5 ms·

>This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. The issue isn't what passkeys _are_ (e.g. explai

by jasode 3mo ago

>This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. The issue isn't what passkeys _are_ (e.g. explaining they are like public/private "ssh keys" and hoping that type of explanation ends the confusion). Instead, it's the workflow around passkeys. The websites show very confusing dialog popups and choices that a lot of normal people will not understand. This is a good article with screenshots showing the confusion: https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/ https://arstechnica.com/security/2024/12/passkey-technology-... I have senior citizens asking me about passkeys because their bank and medical websites keep reminding them about switching to passkeys every time they login into their accounts. My recommendation to them is not to do it unless they have a simplistic single vendor setup such as only Apple iPhone and MacBook with iCloud Passwords app. If instead they have a mixed Windows + Apple setup with 3rd-party password manager, they could accidentally put a new passkey into the os or browser instead of their external password manager and not realize what has happened. This happens because the different parties implementing passkeys all have different agendas that suits their interests and that's what makes the workflow confusing for normal people.

dfabulich 3mo ago
I don't think you're giving those seniors good advice. When the banks ask people to "switch" to passkeys, they're not removing the passwords; they're adding passkeys as an alternate login mechanism. If you lose your bank passkey, (e.g. if you put it in the wrong password manager and you can't figure out where it is) you can just sign in with your bank password. In the worst case, banks actually don't make it very hard for seniors to reset your password/passkey; just show up at a branch with photo ID, your bank card, and your PIN, and a teller will help you reset your credentials. They do it all the time. And, remember, seniors could also put a randomly generated password into the wrong password manager. In that case, they'll either have to reset their password, or they'll have figure out what they did, retrieve their password from the OS password manager, and transfer that password to their preferred password manager. The exact same story applies to passkeys, except, because passkeys can't be copied and pasted, you'd have to figure out how to use the finicky app-to-app transfer system ("Credential Exchange Protocol"). That's probably too complicated for most seniors, so falling back to a password is almost certainly their best bet.
- pishpash 3mo ago
  Uh, if you set up a passkey it becomes the default almost always. Then on another device it'll pop up looking for it and look like login failure and you need to "try another way". That's alarming to anyone, not to mention seniors.
  - dfabulich 3mo ago
    Sure, that's alarming, but if you set up a passkey on the "wrong" password manager, you've (temporarily) lost your passkey. You should probably be kinda alarmed about that. You can click "try another way" and use your password, and then you'll have access to your bank. But then, you should try to resolve that problem. If you (or a trusted friend/family member) can figure out how to use settings to remove the passkey from your bank's account settings, you can do that, or you can ask a bank teller to help you, instead. (And, luckily, you won't need a bank teller, because you'll still have access to your account.)
    - tetromino_ 2mo ago
      > you can ask a bank teller to help you At virtually all banks, the bank tellers cannot help you with login problems. You will have to call the bank's tech support and somehow navigate AI-modulated phone menu hell.
      - dfabulich 2mo ago
        Citation needed. Walk in with photo ID, a bank card, and your PIN, and all the major banks will send you a reset-password email.
        soupbowl 2mo ago
        I went to my bank with all my ID and my bank card, talked to the teller and was told to call a support line. One of my parents went through the same thing. I don't have a citation for you just recent experience, do you have a citation?
Reddit_MLP2 2mo ago
sadly it seems like most of the banks I use still enforce antiquated password rules, no MFA and rely on stupid questions most of which can easily be guessed from public records.
- bdamm 2mo ago
  Just the other day I was creating an ID on a government web site, which offered a list of security questions such as "Title of your favorite movie" or "Someone that you admired as a child" and the answer was not allowed to have any spaces. Just absurd.
  - enobrev 2mo ago
    Security questions have always been ridiculous, but I'll especially never understand how "favorite [thing]" ever made it to production anywhere. "Favorite movie" can change multiple times in the same conversation.
    - thevinter 2mo ago
      Still better than the government (!!!) website that a few days ago gave me the option of using "What's the name of the company you first worked at?"
- Melatonic 2mo ago
  You can also just put any answer into the question as long as you will remember it.
  - edwinjm 2mo ago
    It should work for all people and not depend on these “tricks”.
- vitorgrs 2mo ago
  That might change on the country. At least here in Brazil, all logins require some sorth of MFA. This changes by banks, some send code to our phone number (thought WhatsApp or SMS), others send SMS+email + face ID. All of them require at least the face ID. Some biggest banks requires you to go to ATM to authorize app access. You insert your card, password and authorize there. There's Mercado Pago, which supports passkeys and standard MFA too. So you can store on bitwarden even.
tshaddox 2mo ago
You're agreeing precisely with the parent commenter that passkeys are, from a user's perspective, just passwords that require the use of a password manager. The difficulties many people have understanding or using passkeys are valid to point out and criticize, but they're precisely the same difficulties people have moving from the paradigm of "memorizing or writing down all my passwords" to "using a password manager."
- rstuart4133 2mo ago
  > they're precisely the same difficulties people have moving from the paradigm of "memorizing or writing down all my passwords" to "using a password manager." Errr, no. You can transfer a password from one manager to another. Those very same password managers won't let you transfer a passkey they hold. And if you know the password, you can use it anywhere by just typing it in - no complex technology or protocols involved. But using a passkey involves your secure computer talking to another computer, using a complex protocol that can't go via eyeballs and fingers. If you don't have a way to connect the device holding the passkey to the computer wanting your id - say your USB A Yubikey isn't recognised by your phone, then you are out of luck - you can't use that passkey, even though it's sitting in your hand. And you can't work around that by copying the passkey to a device that can communicate with the service you're using, because you aren't allowed to copy. It's an unworkable mess. The mess is not created by passkeys themselves, because, as others have said elsewhere the protocol is pure elegance. The mess is created by vendors choosing lock in over transportability. I'm hoping it's a passing phase.
  - tshaddox 2mo ago
    That’s a fair point. My thinking was that, once you’re using a password manager, you’ll A) use it to generate random passwords that would be unwieldy to memorize and B) have passwords synced to all your devices such that you will never deal with the plain text password directly. Of course it is conceivable to want to directly access the plain text password for reasons you mention, although that would be exceedingly rare (at least for me). In those cases I agree that passkeys don’t work, although I might argue that if the average user thinks they need to access the plain text password, there’s a significant chance that they’re being phished!
selicos 2mo ago
The what and why make sense. The how is poorly done. People are generally familiar with passwords but passkeys are different.
fragmede 2mo ago
So you're saying that if you're inside Apple's walled garden, it works really well! Hmm...
- baby_souffle 2mo ago
  > So you're saying that if you're inside Apple's walled garden, it works really well! Hmm... Or google. If you use android and chrome then it all just works. But god help you if you want to use a password manager to keep everything in sync; I haven't yet found a way for a mobile app or web page to explicitly signal to the device that the passkey to be created should live in $password_manager and not whatever built-in/on-device key-store exists. So I only really use pass keys for desktop/web things because that's the only place the "store/read from $password_manager" flow _works_.
  - rcxdude 2mo ago
    It's probably not something the app or web page should have any visibility or control over. It's more something the browsers and OS should allow a straightforward selection of where you want your passkeys stored (ideally something you can configure the default for globally). But of course the OS and browser vendors are trying to compete to do it, so they're not incentivised to make it obvious or fair.
  - fauigerzigerk 2mo ago
    >I haven't yet found a way for a mobile app or web page to explicitly signal to the device that the passkey to be created should live in $password_manager and not whatever built-in/on-device key-store exists. On Android 17 (on Pixel) you can select the password service under Settings -> Passwords and passkeys -> Preferred service. If you have an alternative password manager installed, it will be listed there along with Google's own password manager. iOS has a similar setting but I don't know exactly where off the top of my head.
    - baby_souffle 2mo ago
      > On Android 17 (on Pixel) you can select the password service under Settings -> Passwords and passkeys -> Preferred service. I have this set to my password manager but I still can't _use_ the pass-keys in my password manager to sign in to most apps.
raggi 2mo ago
[dead]
marysol5 2mo ago
>I have senior citizens asking me >instead they have a mixed Windows + Apple setup with 3rd-party password manager Why do I feel like this scenario is entirely fabricated. What fucking "senior citizen" is confused by a passkey, but has multiple devices and password managers?

by jasode 3mo ago

dfabulich 3mo ago

I don't think you're giving those seniors good advice. When the banks ask people to "switch" to passkeys, they're not removing the passwords; they're adding passkeys as an alternate login mechanism. If you lose your bank passkey, (e.g. if you put it in the wrong password manager and you can't figure out where it is) you can just sign in with your bank password. In the worst case, banks actually don't make it very hard for seniors to reset your password/passkey; just show up at a branch with photo ID, your bank card, and your PIN, and a teller will help you reset your credentials. They do it all the time. And, remember, seniors could also put a randomly generated password into the wrong password manager. In that case, they'll either have to reset their password, or they'll have figure out what they did, retrieve their password from the OS password manager, and transfer that password to their preferred password manager. The exact same story applies to passkeys, except, because passkeys can't be copied and pasted, you'd have to figure out how to use the finicky app-to-app transfer system ("Credential Exchange Protocol"). That's probably too complicated for most seniors, so falling back to a password is almost certainly their best bet.

pishpash 3mo ago
Uh, if you set up a passkey it becomes the default almost always. Then on another device it'll pop up looking for it and look like login failure and you need to "try another way". That's alarming to anyone, not to mention seniors.
- dfabulich 3mo ago
  Sure, that's alarming, but if you set up a passkey on the "wrong" password manager, you've (temporarily) lost your passkey. You should probably be kinda alarmed about that. You can click "try another way" and use your password, and then you'll have access to your bank. But then, you should try to resolve that problem. If you (or a trusted friend/family member) can figure out how to use settings to remove the passkey from your bank's account settings, you can do that, or you can ask a bank teller to help you, instead. (And, luckily, you won't need a bank teller, because you'll still have access to your account.)
  - tetromino_ 2mo ago
    > you can ask a bank teller to help you At virtually all banks, the bank tellers cannot help you with login problems. You will have to call the bank's tech support and somehow navigate AI-modulated phone menu hell.
    - dfabulich 2mo ago
      Citation needed. Walk in with photo ID, a bank card, and your PIN, and all the major banks will send you a reset-password email.
      - soupbowl 2mo ago
        I went to my bank with all my ID and my bank card, talked to the teller and was told to call a support line. One of my parents went through the same thing. I don't have a citation for you just recent experience, do you have a citation?

Reddit_MLP2 2mo ago

sadly it seems like most of the banks I use still enforce antiquated password rules, no MFA and rely on stupid questions most of which can easily be guessed from public records.

bdamm 2mo ago
Just the other day I was creating an ID on a government web site, which offered a list of security questions such as "Title of your favorite movie" or "Someone that you admired as a child" and the answer was not allowed to have any spaces. Just absurd.
- enobrev 2mo ago
  Security questions have always been ridiculous, but I'll especially never understand how "favorite [thing]" ever made it to production anywhere. "Favorite movie" can change multiple times in the same conversation.
  - thevinter 2mo ago
    Still better than the government (!!!) website that a few days ago gave me the option of using "What's the name of the company you first worked at?"
Melatonic 2mo ago
You can also just put any answer into the question as long as you will remember it.
- edwinjm 2mo ago
  It should work for all people and not depend on these “tricks”.
vitorgrs 2mo ago
That might change on the country. At least here in Brazil, all logins require some sorth of MFA. This changes by banks, some send code to our phone number (thought WhatsApp or SMS), others send SMS+email + face ID. All of them require at least the face ID. Some biggest banks requires you to go to ATM to authorize app access. You insert your card, password and authorize there. There's Mercado Pago, which supports passkeys and standard MFA too. So you can store on bitwarden even.

tshaddox 2mo ago

You're agreeing precisely with the parent commenter that passkeys are, from a user's perspective, just passwords that require the use of a password manager. The difficulties many people have understanding or using passkeys are valid to point out and criticize, but they're precisely the same difficulties people have moving from the paradigm of "memorizing or writing down all my passwords" to "using a password manager."

rstuart4133 2mo ago
> they're precisely the same difficulties people have moving from the paradigm of "memorizing or writing down all my passwords" to "using a password manager." Errr, no. You can transfer a password from one manager to another. Those very same password managers won't let you transfer a passkey they hold. And if you know the password, you can use it anywhere by just typing it in - no complex technology or protocols involved. But using a passkey involves your secure computer talking to another computer, using a complex protocol that can't go via eyeballs and fingers. If you don't have a way to connect the device holding the passkey to the computer wanting your id - say your USB A Yubikey isn't recognised by your phone, then you are out of luck - you can't use that passkey, even though it's sitting in your hand. And you can't work around that by copying the passkey to a device that can communicate with the service you're using, because you aren't allowed to copy. It's an unworkable mess. The mess is not created by passkeys themselves, because, as others have said elsewhere the protocol is pure elegance. The mess is created by vendors choosing lock in over transportability. I'm hoping it's a passing phase.
- tshaddox 2mo ago
  That’s a fair point. My thinking was that, once you’re using a password manager, you’ll A) use it to generate random passwords that would be unwieldy to memorize and B) have passwords synced to all your devices such that you will never deal with the plain text password directly. Of course it is conceivable to want to directly access the plain text password for reasons you mention, although that would be exceedingly rare (at least for me). In those cases I agree that passkeys don’t work, although I might argue that if the average user thinks they need to access the plain text password, there’s a significant chance that they’re being phished!

selicos 2mo ago

The what and why make sense. The how is poorly done. People are generally familiar with passwords but passkeys are different.

fragmede 2mo ago

So you're saying that if you're inside Apple's walled garden, it works really well! Hmm...

baby_souffle 2mo ago
> So you're saying that if you're inside Apple's walled garden, it works really well! Hmm... Or google. If you use android and chrome then it all just works. But god help you if you want to use a password manager to keep everything in sync; I haven't yet found a way for a mobile app or web page to explicitly signal to the device that the passkey to be created should live in $password_manager and not whatever built-in/on-device key-store exists. So I only really use pass keys for desktop/web things because that's the only place the "store/read from $password_manager" flow _works_.
- rcxdude 2mo ago
  It's probably not something the app or web page should have any visibility or control over. It's more something the browsers and OS should allow a straightforward selection of where you want your passkeys stored (ideally something you can configure the default for globally). But of course the OS and browser vendors are trying to compete to do it, so they're not incentivised to make it obvious or fair.
- fauigerzigerk 2mo ago
  >I haven't yet found a way for a mobile app or web page to explicitly signal to the device that the passkey to be created should live in $password_manager and not whatever built-in/on-device key-store exists. On Android 17 (on Pixel) you can select the password service under Settings -> Passwords and passkeys -> Preferred service. If you have an alternative password manager installed, it will be listed there along with Google's own password manager. iOS has a similar setting but I don't know exactly where off the top of my head.
  - baby_souffle 2mo ago
    > On Android 17 (on Pixel) you can select the password service under Settings -> Passwords and passkeys -> Preferred service. I have this set to my password manager but I still can't _use_ the pass-keys in my password manager to sign in to most apps.

raggi 2mo ago

[dead]

marysol5 2mo ago

>I have senior citizens asking me >instead they have a mixed Windows + Apple setup with 3rd-party password manager Why do I feel like this scenario is entirely fabricated. What fucking "senior citizen" is confused by a passkey, but has multiple devices and password managers?