?
• junaru 3mo ago
  Passkeys were invented so hacked sites could brush off their leaks with "no credentials were leaked" and minimise any regulatory fines. This is the reason why its being pushed by the big players. Additionally this puts the same players in control of your logins - want to sync your passkeys? - enable "iCloud Keychain", or some other 'trust me bro' app that will 'securely store/sync your data' - no thank you. In perfect world users should be able to generate a certificate, upload it to a couple nfc capable ubikey like devices that blow a fuse afterwards preventing from additional writes/reads and use that to login to every app ever. You would buy such devices in packs of 3, upload same cert to all, hide the other, burry the third.
• ectoloph 3mo ago
  Passkeys are a mitigation against users being bad at password hygiene and phishing being a real issue to users. You can't phish a passkey, and you don't rely on the user providing you 'hunter2' on every site. As for vendor lock in? No. The specs are open. You can run the code on a microcontroller, or, you can keep it in your arm with something like the Vivokey Apex. Note that the FIDO2 for the Apex is an open source Javacard applet. The UX on the other hand is not great. If you have a password manager, your OS may prompt you which target to store the passkey with.
  • thyristan 3mo ago
    > As for vendor lock in? No. The specs are open. You can run the code on a microcontroller, or, you can keep it in your arm with something like the Vivokey Apex. Note that the FIDO2 for the Apex is an open source Javacard applet. That is not true. Passkeys support device attestation, enabling websites to lock you out if you don't use their approved devices. Which is happening with all the big platforms right now.
    • ivlad 3mo ago
      Neither Apple nor Google do key attestation for their cloud-synced keys. This > Which is happening with all the big platforms right now. Does not seem to be happening. Am I missing something?
• waffletower 3mo ago
  The cumbersome and poorly designed workflows surrounding passkeys are a significant hindrance to their adoption as well. It surprised me how bad they were when they emerged -- it was as if the UX was intentionally designed to kill passkey adoption.
• dang 3mo ago
  > I run a tech company and I have no idea what a passkey is and at this point I’m too afraid to ask I thought I was the only one!
  • jimmydoe 3mo ago
    lol it seems a good technical writing opportunity someone should take on. also appreciate your attitude, better than "I work in tech for xx year, i don't understand yy, so yy must be bad."
  • cswelin 3mo ago
    I find passkeys.. ill say interesting. I can have the most complex password and create a passkey, but a windows machine could allow a 4 pin digit to access the passkey.
• justSAYnooo 3mo ago
  Consumer passkeys are just an extension of the OMB Policy Memorandum M-19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access Management (dated May 21, 2019). It is ultimately part of anti terrorism efforts with regard to banking and fraud. Think of this as consumer computer version of the scene in the movie The Baader Meinhof Complex when the cops are discussing a proposal for electronic data processing. "According to a poll by the Allensbach Institute, one in four Germans under 30 sympathizes with the RAF. That's nearly 7 million people. That amounts to an enormous pool of sympathizers, which makes the search for perpetrators extremely difficult." It signals the end of publicly available general computing. This was always inevitable, the mob cannot be trusted with weapons of mass destruction. Computers = Guns
• WesolyKubeczek 3mo ago
  Passkeys do have drawbacks and tradeoffs, as has everything, but my god did I feel the energy of „lol I’m so bad at math” in that tweet and a lot of „lol smelly nerds” in replies.
• beaker52 3mo ago
  Passkeys are a political play aimed at bolstering government support. They’re the privacy sabotaging arm of Digital ID. They go hand in hand with “age” verification. It’s all the same play. Get your identity, get your access credentials, give it to the prying eyes.
• EPWN3D 3mo ago
  I don't know everything there is to know about passkeys or anything, but my reaction to most of these comments is "You're passing yourself off as someone who has relevant opinions about security, and you can't possibly imagine how these things work or how they're useful? Come the fuck on." Passkeys are basically session cookies that are signed by a secure element in one of your devices at the time you log in. That's it. They cannot be phished because there is no password to steal. If I had to guess, the basic flow is something like this: 1. When the passkey is created, the device's secure element coughs up a public key or something to the server representing itself as a trusted device 2. When a user logs in, the server issues a challenge (basically a random number) to the device and says "sign this with a private key that corresponds to one of the trusted public keys I have" 3. The secure element signs the challenge and sends it back 4. The server goes through its list of trusted device public keys until it finds one that verifies the challenge response. If it finds one, it logs you in. If it doesn't, you don't log in Step (1) is probably bootstrapped with a username/password and second factor like SMS 2FA, OTP, or email 2FA. Even if this isn't exactly how they work, it's a plausible implementation. Nothing about this requires vendor lock-in. The various secure elements that can produce passkeys come from many different places, so I'm sure sufficiently motivated open source people could create a firmware TPM that is certified for use with passkeys or something if they cared enough.
• gchamonlive 3mo ago
  I really don't get passkeys and how they are supposed to be safer. Currently I save all login tuples to Bitwarden and store OTP secrets onto Aegis. Could have been 1password and authy, it's irrelevant. The thing is, I only get pwned if both are compromised. Now with ubiquitous passkeys in Bitwarden if someone has access to my vault unencrypted it's already endgame.
• legitster 3mo ago
  I think about this a lot when using our corporate SSO tool. When I hit the button to log into Slack, there are like, 3 popups in succession - the last one ultimately asking for my fingerprint. Then when I give it, there is a flurry of web pages that get loaded and redirects that happen until finally Slack pops up again. There isn't any realistic world in which I check each window to make sure everything is happening right and I am not being MitM'd. I'm a fairly technical person, and I would be unable to perceive the difference between a really tight security environment and my computer being hijacked.
  • joshuamorton 3mo ago
    The point of passkeys is that you don't need to. Unlike passwords, your session cannot be hijacked because the thing that you give your fingerprint cryptographically verified the requester.
  • jerednel 3mo ago
    Aren’t passkeys intrinsically resistant to those attacks? With hardware security keys, the private key remains on the device, never crosses the network, and is cryptographically bound to the site being authenticated.
• ghostly_s 3mo ago
  We've all been through at least a couple rounds now of the security industry pressing us to change how we log in, ostensibly in our best interest: impractical complexity requirements, 2FA, "magic links," ridiculously short session expiry, whatever this bullshit is with the username and password on separate pages that make your password manager less convenient. The only observable outcome of each of these changes has been making these products less convenient for us to use. At this point I don't think I am alone in being knee-jerk opposed to any further "improvements." I have yet to see a website make a case for a passkey being more convenient than what it is replacing, so I will continue opting out of them as long as I am allowed to.
• dp-hackernews 3mo ago
  Why not use SQRL instead?
• sehw 3mo ago
  [dead]
• MBCook 3mo ago
  I will never understand how a small group of tech savvy people are heavily confused and against a simple and more secure system. You want anecdotes? Ok. I’ve had elderly adult relatives who aren’t good with their devices tell me unprompted they’re using them and like them when I mentioned the word out loud to myself using my phone around them. These are people who don’t know the difference between apps and the web. Who have 200 tabs open because they don’t know what tabs are so a new one just gets opened automatically all the time. Can’t tell some websites apart. Who change their passwords on every login to some sites because they can’t get sign in right. Yeah if you want to write them down or refuse to save passwords outside text files or demand they live on a security key on your keychain you’ll have a hard time. You’re being 0.0000001% of the user population. You’re not representative. They are a MASSIVE UX win. A MASSIVE security win. I’ve logged into my work computer with a passkey on my personal phone, no issue. It’s fine. They’re backed up locally. It’s fine. The biggest problem, which is getting better and somewhat a transition problem, is sites using terrible UX to trigger the workflow. Those that follow the suggestions or close to it are great. I love passkeys. I just don’t get the confusion.
  • TSiege 3mo ago
    I've yet to meet a non tech person irl who uses them. I went through the laborious process years ago setting my parents up with 1Password. They find passkeys very confusing addition. I have yet to see the massive UX win. If that were true I don't think we'd be having this conversation. Good UX becomes the natural state of things and we don't even notice. I've had trouble myself setting up passkeys correctly with my 1Password. This never happens with traditional passwords and 1Password
    • bombcar 3mo ago
      The win for passkeys is login with faceID. That people actually use.
      • readread 3mo ago
        My usernames and passwords auto-fill with faceID already. Lots of forms even (somehow?) auto-submit after that, don't even have to press a button.
• modeless 3mo ago
  I find Google Password Manager makes passkeys pretty easy to use. As long as you don't accidentally create a passkey some other way. Hopefully websites will adapt to the reality of how people use passkeys in practice and some of the UX weirdness around them will disappear over time. One annoying thing though is that while they recently added password sharing, they don't allow sharing passkeys. Basic passkey sharing would be nice, but it also seems possible to implement fancy sharing features that wouldn't be possible with password sharing. Things like sharing one time use passkeys or time limited passkeys or limited access passkeys or secure revocation of shared passkeys. I hope people are thinking about this.
  • cube00 3mo ago
    Considering Google's track record of locking people out of their accounts it'd be very risky to trust them with your password manager.
    • modeless 3mo ago
      This is very far from the top of the list of risks I should be concerned about. Basing your security decisions on the frequency with which you hear about something bad happening in the news is not a wise strategy. You have to consider that the user base of Google accounts is in the billions.
      • cube00 3mo ago
        > You have to consider that the user base of Google accounts is in the billions. Basing your security decisions on "it'll never happen to me" because there are billions of other users who will get burnt first is not a wise strategy either. Why take the chance when there are so many other alternatives that let you own your vault or at least companies that still have some semblance of a support team. Losing a decade of my Google Maps Timeline data even with backups enabled made me realise I may not be lucky enough to win the lottery but I am lucky enough for Google to pick little old me, hidden in the billions, to lose my data.
• epistasis 3mo ago
  I think the problem was that there wasn't a "Best Practices" way of using them when they were launched, which really prevented describing them in a consumer-friendly way. And web site implementors couldn't follow that golden path, or describe the golden path, so there's fragmentation in usage and meanings and practices, making it far more confusing. I love passkeys, I want to eliminate any and all password-based logins and switch entirely to passkeys. It's such a better experience, it's a "physical" key that can be backed up to multiple devices, and thinking of it like a key for a physical lock really gets at the core of its capabilities. But locks can be used in many many ways! Maybe you need to open the lock and still tell the guard a password, which is weird, but how most websites still operate.
• christina97 3mo ago
  It’s quite the opposite. Passkeys are phenomenal for a lot of consumers. Based on this thread, it’s the engineers who understand authentication in the first place and have their own system (eg password manager) that are confused. Consider a user in the Apple ecosystem: you are already conditioned to just do Touch ID or Face ID when asked. I was on Amazon the other day, it prompted randomly for “want to set up a passkey to sign in easier”? I set it up and now I can easily sign in to Amazon on my mac or iphone with zero friction. For the normal consumer this is not a replacement for “dig out my password manager and copy-paste/autofill my password”, it’s a replacement for “oh it’s prompting for my password again” -> proceed to type your shared password for all sites.
  • selicos 3mo ago
    A password manager let's me use my service specific credential from any device, securely and decentralized. Passkeys lock into a specific device and seem easy until you need to use another device. But instead of being a credential you own and control, across what could even be a local password manager, it's one password to everything. Maybe it is more secure than a regular password in some cases but it largely seems like a worse fix than existing tools for a problem that has better solutions.
    • eigenspace 3mo ago
      Passkeys do *not* do that. I use 1Password to manage my passkeys and they are all synced across all my authenticated devices where I installed 1Password.
      • preisschild 3mo ago
        You can choose either if your password manager supporte Passkeys
        • eigenspace 3mo ago
          Of course. I was just pointing out that their claim about the lack of portability across devices was untrue.
• TechRemarker 3mo ago
  Yes, a bit of a mess. As the only practical way for most to use is with a password manager. So essentially, all your accounts still have a real password, just you enter that into your password manager app. So if your device is every compromised and someone has your master password then you are screwed. And of course, passkeys on most all sites don't really improve security since someone can just choose to login with user/pass instead since presumably very few sites allow you to have just passkey. Also if you use a password manager you may get locked into using that platform. Or ideally using a third party one but then having to pay a subscription, or using an open source option that is not ideal for the average person. If one uses a passkey as intended and without a password manager and the site truly only supports logging in via your passkey, for all the touted benefits of passkeys, that would be a nightmare if a person loses access to their device, etc.
• rglover 3mo ago
  This is mostly a complaint about bad copy/explainers in Google's UI. Passkeys, properly implemented, can be perfectly consumer friendly (e.g., Apple Touch ID is delightful).
• baking 3mo ago
  I find it annoying that gmail has simply decided that my unlocked phone is more secure than my computer.
• lrvick 3mo ago
  At Caution we -exclusively- allow passkeys. The entire database is user ids and public keys. If it leaks, it would only be mildly annoying. If you are confused about digital passkeys, you can use a physical yubikey or nitrokey and tap it when it blinks. You can treat them like a credit card or house keys. Asking people to keep up with and remember passwords is and always has been the thing that was invented with zero understanding of the consumer brain.
  • deleted 3mo ago
    [deleted]
  • tavavex 3mo ago
    > -exclusively- allow passkeys Isn't that just a euphemism for "we mandate passkeys"? Saying 'exclusively allow' draws the reader's attention to the positive (allowing!) while de-emphasizing what's not permitted. Regardless, I think it's a lot less of an issue for services exclusively oriented at people in tech instead of just everyone. Even then, there is a barrier to adoption besides just understanding it, which is relying on new software or owning a piece of hardware. It's a lot messier, while text remains universal and has no dependencies.
    • lrvick 3mo ago
      Instead of asking users to create another password, they just specify a username, tap, and they have an account. Good security and UX do not need to be at odds.
• luciana1u 3mo ago
  [flagged]
• c7b 3mo ago
  UX is not the problem with Passkeys. Passkeys were designed to align with the interests of BigTech, who are bent on stopping the abomination that is general computing devices in the hands of consumers and forcing them into their walled gardens. The language that is used for taking away freedoms is the same as always, safety. Where we ended up with Passkeys is an operating model that is suitable for corporate devices, i.e. the user can only do what the owners of the device allow them to. Suboptimal UX is downstream from that problem.
  • jeroenhd 3mo ago
    Passkeys work just fine with Bitwarden, LastPass, KeepassXC, physical keys, several software tokens, and TPM storage. So far only Nintendo has been absolute assholes about requiring specific passkeys, but that's maybe the least assholish thing Nintendo has done.
• 827a 3mo ago
  Passkeys are so, so, so bad. One of the worst things our industry invented. The sooner sites start leaving them on the wayside and just go back to TOTP, SMS, and Email codes/links, the better. These work. We solved auth. Its fine.
• et1337 3mo ago
  Throwing my hat in the ring, I think passkeys were also invented by engineers with zero understanding of the average developer: https://etodd.io/2026/04/06/passkeys-are-too-hard/ https://etodd.io/2026/04/06/passkeys-are-too-hard/
• sergiotapia 3mo ago
  One of the worst technologies I've had the misfortune of being forced to use honestly. It's always confusing and always breaking or not working as I expect across my devices?
• deaux 3mo ago
  This comment section is the best example of all time of the arrogance of Big Tech and its employees. Please try to take a second thinking outside of your bubble before commenting ridiculous stuff. Yes, as a wealthy American, you "live in the Apple ecosystem". 99% of the world doesn't. And guess what, they're affected by passkeys all the same. They use a Windows laptop, and either an Android phone or iPhone. A lot of people even have an Android phone and an iPad. And no laptop at all. But at work or school they have to use Windows. It's quite simple. Besides people "living in a single ecosystem" (discussed above, this is almost nobody), passkeys are only viable (i.e. not very painful to use) if you use a dedicated cross-platform password manager. Yet people who use those - which too is a globally negligible percentage - are exactly the people who tend to have near nothing to gain from passkeys, and only to lose. The majority of them is tech-savvy and they use auto-generated unique passwords. In that scenario, the minuscule improvement in security is meaningless and not worth it. Ironically, this comment section shows exactly why passkeys are a shit show. Half the people here are exactly those who are coming up with this shit in their FAANG jobs, happily part of the global 1% (of which their tech-illiterate grandma too is part of), and they have no idea or care in the world for the remaining 99%. Unless of course this was simply a land grab for lock-in, which is about as likely.
• maples37 3mo ago
  I'd like to try passkeys out. I actually tried again on Amazon in response to reading the comments here. But it just.... doesn't work? I'm on a laptop running Ubuntu, I use Firefox as my browser, and I use 1Password as my password manager. I have both the browser extension and native Linux application installed, and they sync/communicate with each other (so if I unlock the native Linux app, the browser extension also unlocks). When I open my Amazon.com item in 1Password, it has a helpful link to https://passkeys.directory/details/amazon https://passkeys.directory/details/amazon which tells you clearly, step-by-step how to set up a passkey. Great! I love clear directions. But when I get to the step when I click the "Set Up" passkey, Firefox gives me an address bar pop-up saying "Touch your security to continue with www.amazon.com". Huh? I don't have a security key. My laptop does have a fingerprint reader, which I use to unlock my screensaver (and it's integrated with some KDE keyring thing), so I tried putting my finger on that. Nothing. I opened the 1Password extension. Nothing there, just normal view of my login info. I opened the 1Password native application. Nothing there either. Maybe it's a Firefox issue, or a Linux issue? So I tried setting it up on my phone (running GrapheneOS and their Chromium-based browser), which has the 1Password app installed. I logged in, and this time got far enough that 1Password brought up a prompt asking "Do you want to save this passkey?" I tapped Yes, and it then immediately told me "Unable to save passkey: For security reasons, 1Password did not save this passkey. The associated URL for this passkey does not match the selected app." So... does that mean 1Password is refusing to touch the passkey because it didn't come from the com.google.chrome Android application? This whole experience has re-affirmed my skepticism of passkeys in practice. I think it would be awesome to have public/private key security on my online accounts. I think it would be great if I could log in without having to copy/paste passwords (when autofill doesn't work, or for TOTP codes). But I have zero confidence that this opaque stream of bytes will actually work to get me logged in to my account. When the 1Password input field detection fails, I sigh, copy/paste my username and password, and then forget about the mild inconvenience after about 30 seconds. I don't even want to think about what would happen to an account if the only way to log in to an account was via passkeys.
• jbombadil 3mo ago
  Another noteworthy annoyance is the increasing number of services that try to aggressively push you towards passkeys, without you ever asking. Every other time I open the Costco app (needed to walk in to the store, since I don't carry my card and they refuse to provide Apple Wallet integration) I get asked to switch to passkey, without a way of saying "don't ask me again". If you're in any position to determine this in your company/software, please stop this pattern. Give users the option to say "stop asking me about passkeys".
• tossitawayplz 3mo ago
  The first time I got asked by a site if I wanted to use a passkey I immediately googled what they were and... never really found the answer, not in the 5mins I devoted to being distracting from my task at hand anyway. "magic fairy dust to login to apps." is the most accurate description I've seen. Unlike a password or a TOTP token, I know how those work, I know its my responsibility to keep track of them. If my passkey is on my phone what happens if I lose my phone? Do I need a unique passkey per device? How do I rotate them? What if a device gets stolen? I'm so glad I'm not alone in thinking these are so poorly explained.
  • preisschild 3mo ago
    You can use both hardware bound passkeys (where you may not even be able to read the secret so you probably would want to add multiple device passkeys to a site) or shared passkeys (where the private key can be synced through something like a cloud service across your devices, see Bitwarden, iCloud)
    • junaru 3mo ago
      > hardware based Sounds good until you realise theres no way to transfer/back them up and you are limited to 100 [1] (previously 25?). Personally my password manager has almost 4x the entries so hardware passkey solutions are a joke leaving users with single option - upload their keychains to ms/apple/etc clouds where they can be requested by any gov under the sun for x reasons. [1] https://support.yubico.com/s/article/How-many-accounts-can-I-register-my-YubiKey-with https://support.yubico.com/s/article/How-many-accounts-can-I...
      • preisschild 3mo ago
        That limit is only for a certain Yubikey model, not for all hardware-based fido2 authenticators. > upload their keychains to ms/apple/etc clouds where they can be requested by any gov under the sun for x reasons. If a HSM module (TPM, Apple/Android Secure Enclave) is used the private key is impossible to extract (and upload to a cloud) anyways
• otikik 3mo ago
  Ah! Like Pgp
• stalfosknight 3mo ago
  I do not understand all of the drama surrounding passkeys. They work flawlessly for me on all my devices. Maybe that’s because I’m all-in on Apple devices, but I have yet to have a single problem with passkeys.
• joshstrange 3mo ago
  My biggest issues with Passkeys is how inconsistently they are implemented and how opaque they attempt to be. I understand SSH keys, I've been using them for decades, I know where they live, I know how to secure them. Passkeys are murky as fuck. Is your PW manager supported? Do they sync? Where are they stored? How can I move to another PW manager if I want to in the future? Can I have more than 1 passkey per site? And the list goes on. I _know_ some of you out there can answer some/all of the questions above but it's mostly on a per-site basis. Passkeys take too much of the control out of my hands and I don't like that. Even more than that, I hate how they are trying to be pushed on me at every turn. Login -> Want to save a passkey (but they never call it that, they use some other confusing euphemism)? I click "No" and then it proceeds to pop 1Password's UI, then I dismiss that and it opens Chrome's passkey save UI, I dismiss that, and then it opens the OS's passkey UI. It's incredibly disrespectful and unclear. I never use anything but 1Password but somehow everyone (OS and Browser) try to reach their grubby hands in. This is what scares me, I don't like having to be on high-alert to not accidentally save a passkey in Chrome or Safari and not realize until I'm on a different device and notice it's not in 1Password. Lastly I trust the developers implementing passkeys... none, I trust them none, zero, zilch. I don't trust them to pick the right defaults, I don't trust their recovery options, and I know they will always pick the configuration that benefits them and not me. No, for now I'll stick with my as-long-as-you-let-me-make-my-password random passwords which I never copy/paste into random website and be perfectly safe, thank you.
  • xg15 3mo ago
    > I _know_ some of you out there can answer some/all of the questions above but it's mostly on a per-site basis. Yeah, there is a difference between something that is difficult to explain but ultimately explainable, and something where the correct answer is "it depends"...
• apparent 3mo ago
  I don't use passkeys because I can't tell if they're a one-way door. If I use it once, can I still use passwords to log in in the future? I also don't understand how the system works when things go wrong (someone hacks your account, etc.). I don't even understand all the ways things could go wrong with passkeys. Seeing the comments here makes me realize I'm not stupid or ignorant for not understanding these things. Some people do understand them much better than me, but there is no universal answer that emerges after sufficient study. I will continue to stay away from passkeys.
• johngalt 3mo ago
  If you want a consistent, and seamless authentication experience, then one party has to own that experience. Go federation/SSO. Sign into everything with microsoft, or google as your identity provider, and live with the privacy implications. Passkeys are great, and they take a significant amount of work away from the user, and make them much less prone to phishing attacks while also not turning their entire online identity into the property of google. I've had much more luck with onboarding non-technical people into a yubikey vs a password manager. Platform authenticators tend to trip people up. However, the process of adding a new key is getting much more consistent, and legible to people over time, and things will settle on platform authenticators rather than external physical keys for most use cases.
• AJRF 3mo ago
  I keep seeing people working on Passkeys get real defensive when told they don't make sense to people. I've worked in tech 12+ years and I _hate_ when a Passkey prompt comes up, its only ever slowed me down. But the devs who work on them are quite rabid, and keep dismissing real criticism of their implementation.
• TitaRusell 3mo ago
  Security people don't care about usability. They genuinely think we are all CIA field agents. Look I remember my PIN everything else is in Firefox password manager.
  • JohnFen 3mo ago
    > Security people don't care about usability. I spent a long time working in the network security field, and you speak truth. The perverse thing about it is that security people should care a lot about usability. If the scheme isn't usable enough, people will figure out how to bypass it or aspects of it. The technically weaker security scheme that everybody accepts is more secure than the technically stronger security scheme that everybody tries to bypass.
• Dwedit 3mo ago
  I just stick with TOTP.
• ChoGGi 3mo ago
  Passkeys? That shit that's not a password or a crypto key that I never use?
• brachkow 3mo ago
  Passkeys work well when you have password managers with multi-device sync. While it is indeed trivial to get one, consumers don't like password managers in first place. And it is very hard to make person use password manager, instead of his john1988 type of password
• f30e3dfed1c9 3mo ago
  My take: (1) I've had passwords handled pretty well for a long time now: same password manager for something like 15 years; (2) companies are pushing pretty hard to get me to use passkeys instead. From (2) I assume that the companies see benefits to themselves. I don't care about benefits to them. I don't see much in the way of benefits to me, so I'm not changing anything if I don't have to. I'll admit to not having looked into passkeys all that much. Someday, I might. But for the time being, I don't see much point. I imagine that eventually I'll be more or less forced to deal with passkeys in at least some contexts. Will leave that for later. For now, it's all a big "no thanks" from me.
• randomblock1 3mo ago
  Stop thinking of them as alternatives to passwords. That is something they do, incidentally. Really, they are an alternative to normal TOTP 2FA (and shudders SMS 2FA). Those were already dependent on an app on a single device, or a password manager. And now, you can have the security of that, automatically used with biometrics. It is only because they are so secure, due to being a cryptographic key, that they can replace passwords. They really should come up with a way to transfer them across devices/password managers though.
• techteach00 3mo ago
  I like the authenticator option. I literally cannot understand if that's the same thing as passkeys.
• thescriptkiddie 3mo ago
  > Imagine you’re a boomer and you just figured out how to store your passwords i'm gonna stop you right there
• tonymet 3mo ago
  The fundamental blind spot engineers have had with every authentication protocol for 30 years is forgetting that trust must be mutual. The lone exception has been phishing prevention with user-selected avatars, and that didn't last long. Every advancement in "security" has assumed the service needs to more strictly identify the customer, without caring about the customer's trust for the service, or experience with performing the identification ritual. So when your bank asks you for a code or your mom's maiden name, they never offer anything to verify they are who they say they are. whenever I ask they say "of course we're from chase, we just called you", without realizing how absurd that is. Now Passkeys suffer an even worse dilemma. Now the customer has 4 dimensions of tools to record & use in order to log in. Did I use email, google, facebook, apple ID to log in? Did I save this code via phone, text, authenticator app (which one, there are multiple incompatible ones)? Did I use a passkey ? where is that passkey located? my phone, my browser storage, my authentication extension. We started with a single dimension of email + password to log in. Now it's an entire decision tree that has to be recorded. How do you even record this? disqus : credential = email, password = "see bitwarden", 2fa = microsoft authenticator, passkey = "on iphone in icloud" viator: credential = google sso, password = same, 2fa = symantec, passkey = "edge on windows 11 laptop in office" This is absolutely absurd! I thought engineers were tested for scaling during the interview process. This protocol doesn't even scale to a single site.
• qurren 3mo ago
  Reminds me of Yishan Wong's description of OpenID's failure: https://www.quora.com/What%E2%80%99s-wrong-with-OpenID-Why-hasn%E2%80%99t-it-taken-over-the-world?top_ans=24870 https://www.quora.com/What%E2%80%99s-wrong-with-OpenID-Why-h...
• vaylian 3mo ago
  Obligatory https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/ https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt... It's a shame, because WebAuthn is really great technology. But tech companies are botching the rollout.
• FireInsight 3mo ago
  Okay, I'm a tech nerd I admit it, but for my personal authentication life I find passkeys to make sense. All my passwords and SSH key are already in Bitwarden. When a site starts supporting passkeys, I add that to Bitwarden as well. Now, instead of logging in by auto-filling my username and password, I just press the passkey login button (that hopefully exists) and click on the Bitwarden popup to select the account. It's less button presses for me, and I cannot be phished, nor can my passkeys be leaked on the dark web. All thanks to some fancy cryptography. Okay, sure, if someone steals my Bitwarden vault by snatching my laptop while it's unlocked or something, I end up pretty screwed. That security aspect did not change, so I still use TOTP for all important services. Also, I've made one invite-only web app where single-use invite codes and passkeys are the only ways to log in. It was not too hard, it was fun, actually. And I get the peace of mind that account sharing is pretty much impossible were a bad actor able to get their hands on an invite, as is hacking other people's accounts. (Okay, I concede that I've had to help multiple people who find passkeys confusing as a result of this whimsical decision, and that it just might be that nobody is using my web app for real. So I'm just speaking from nerd privilege here... But it works well, trust me!!)
  • ab71e5 3mo ago
    So what do you use for TOTP? Also bitwarden?
    • FireInsight 3mo ago
      Ente Auth. Obviously not Bitwarden, I don't even know why that's an option. Having your 1st and 2nd factors in the same place seems foolish. I used to use Aegis, which might technically be a bit more secure, but Ente is also on the PrivacyGuides recommendations list (https://www.privacyguides.org/en/multi-factor-authentication/#ente-auth https://www.privacyguides.org/en/multi-factor-authentication...), so I opted to use it for more peace of mind in case my phone breaks.
  • xg15 3mo ago
    > Also, I've made one invite-only web app where single-use invite codes and passkeys are the only ways to log in. It was not too hard, it was fun, actually. And I get the peace of mind that account sharing is pretty much impossible were a bad actor able to get their hands on an invite, as is hacking other people's accounts. It also makes access to the app maximally unrecoverable if someone loses access to the passkey...
• 66fm472tjy7 3mo ago
  It seems to me like those who like passkeys/consider them simple are those who entrust all their credentials to proprietary cloud software vendors that sync them to all their devices. Those of us who are not comfortable with that and want to keep our credentials offline and sync/backup them ourselves have questions about how the registration/backup/sharing flows work exactly. I see this as part of a trend together with remote attestation, age verification, CSAM scanning, restricting sideloading, etc that will lead to most interactions over the internet only being allowed if big tech and/or government can verify the participants, the contents, and the hardware and software used. Even among techies, many support these developments, so it is just a matter of time before we have no choice but to join the former group.
  • epistasis 3mo ago
    I do love the cloud version of passkeys, but I also have a backup YubiKey. I could do two backup YubiKeys, drop the cloud, and keep one YubiKey in a safe deposit box and one elsewhere, but I haven't had much reason to yet. A passkey doesn't give up anything compared to a password, and is in fact much much easier to handle, IMHO. I have kept all of my private SSH keys in secure hardware for a decade, so perhaps I'm more used to carrying a physical key than others, but IMHO it's all better, all around. We should eliminate passwords, and that has nothing to do with remote attestation, age verification, or anything like that. For 20 years, I've only known two to three passwords at any time, and those are login passwords for separate boxes or corporate/home accounts. Beyond that, hardware access should solve everything, and I shouldn't have to type any passwords anywhere. Every account needs granular credentials, not shared credentials, but no user should have to memorize passwords beyond one per work domain.
    • 66fm472tjy7 3mo ago
      > I do love the cloud version of passkeys, but I also have a backup YubiKey How does this work, exactly? Does you cloud password/key manager allow syncing to the YubiKey? Or do you register a second passkey that you store on the YubiKey whenever you create a passkey? If it is the latter, do all services that allow passkey authentication also allow registering multiple passkeys? How many? > could do two backup YubiKeys [...] keep one YubiKey in a safe deposit box If you register a new passkey on the primary, do you then have to take the backup YubiKey out of the safe deposit box to put it on it as well? I haven't seen this kind of question answered when sites prompt me to use passkeys instead of passwords.
• allthetime 3mo ago
  I use Apple based passkeys to log into everything I can now. I have given it virtually no thought since all my relevant accounts and rolled out support. My non-technical close friends and family (consumer brains) have also done the same. I imagine it is a different case for non-Apple device users, but in the Apple case, passkeys are zero friction and truly life-enhancing for anyone who logs into things
• Slackwise 3mo ago
  I recently logged into my CVS.com account after not touching it for years, and I couldn't find the password reset..... turns out they no longer use passwords at all; only Passkeys and tokens via email/SMS. Aside from email accounts potentially being compromised or SMS interception, this is honestly the way all sites should be going now. But more seriously, there should be a way to use only Passkeys with a backup identification method in case you lose your Passkey. The new threat? Browser password managers are insecure. Anyone can sit down at my machine if it's unlocked and Passkey their way into any of my accounts. What good is that? Why doesn't Chrome use my Google account password before allowing auto-fill/login? (Obviously I don't use Chrome's password manager, but it's a real concern for everyone else.)
  • epistasis 3mo ago
    I agree with your anti-password take, 100%. But all my passkeys have biometrics attached to them, mostly so that I know that they are being used, when they are being used. Silent release of authentication credentials is a scary security mode. A YubiKey with a press mechanism is enough, I just happened to buy the biometric version. Or use the biometric lock on iCloud Keychain passkeys.
    • Slackwise 3mo ago
      I was trying to say, nobody should be using Passkeys via browsers because they all fail to secure them. You need a password manager of some sort. But this is also true of passwords. My ultimate point was, passwords are a burden because unless you use a password manager and unique passwords for every single account, then passwords are strictly a burden. The average user doesn't use a password manager outside of the junk in Chrome, so... they're really just creating a security disaster for themselves. So, therefore: passwords shouldn't exist, and you should create sessions via email links/tokens. Then also offer Passkeys as a faster login.
• eigencoder 3mo ago
  I hate passkeys so much. They're so confusingly implemented.
• pronik 3mo ago
  I'm probably not the only one to have a deep distrust in passkeys. I've deep-dived in to what they are and how they work and I think I can accept them on their technical merits, but I can't shake the feeling that the adoption has been way faster than we've been used to, for whatever reason. I think it was half a year between the settling down of the specification to being bombarded by a "Get a passkey!" from every goddamn website on this earth. I don't really see what the conspiracy to move the whole world to passkeys would be here, but it certainly feels like there is one. I think my problem with passkeys is the same as with almost everything today: if I lose my phone, my digital life will be almost as difficult to recover as if I lost my ID and my birth certificate at the same time. Yes, that's why you don't create one passkey (phone), but maybe two or three (browsers), but that's mental load on myself -- I don't even try to explain that stuff to my parents, even something as (somewhat) easy to use as a password manager is out of their scope. Add TOTP and passkeys on top of that and you've got perfect security that no-one in their right minds is using. No idea how to resolve the problem, but it's not by shoving a solution down our throats with a vengeance.
• unbolted3032 3mo ago
  The thing that gets me is that to even use a Passkey I need a browser addon that syncs my entire password vault into browser memory, the same memory that all the adtech JS runs! No thank you! What a ridiculous system. I will continue copying and pasting passwords myself out of KeePassXC.
• mmmpetrichor 3mo ago
  My Health savings account provider is trying to force the use of passkeys. I assumed it was a cynical attempt to force the use of their app, which I never needed or wanted, but now seemingly will be required to use.
• VCFundedGenYer 3mo ago
  Passkeys bother me because they depend on the availability of another device. That just won't cut it for a lot of folks, especially people that are prone to losing devices. It's also annoying to have to deal with the 50,000 places that are fighting to keep your passkeys, leading to fragmentation and uncertainty as to where these credentials are stored. Haphazardly implementing passkeys also has big problems - one vendor I use implemented them rather badly and randomly one day, completely removing the previously-solid password/MFA setup they had, replacing it with a "you are required to confirm on your phone with no other alternative" passkey, which was really annoying. I don't like my logins messed with. Passwords/MFA, while not perfect, work very well for most people, myself included. Passkeys still feel like they are in a very immature state.
• deleted 3mo ago
  [deleted]
• ChrisMarshallNY 3mo ago
  Have to agree. They are, indeed, very safe and effective, but no user that usually picks "fuckyouhacker" as a password, is gonna use them, given a choice.
• t1234s 3mo ago
  The idea of passkeys is good (similar to key pairs you use with ssh if I understand correctly) but how and where they get stored is the problem. Especially if you use multiple computers / devices. Something like a yubikey makes sense for this until you lose it and your fucked. From what I understand you cant clone a yubi key to keep a backup somewhere safe. In the end the solution will be some sort of cloud based storage for these keys where the NSA can have easy access.
• upcoming-sesame 3mo ago
  I love passkeys. The only confusion I have with them is around when they are used just as a 2fa (most cases) and when they can replace passwords completely (just one click and you're in) Unfortunately very few services offer #2 not sure why
• boarsofcanada 3mo ago
  I’m absolutely floored by some of what I am reading here. Six months before passkeys rolled out there were numerous succinct consumer-friendly write-ups. I sent at least one of these to several non-technical people I knew and they had no problem understanding the benefit and moving to using them where available once they started rolling out.
  • eviks 3mo ago
    Would be helpful if you provided at least 1 example
    • boarsofcanada 3mo ago
      https://www.aarp.org/personal-technology/passkeys-future/ https://www.aarp.org/personal-technology/passkeys-future/
      • bigyabai 3mo ago
        I pity the grandpa that has to read all of this and determine if Passkeys are right for them: > According to Google, you’ll need the following to sign in with a passkey: > A laptop or desktop that runs Windows 10, macOS Ventura or ChromeOS 109 or later > A mobile device that runs iOS 16 or Android 9 or later > A hardware security key that supports the FIDO2 protocol > Google adds that your computer or mobile device will also need a supported browser, including Chrome 109, Edge 109 or Safari 16 or later. > [...] Do not create a passkey for a shared device if you don’t want other users to access your account, Google warns. So much information, so many warnings. I feel nostalgic for passwords just sifting through this stuff.
      • eviks 3mo ago
        If you don't understand how an article wasting more words on describing corporate alliances than on how things work, and the latter is needlessly repetitive while also wrong, you are likely to stay on that floor of befuddlement for a long time
• gblargg 3mo ago
  I don't care how it works, but as long as it requires me to physically have some device to log in (and doesn't have a backup, like emailing me or calling me), it puts security in my hands.
• sauercrowd 3mo ago
  I used to think this but once you treat them as another path to get in they become really useful. Yes, you still have your 2fa and password, but you create a fast path in addition to it when you get in. It became even more useful once I stopped insisting they have to go into 1password
• nottorp 3mo ago
  > Passkeys were invented by security engineers with zero understanding of the consumer brain. ... of the human brain.
• flumpcakes 3mo ago
  I can't believe these comments - passkeys are pretty easy to understand and most platforms allow you to add multiple. Not enough for truly one-passkey-per-device, but if you use a password manager that syncs passkeys, or hardware passkeys it's fine - it's easy, quick, and more secure than any password can ever be (mitm resistant). I think the confusion with passkeys comes from that fact that everyone wants to own you so you have to be mindful if this passkey is being stored on the OS, the browser, sync'd between devices through google or apple, etc.
  • bigyabai 3mo ago
    I have zero passkeys to my name. It's just not covering any serious attack surface in my life or anyone that I can think of. If technically-motivated individuals can't be assed to switch away from passwords, then imagine how normies feel. I fully understand why most people choose passwords instead.
• maxgashkov 3mo ago
  I do have love/hate relationship with passkeys. Love: I truly have redundancy for most critical accounts, meaning I have 4 separate passkeys assigned, each not tied to one SPoF -- one in 1Password, one in iCloud -- both synced everywhere I logged in and if I'm ever banned/locked out of both of them somehow, I still have two additional USB keys (token2) as a fallback. Hate: every fucking service seems to have different idea on how to implement them, whether to allow them as the only factor, how many to allow to have in any particular account. On a separate note, for the hw side of things I'm kinda sad that old yubikey nano approach when the token is just sitting flush on the side of the laptop and I tap it occasionally is just dead, because every vendor moved to mandatory PIN to store passkeys on hardware tokens. I get the rationale but still.
• timmyc123 3mo ago
  Still taking feedback and questions for an upcoming consumer centric "What's a passkey?" site. https://forms.gle/wmaydkzmUp2eKfJG7 https://forms.gle/wmaydkzmUp2eKfJG7 Original post: https://news.ycombinator.com/item?id=47852849 https://news.ycombinator.com/item?id=47852849
• rustcleaner 3mo ago
  I don't need your stinkin' passkeys! I have KeePassXC on Qubes OS and KeePassDX on GrapheneOS. No I will not buy into your proprietary cloud prison, with FISA/NSA/court-order backdoor access to my data! No I will not rely on KeePassXC/DX for storing them, when I can wake up tomorrow and find the paternalistic tyrants who maintain the provider attestation/trust lists have blacklisted my KeePasses! TOTP/HOTP-everywhere is a much better idea than freakin' passkeys! We need a law that forces any service provider that requires (hell, even offers) SMS 2FA to also offer TOTP or HOTP as additional options to substitute for SMS! Whoever makes these boneheaded decisions (SMS 2FA only, hardware/cloud passkeys only) should not be allowed around engineering authentication for the public! Yeah, I went there! Back off! Get off your high horses and eat some humble pie!
• tgsovlerkhgsel 3mo ago
  Passkeys are a nightmare for techies that want to understand and manage their stuff. They were optimized for people who neither can nor want to understand, they just press the button that the screen tells them to press and live inside someone's closed ecosystem. For that use case, they work fine, and they create enormous lock-in, because now moving out of that ecosystem breaks everything. One might argue that that means they're perfectly engineered for what they are meant to do...
• drsalt 3mo ago
  i don't understand passkey - there's a website forces me to use it. i have to remember some six digit number to unlock it. whereas before, i could just click to autofill my password.
• Natalia724 3mo ago
  [flagged]
• szigand 3mo ago
  I always think back to my grandmother in the '90s. When her old black-and-white TV stopped working, we bought her a new color TV with a remote control. A few weeks later I saw that she had taped over the buttons, leaving only the power button exposed so she wouldn't mess anything up accidentally. I've been programming for 40 years, but even I struggle to grasp sometimes what goes where and why - so what is someone with zero coding background supposed to make of it? I sometimes talk about tech stuff - internet, cookies, security - with my hairdresser, and she just listens with wide eyes. I'm convinced most people have no idea what they're actually doing with their devices, and that's on us developers. It's our job to tailor systems to users by serving them with our knowledge, not confusing them with it. I doubt anyone wants to mess with the ECU settings on their car's dashboard - they just want to press the gas pedal, because that actually makes sense.
• throwawayk7h 3mo ago
  I dislike passkeys because they support remote attestation. It's my key -- why does the website care what app I'm using to host it or if I'm allowed to copy it? Or what operating system I'm using, for that matter. Because of this, I will not use passkeys. It's a slippery slope. Once we're all on passkeys, website devs won't resist enabling the remote attestation bit, locking out linux users.
  • Gander5739 3mo ago
    Passkeys aren't tied to any specific app or operating system.
• xg15 3mo ago
  Another point I haven't seen discussed here yet: It's nice that Google or Apple or 1Password or whoever else can sync your passkeys to all your devices, but what happens if they ban you? It can happen for sometimes ridiculous reasons, as demonstrated by Google. Does that mean you instantly lose access to all passkeys as well?
• PennRobotics 3mo ago
  One of the dumbest auth workflows I experienced in recent times: My partner texts me, "Mom lost her phone somewhere in the zoo." I go to log into Google Find My Phone with her password. It sends a mandatory verification SMS... to the lost phone. (It was eventually found, no thanks to Alphabet.) I would be much more comfortable with passkeys and 2FA if there was almost always the option to log in with just a password as long as an email gets sent to me (perhaps relevant that I have paid email, not Gmail) stating I logged in to site XYZ without 2FA. Not a "click button to confirm you want to log in" email, just a "hey this happened" email containing a Shaggy link, "It wasn't me." Bonus points if that site's account settings (e.g. 2FA) cannot be changed as long as I'm only logged in with a password[+]. The odds of me not having a device to receive the email at the same time someone guesses my password and causes rapid catastrophic damage[++]... I would need to be specifically targeted or unlucky beyond the normal expectations of unluckiness. (Much more likely: I'd occasionally discover which sites have bad security practices or that I need to be more resistant to social engineering or more careful in public spaces; guessing a long generated password in just a few attempts when the password is never shown on the screen would be impressive!) I've lost count of the number of times I need to enter a password using a unknown machine, log into my Bitwarden server, copy/paste the necessary password, ... "okay now you'll see a popup on your Totally Breakable Losable Connectivity-Unreliable Android phone" ----- [+]: account info can't be changed w/ only password... unless I provide some verification ranging from personally appearing at an office with ID for money-related accounts to verifying ownership from a backup email address for low-stakes accounts like bulletin boards. [++]: short of guessing my Bitwarden master password, which is one of the carveouts for "always always 2FA" and "several alternative, secure backup login methods, at least one which does not require technology"
• TheSpacerr 3mo ago
  [dead]
• thecopy 3mo ago
  1. Use Passkey from 1Password 2. Profit
• zeratax 3mo ago
  I kind of get what everyone here is saying, but in my experience i love passkeys and use them for everything as much as possible. I especially love the qr code feature where you can login with a passkey that is only on your phone on another machine without having to do any setup. Also I find it a bit frustrating when people say password or otp just works. No they absolutely do not work. Even technical people on here get phished all the time even with otp.
• rldjbpin 3mo ago
  personally it works well for me as a way to login. however, lately the anti-bot/spam shenanigans from big tech has ruined any ux work they have spent trillions on. <rant> one fine day, i was trying to log into my google account at google's office. for some reason their internal wifi was serving the internet through a corporate vpn, which was based out of the US. this tripped their security system, which then made me jump 3-4 hoops to log in back to my account. i recall sms verification (where you send them a code), some part where i had to scan a qr code and open on my phone (not logged into google btw), and the usual 2fa, among others. likewise ticketmaster asking for verification for a decently used account over the years out of the blue. this is when booking a new ticket from a residential internet without any shady business. was made to reset my password three times in a row, and still got blocked!!! </rant> the false positive rate of these systems have reached a boiling point at some instances. yet they don't seem to stop the spammers and scalpers, but cause great pain to regular folks who don't pass the sieve. passkey-based verification is just a symptom of the larger problem. PS: don't even bother using a non-normie browser, as it is a sure-shot way to get restricted, even on this website. it is as if we are all using tor browser if it is not the latest chrome.
• HackerThemAll 3mo ago
  Rather: passkeys are great, but the way Microsoft implemented them in their login flow it disastrous. I store passkeys in a device-independent way, in KeePass using the great actively developed KeePassPasskey extension, because my threat model allows storing password and 2FA for the same site in the same place (or 1st factor when an account is passkey-only, i.e. passwordless). And I sync that between my primary computer and the phone. I have backups of my KeePass database in a few places (that don't require a passkey to log in) so I am able to regain access to core services in case both my devices fail at the same time. Although it's easy to trap yourself in a circular dependency. https://github.com/yusei36/KeePassPasskey/ https://github.com/yusei36/KeePassPasskey/
• abustamam 3mo ago
  I signed into my Playstation account on a new phone. It told me to make a passkey. Its safe. So i said ok. Later I tried to sign into my Playstation account on my computer and I couldn't. It said I needed to use my passkey. I went back on my phone and deleted my passkey. FWIW, Nintendo seems to have nailed the concept of passkey. I can sign in anywhere. If I'm on a new device, i just use my email password and 2FA. I dont know why so many vendors find the need to complicate this. A secure solution implemented poorly can potentially be worse than an insecure solution. One more anecdote on that front — I worked the help desk at a medical school during college. The IT department had their fun password requirements (number, special character, blood of a virgin, change every month, etc). Every single person who came to the help desk had their password written down on a sticky note on their laptops. These were med students , doctors, staff... everyone. At some point these admins have to ask themselves whether they're actually helping people be more secure or if you're just making them jump through hoops.
• knorker 3mo ago
  And when thinking of passkeys, remember that Amazon, who presumably have at least one employed engineer, decided in its infinite stupidity to only allow a single security key to be registered. So Amazon did not understand FIDO, but J random webmaster is supposed to understand passkeys?
• ezst 3mo ago
  For what's worth, I only really started using passkeys after committing to bitwarden/vaultwarden as my password manager. I've been skeptical of Google's/Apple's/Microsoft's passkey implementations forcing you into their password managers and seeing them as yet another power play to lock you in their ecosystem. Passwords+TOTP have that universality going for them that you can always move away to a different password manager/do without one if you ever want. With vaultwarden and that dependency/liability cut off, passkeys have phenomenal UX, especially coupled to a SSO/identity provider like pocketId.
• fobcodes 3mo ago
  [flagged]