15 ms·

I don't like passkeys

• juancn 15d ago
  Account lockout as the author mentions is the biggest risk on personal accounts. Passkeys just make it harder/riskier.
• kelvinjps10 15d ago
  I didn't like the passkeys that were handled by Google and only worked on my phone. But now that most of them support bitwarden they are really convenient.
• a2tech 15d ago
  They’re bad and I wish places would stop being so aggressive about them (I’m looking at you Amazon and PayPal)
  • Finnucane 15d ago
    Asking Amazon and Paypal to not do something bad is a big ask.
• junaru 15d ago
  They exist for sole purpose companies can just shoot the "we have been hacked, but worry not your 'passwords' have not been leaked" email. It's entirely one sided solution.
  • cbarrick 15d ago
    But they could always do that with regular passwords. Like, no company should be storing anything but a salted hash of their users' passwords.
• kenrick95 15d ago
  Passkeys have a marketing problem where no one is able to describe simply what it is without having to use technical jargon. There's also the problem where each OS tries too hard in pushing this to the face of end-user
  • etatester 15d ago
    It's a key, what else do non-technical people need to know? Ironically on macOS we used to have an app called Keychain which unfortunately was effectively renamed to Passwords for non-technical users.
    • paulryanrogers 15d ago
      It's a digital key. Unlike physical objects they may reside in a TPM, a software vault, an export/backup, or any combination thereof. You may or may not be able to recover or migrate them, depending on where/how they were made. Therefore you may need multiple per service, or maybe not. Services which only allow one may end up locking you out with no recourse. You get to find out. None of this is obvious or self explanatory to normies.
      • kskdkwkdkwk 15d ago
        Probably because these caveats and weird behaviours are platform-dependent, not really the passkey’s fault. Passkeys really are not any more difficult to explain than 2-factor authentication. Anyone who’s currently been able to actually create an Apple or Google account and successfully navigate their devices up to a passkey screen will be able to grok how it works. People around here really ought to stop thinking users are complete idiots. Hell, you don’t even to scroll that far to read people calling users “normies” for crying out loud. What is this? High school?
        • alt227 15d ago
          You obviously dont have to deal with anybody who doesnt know how or want to use computers.
        • paulryanrogers 15d ago
          Do you know how many Google and Apple accounts my boomer parents have? Roughly one per smart-phone that they've ever used. They don't know the passwords or even the email address of any of them, not even the latest.
• silon42 15d ago
  Is there a reason why passkeys couldn't be used in "expire-periodically" mode?
  • pletnes 15d ago
    Then how do you log in? Not all sites let you keep password logins after.
    • silon42 15d ago
      Then passkeys are a guarantee of account loss, if there is no reasonable way of recovery.
      • mrguyorama 15d ago
        Yes, that is what everyone keeps complaining about and the people who insist passkeys are the best continue to loudly and totally ignore. The repeated response to "I lost the passkey, what now?" is apathy. It is your fault, you should have done better, eat it loser. Because companies built passkeys for their own needs, not for users. In a managed device setting, there is a response: You go to IT and get provisioned new credentials. These companies don't care that you get fucked because they just don't care about your needs at all.
        • mermerico 14d ago
          Your passkeys should go in your password manager.
  • hannasanarion 15d ago
    What benefit does that give you? Passkeys cannot be moved, by design. So for the website, recieving the same one means you're talking to the same device, always. The purpose of rotating passwords is to cycle out potentially compromised ones, due to phishing attacks, keyloggers, shoulder snoops, etc. But those cannot exist with a passkey.
• wg0 15d ago
  They really are bad. Passkeys have turned out to be just another password that you cannot even memorize.
  • john_strinlai 15d ago
    >just another password that you cannot even memorize there's some issues with passkeys, but not being able to memorize them is a feature
    • blackdahlia313 15d ago
      And this is why people bash passkeys, but they hear a buzzword lol
    • wg0 15d ago
      So where do I keep my pass keys is the problem. They are in my password manager just like another password. So what's the point of having them because effectively, the passwords in the password manager and the passkey in the password manager offer the same UX to me? Except that at least I can memorize a password by heart just in case.
      • john_strinlai 15d ago
        >They are in my password manager just like another password. So what's the point of having them because effectively, the passwords in the password manager and the passkey in the password manager offer the same UX to me? same ux, different security properties. >Except that at least I can memorize a password by heart just in case. "just in case" should be a thought out recovery flow, rather than hoping that you remember the password of the account you need to access.
        • xboxnolifes 15d ago
          The password is the recovery flow. What do you propose instead that isnt just a variation of having a password and a passkey?
• elteto 15d ago
  While the technology itself may be great (I don't really know since I don't use them) it has been co-opted by the tech conglomerates as another form of isolating and walling off users into their ecosystems. And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".
  • spider-mario 15d ago
    It’s a bit ironic that Apple is the one that lets you export them.
    • rcxdude 15d ago
      They're also not supporting device attestation which would allow websites to insist on particular implementations of passkeys.
      • dingaling 15d ago
        That's more because attestation breaks their passkey cross-device sync process, rather than out of benevolence.
    • 93po 15d ago
      But only to other approved apps
      • spider-mario 15d ago
        Not as far as I’m aware? They of course require the target app to be compatible with the way they export them, but I don’t think they vet them manually. At the very least, on my phone, the apps it agrees to export to include Chrome and Bitwarden (the latter of which lets me export them further).
  • mschuster91 15d ago
    > And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. The reason is the ever increasing number of hijacks of social media presences and code hosting portals, with the latter being a serious financial threat. Done right, passkeys stay in the Secure Enclave, at least for anything Apple and most of the Android sphere. There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
• blfr 15d ago
  Yes, thank you. Maybe I am getting old but password+yubikey/webauthn was really top UX.
  • mschuster91 15d ago
    > Maybe I am getting old but password+yubikey/webauthn was really top UX. It most definitely isn't. Any 2nd factor that is not the device I am currently using (either a yubikey or my phone) has a non-zero chance of not being near me when I need it, leading to the constant question of "where the fuck did I put that darn thing", only to find out that the cat has decided to believe the yubikey is a mouse and tried to devour it, the phone's battery went dead...
  • xxs 15d ago
    What prevents passkey being used alongside password (+ email 2fa)?
    • blfr 15d ago
      Email 2fa otoh is the worst UX I have experienced. I curse every time Claude sends me a magic link. Absolutely hate them.
      • esafak 15d ago
        You don't like not having to worry that they don't store your creds so they can't lose it?
        • blfr 15d ago
          The creds they store hold no value. These creds only give access to their system anyway. They store the email address either way so the situation is no better but less convenient.
          • esafak 15d ago
            They hold no value precisely because they don't store them and send you a magic link! If they stored a recycled password or its hash, then it would be valuable.
• xyzzy_plugh 15d ago
  Do passkeys improve security posture for the average person, reducing the likelihood of them losing their accounts to fraudulent actors? Absolutely. But they also introduce single points of failure, as the article points out. I can't even remember how many times I've had to help a family member recover their account or get confused when they can't sign in on a new device. It's incredibly frustrating that this flow is promoted as the default for so many services. 1password is the best solution I've found for the average person. It's not perfect (it's definitely more complex than writing down your passwords on a piece of paper or using the same password everywhere) but it's much easier than juggling yubikeys. I know so many non-technical staff members who prefer the OS or browser keys even if it means another account recovery is lurking around the corner.
• vanschelven 15d ago
  Passkeys remind me of ipv6 in that they are a "solution" coming from the supply-side, without (apparently) having done any research in what motivates actual users (and what would motivate them to switch). <<ducks>>
  • coldpie 15d ago
    They make sense as a technology for businesses & their users. In that scenario, the owner of the account is not the user, but the business. It makes sense for the business to be able to place strong restrictions on how & where the user may log in, it fixes a lot of real problems businesses may have thanks to sloppy user behavior, and the business is also motivated to provide a way to fix broken logins. It's a good solution for that scenario. But for regular end users where services are primarily motivated to take money from those users and lock them into their ecosystems, they are a usability disaster and yet another exploitation vector. It's one solution for two very different usecases, and it just does not work. There is an approach that could work for end users who own their own accounts, but they need to go back to the drawing board and rewrite the protocol with the assumption that the keystore is hostile to the user's interests. That means strong guarantees on key portability so users can migrate away from hostile keystores, and absolutely no ability for services to restrict the user's choice in passkey provider software.
    • Telaneo 15d ago
      > and the business is also motivated to provide a way to fix broken logins. It's a good solution for that scenario. This is a big part of it. An employee at a business will be able to talk to someone in person and say 'I can't login. Can you reset my password?' or whatever equivalent, and be made whole. Even if the business is is made up of 10000 people and the identity of the employee is for some reason in question, the situation can still be resolved with a passport or a driver's licence. Google is never going to make you whole again if you're locked out of your account, unless you're a celebrity and make a stink. There is no help desk where you can prove who you are (and even if you could, would you want to? That's a whole second domain of problems that I'm not sure will ever be solved completely).
  • 15d ago
• kardianos 15d ago
  I agree with all the points this articulates. I understand why for many users they are great. But I would prefer better acceptance and continuance of the simpler, unfishable, u2f simple hardware keys.
• micromacrofoot 15d ago
  The experience is also junk if you're using a password manager, I have passkeys that I'm not sure if I saved to the OS manager or my password manager... mostly my fault but I enter passwords so many times a day it can be hard to stay on top of which UI I'm clicking yes in to store them. Password managers are great IMO, I can use some absurdly long password, backup is reliable, I can use them across devices. For extra secure stuff 2FA works the same, I've got an app with codes I can easily back up and use from multiple devices. Passkeys tend to obscure everything and take away a lot of control.
• BoppreH 15d ago
  Completely agree. I think the root of many of its issues is the inability to add a key that you don't currently hold. This prevents me from storing a backup key in a safe, for example. I proposed an alternative scheme many years ago: https://www.researchgate.net/publication/343318317_Privacy-aware_web_authentication_protocol_with_recovery_and_revocation https://www.researchgate.net/publication/343318317_Privacy-a... . By allowing "offline" keys you can also treat them as higher priority, and use them to revoke any lesser keys from attackers if your account is compromised. It would also be nicer to get rid of usernames, but that's a fight against the data-gathering powers that we're unlikely to win.
• Liftyee 15d ago
  YES. This exactly. I work across multiple devices, some of which are nonstandard/uncommon (Linux, Xiaomi China ROM, ...) and I've NEVER had passkeys work properly - yet everything constantly prompts me to add one. Even if they did work, I'd have to carry around hardware keys or register each computer separately. And the lack of backups if a device is lost/broken is definitely a larger concern for me than being phished of my TOTP keys.
  • girvo 15d ago
    My wife clicked through a Google dialog and suddenly was using a passkey. It absolutely happens, though IMO more to the non technical users. I know what those login dialogs and pop ups mean, and decline them. (At least til I get around to setting up my new usb c yubikeys!)
    • ryandrake 15d ago
      I'm convinced that most Passkey adoption is accidental.
      • deaux 15d ago
        I'm convinced it's over 80%.
  • utopiah 15d ago
    > lack of backups if a device is lost/broken Same as traditional physical keys, you don't have a single key, you have multiple ones precisely so that if you lose/break one, you are not stuck and can go to the local locksmith and get another one in minutes. In fact it's even nicer since you can just re-use the backup key with no security loss by revoking the other one, and buying another key.
    • account42 15d ago
      For physical keys I don't need to ask permission to be able to make a second or third copy.
• etatester 15d ago
  As someone who uses a single password manager on my computer and phone, I don't see the problem with passkeys. I use Safari on both and I never even had to "set up" anything. I can see why they would be problematic for people who otherwise live life with a single love2025 password though.
  • kejdkwjdjwj 15d ago
    [flagged]
  • flerchin 15d ago
    Imagine you lose your computer and phone. How do you recover your digital accounts? This happens every day to someone. The most common scenario being a house fire or robbery.
    • karlshea 15d ago
      The same way you recover your account when you lose a password.
      • marcosdumay 15d ago
        What benefit does your 128-bits authentication schema gain when anybody can just clone a phone number? Or do you demand that the user has an email with that 128-bits authn too, with a key on the same phone that was lost?
      • flerchin 15d ago
        I don't get it. I recover an account at ticketmaster by receiving an email. I recover an account at google by???
        • karlshea 15d ago
          Receiving an email at your backup email address? Getting a text message? It’s whatever you have decided to set up in your account, the same as with a password.
• dxjxjdjsssb 15d ago
  [flagged]
  • rcxdude 15d ago
    I've seen it. Websites are pretty inconsistent about the flow but I've had a few just try to install a passkey when I log in (amazon does it. Paypal seems to do it but only try to use it on the same browser it was installed on, even if it's synced through a password manager, just to be different. The more reasonably ones have a 'log in with passkey' button but this isn't universal. Microsoft seems to just nag the user on login periodically in their classic 'Yes/Ask me again later' style of 'consent'). You can, if you're paying attention, avoid it actually happening, but the average user isn't going to notice until they suddenly can't log in because they're on a different device. You can see some advocates are pretty vocal about making them mandatory as well.
  • paulryanrogers 15d ago
    You must not use Outlook
  • geerlingguy 15d ago
    Every time I login to certain sites (like my health insurance, for one) I get a passkey prompt (system dialog) with no way to keyboard-dismiss, so I'm forced to move my hand over to the mouse and figure out which of three poorly-named buttons to press to get on with the login and ignore the passkey. It's a minor inconvenience, but happens so regularly I hate it. It also stops the login flow until I dismiss the prompt, which is also annoying as I could've already gotten to the page I wanted to get to in the time it took to dismiss the dialog.
  • dbalatero 15d ago
    I feel like dozens of sites constantly nag me about this. The best ones at least save a cookie to note I'm not interested, such as GitHub.
• hahn-kev 15d ago
  I like using passkeys in bitwarden from Firefox, I just wish it didn't popup a dialog that's usually behind the browser.
• drtz 15d ago
  Passkeys do marginally improve security against MITM and phishing attacks, but they are primarily for protecting the lowest common denominator from themselves: people who re-use passwords and/or don't use a password manager. If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password. The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
  • mystifyingpoi 15d ago
    > how do I log in on a device that I don't own? Sad reality is that such usecase is less and less common, thus, no one cares about it. I think majority of my friends would not be able to access their email, or facebook or alike, if they were forced to use my computer in emergency.
    • Latty 15d ago
      Which is a trade-off that makes sense for a lot of people. If you have multiple devices, many of which are portable and one you have on you all the time, the need for that is just way lower, so being more secure against commonplace automated widespread attacks is worth it to them.
      • iamnothere 15d ago
        Many people are moving to only a single portable device that’s easily lost, broken, or stolen, without any understanding of backups or fallbacks for their accounts. And many are moving to virtual wallets like Cashapp rather than banks with a physical presence where you can take out money without a phone. It’s a bad situation.
• xphos 15d ago
  I agree 100% i learned that my old school with whom I had linked to my windows computer and finished my degree with one day required passkeys rather than passwords on all devices. This force locked my windows PC back to passkey mode luckily I remember recovery account and got a passkey to work. But it took months to figure out why I had to use it. All the help board were said just click this button which was grayed out. Or set this register key which auto repopulated. It was an awful experience. I like my password as default
  • rcxdude 15d ago
    Ah yeah, Microsoft has this awful habit of just hiding the buttons for actions you don't have permission to do, which makes me feel like I'm being gaslit sometimes when a guide says 'there's a button right here' and there's not, and I've no idea if the button was just moved or if not, why it's not available (sometimes it's because I don't have permission, but sometimes it's because it's a different product with the same name and branding as a completely different product).
• blackdahlia313 15d ago
  Passkeys have made my life very easy. Especially using Proton Vault. If you think passkeys aren't ready yet, blame the people implementing it on their platforms.
  • VCFundedGenYer 15d ago
    If the concept isn't easily understood nor well implemented by the majority of platforms, it's not a good concept.
    • izacus 15d ago
      We've been using SSH keys which behave the same for years. At this point it's mostly clowning by old farts in these articles.
      • cpburns2009 15d ago
        SSH keys are much easier to use and understand. Heck, passkeys could have just been a ZIP file holding a key-pair instead of whatever hostile design by committee we ended up with.
      • rcxdude 15d ago
        If they actually worked like SSH keys that would solve some of the problems with them. (like keeping a backup that you can still enroll into new accounts without it being present).
        • izacus 15d ago
          There's plenty of password managers available that keep the backup for you in multiple ways.
          • rcxdude 15d ago
            At some substantial risk to the important key material, yeah. You also don't get an offline backup.
• F7F7F7 15d ago
  I'm was tempted to come in here and say "you're holding it wrong." But then I quickly realized that I had to spend weeks changing my behaviors and messing around with devices in order to get it to work correctly. As someone who's OpSec puts swiss cheese to shame Passkey has been a godsend. My passwords are actually much better because of it.
  • blackdahlia313 15d ago
    I will say it. They are all holding it wrong. But it's not their fault. Its how the platforms designed their implementation of it.
• brushfoot 15d ago
  If you have to use passkeys, try KeePassXC and KeePassXC-Browser. I used them to set one up for Amazon a few days ago, as Amazon now forces passkeys as of this month, at least for my account. It was relatively painless. That said, I don't like passkeys either.
  • beej71 15d ago
    This is the direction I'm looking, but it sounds like we might have a little farther to go before it works well across all devices.
• elAhmo 15d ago
  Ecosystem is not mature yet for individuals? Probably hundreds of millions or even billion people have devices that support biometric auth. How is that not mature?
  • Al-Khwarizmi 15d ago
    Devices that break or get lost, and then either the user had password authentication activated all the time anyway in addition to the passkey, or they have the classic "mother's maiden name" recovery path, or they get locked out of their account. Brilliant security: a highly secure high-tech shiny front door that can randomly fail to open, so you still need the low-tech back door, which is the one potential thieves will use. Mind you, it can work if the back door is old but sturdy (basically, for a bank that will ask for KYC authentication, or in the worst case you can set foot in the brick-and-mortar branch showing your face and ID and ask for access) but for pretty much every other service it introduces risks for very little or no gain.
• hannasanarion 15d ago
  The point about poor support for 3rd party managers is so frustrating. Because this is correct, that is the obvious solution for the normal user, but passkey implementations somehow do not know how to deal with it. Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser. And the confusing mechanism hurts there too: I'm always a little bit afraid that i'm somehow more in danger because I keep them in a vault that's shared on all my devices rather than a TPM, because whenever the protocol is explained the "it can't leave your device" part is highlighted as the main source of the security, except.... mine obviously do leave my device, with the vault, so.....
  • jasonjayr 15d ago
    Yet, the Apple + Google implementations will sync passkeys between your devices. "Securely", of course. (I've seen first hand how Apple implements this, and it seems.... sound) Sites can request hardware-bound tokens, which would block any software based password managers. It's an option in the protocol but one not yet widely utilized.
    • XorNot 15d ago
      Which is a problem. It should not be in the protocol. And I don't trust Apple and Google not to lock it away from me. I want my own open source manager and if that is attempted I want it to lie about it.
      • drtz 15d ago
        Lying about it may become impossible in the future when you throw hardware key attestation into the mix. https://developer.android.com/privacy-and-security/security-key-attestation https://developer.android.com/privacy-and-security/security-...
        • tadfisher 15d ago
          FIDO authenticator attestation is dead for consumer-facing RPs. Apple made the right call and simply refuses to support it outside of MDM environments.
• Finnucane 15d ago
  I've resisted passkeys for some of the reasons listed. I use third-party password managers, they're device/system independent, and I can export the data when I want to. I don't see passkeys as a big advantage, or perhaps I should say the bigger advantage isn't really for the _user_. Of course, at the rate we see security failures everywhere, I'm not entirely convinced writing your passwords on post-it notes wasn't such a bad idea after all.
  • XorNot 15d ago
    Keepass2Android without network permissions saving the file to a folder monitored by Syncthing is pretty good though - it keeps responsibilities nicely separated.
• ectoloph 15d ago
  I am conflicted with passkeys. I actually prefer non-resident U2F in some ways. You don't have to store anything on your key, you are just signing requests. This is relevant where U2F/FIDO keys have limited slots for 'resident' keys. In principle, it's great. You have one good password to remember for the average user, and that's enforced by their device's probably good enough security posture. They are resistant to being phished and they won't reuse the same one everywhere. They then don't end up going from hunter2 to hunter2! everywhere. But my experience for users is that they worry they are giving their biometrics to Amazon or whoever and so the UX just confuses them. The certification aspect was new to me too last time passkeys came up. Sites can require that a given passkey has been certified. The patchy support for them is also frustrating. MacOS does not support NFC FIDO/U2F. iOS does.
  • iamnothere 15d ago
    Absolutely! U2F keys are unlimited, but I only have so many slots on my hardware key. And now sites are moving away from supporting U2F towards a passkey-only model. No! I have limited slots!
  • wang_li 15d ago
    I don't want to have the security sensitivity of my devices be escalated by the fact that I access a very important service with that device. Currently I have separate passwords and a 2FA on my investing and bank accounts. I don't want to have to treat my cheap travel laptop as a SCIF because it is synced with my cloud services and has passwordless access to my entire financial life.
• whalesalad 15d ago
  using them with 1password has been pretty effortless. 'want to add the passkey' sure why not. 'want to use the passkey?' sure why not. for me it works across devices/os/platform so not sure what the big gripe is tbh.
• lapcat 15d ago
  Two crucial things you can do with a password that you can't do with a passkey: 1. Write it down on a piece of paper and put it in a safe deposit box. 2. Read it on one device (or from a piece of paper!) and enter it manually on another device. Plain text is the ultimate form of cross-platform portability. Passkeys are the ultimate form of vendor lockdown. The passkey vendors won't even allow you to view the private key, unlike with ssh keys, which you can also write down on a piece of paper. It's vendor cabal to destroy computing freedom in the name of "security", always the excuse. Tech company paternalism at its worst.
  • XorNot 15d ago
    This is exactly how I feel about it. If passkeys were meant to be user friendly then there'd be a secure optical transfer mode to QR code them from device to device with the screen and camera. Easy to implement (receiver flashes a public key, sender encrypts to that key and flashes the QR code back). That it doesn't exist for a protocol meant to work with phones tells you exactly where the thinking was headed.
    • mrguyorama 15d ago
      That they have purposely put effort into preventing you from doing that shows you everything you should need to know. The entire point of passkeys is yanking the control over authentication out of the hands of people. These companies don't want you to be able to let someone else log in as you. That's the entire point. The problem they are solving has absolutely nothing to do with security.
• VCFundedGenYer 15d ago
  This is generally the same experience I've had. Microsoft is especially poorly prepared for this - Often if you have a passkey, it will CONTINUE To ask you to create a passkey (a new and different one), and it may save it in a different place, which is infuriating. Strong password + MFA is the way, and I don't see that changing.
• T3RMINATED 15d ago
  [dead]
• brettermeier 15d ago
  I absolutely hate them and avoid them everywhere I can. I'm not bound to a single device or I don't want to get bound to some, and some pages quit your option with a normal password login after setting up a passkey. Absolutely frustrating.
• throw7 15d ago
  I have said before, I'm personally not interested using "Something I have"/"device bound" as an authentication factor. I'm also not interested in the sync "workarounds" that store keys in the cloud. People have replied it's possible to extract the private key, but it's not clear to me that that's usable (maybe it is I don't know). It's certainly not in line with what passkey devs want people to do and not do, so I'm not interested in "fighting" against the "flow" so to speak. I'm happy with TOTP, as I can manage and use the codes where I want, under my control.
• iamnothere 15d ago
  I don’t like how tokens have gradually evolved from a secure 2F device that you carry with you (Yubikey etc) to a single factor “passkey” that’s built in to your computer/phone, or worse, a password manager with export capability. It should always have remained a second factor device. It’s not impossible to teach people to use these, European banking did it for years. There’s just no will to do it.
  • dalyons 15d ago
    It’s because we have effective biometrics now, so the need to carry around an inconvenient limiting physical 2nd factor is obsolete (for the vast majority of regular use cases)
    • izacus 15d ago
      We also have devices with yubikeys built-in now.
      • deleted 15d ago
        [deleted]
  • sikozu 15d ago
    I 100% agree with this. I have physical passkeys, one attached to my keys and another on my desk at home and I absolutely hate software based passkeys. Every single time I'm asked for a passkey it always ask me if I want to use my Apple Keychain first and I wish I could default to physical.
    • dalyons 15d ago
      physical 2fa should be an option, but i can never agree that we should force billions of regular people to use a harder to use and more inconvenient system that they have already indicated they dont want to use, for some mild security benefits
      • 15d ago
• throwaway27727 15d ago
  Passkeys are great in that its turning login support on websites into simple "autheticate your device to seamlessly login". My biggest gripe is that it seems Apple/Google are using this to consolidate control into their own password ecosystems and don't support password managers as a store for passkeys.
• Jnr 15d ago
  Surprised to see so much hate towards passkeys. I absolutely love them when I can use them with Bitwarden and my own SSO. Sucks when I am limited to hardware tokens like yubikeys.
  • Jnr 15d ago
    I am even more surprised about the multiple down-votes for this comment just because I like some feature. Must be a bunch of grumpy old keyboard warriors on this thread. 0__o
• joshstrange 15d ago
  I continue to avoid passkeys but it's becoming an incredibly dense minefield. Certain sites try to trick me into adding one each time I log in and I have to be careful to dismiss the 1Password prompt, then dismiss the chrome prompt, then dismiss the OS-level prompt (all back-to-back). It's so incredibly user-hostile.
  • frizlab 15d ago
    Where do you have so many sites asking for passkeys? I’m desperately trying to have more but I have ~1.1k passwords in my password manager and only 63 passkeys!
    • joshstrange 15d ago
      It's the banks/Amazon/etc-type places that keep prompting me, coupled with random one-off websites here and there. When I upgrade my phone in a month or so I'm dreading the deluge of passkey requests I'll run into and having to deny it multiple times per initial login. My annoyance with the prompts is not evenly spread over the sites I use, it just so happens the same sites that think short login periods = security (it does not) are also the same sites that think passkeys are the best thing since sliced bread. I have such a low opinion of any company that logs me out every time I turn around and those are the same disrespectful companies that think it's appropriate to spam me with passkey requests when I login. My dislike also extends to those companies they have a "Remember me" or "Remember this choice" checkbox that is decorative, as in it doesn't do anything. Often paired with clicking external links in things like a banking website "Warning: You are leaving this site!", yeah, I know how the internet works, I don't need to be babied by a completely ineffectual dialog (if you think normies are reading that and not just clicking through, you are living in a fantasy world).
      • frizlab 15d ago
        Interesting. For the GAFAM yeah, I got those. But for banks, in my country at least, I’m not sure they are even allowed to use passkeys. Instead we have a glorious numerical keypad where we have to manually click on the keys and the keys are never at the same place. I’d love to have passkeys instead…
• jtrn 15d ago
  My thinking is that Passkey is an extremely good and, in theory, extremely easy solution to security, authorization, and login issues. The problem is that Google, Apple, and Microsoft have done a just horrendous job, and made it suck as much as possible. They didn't want to cooperate, and they wanted to make passkeys transferable within you cloud account, while not cooperating with anyone or anything else. The result was that you have no predictable and stable pattern/protocol/interface, or even general description, for how, for instance, a website connects to the passkey or even a hardware key, if you wanted it. We basically have all the browsers, the operating systems, and the password managers, all fighting over who gets to store and present the passkey. And everybody assumes that they are the only one that exists and actively tries to fight the others is they can. The basic technology is really good and could work well, but the large asshole tech firms focused on self-interest and walled gardens and made it insufferable.
• ChrisMarshallNY 15d ago
  Eh. Not worth complaining about. Passkeys work nicely, and I'll use them, in cases where I want decent security, but I don't consider them the "Philosopher's Stone" of regular end-user security. I think they are still a bit too "fiddly" for your average Joe[line].
• skybrian 15d ago
  To guard against lockout, you need to be able to log in from multiple devices. But you don’t need to copy passkeys around to do that! Instead, generate a new one for each device. This is similar to setting up ssh by copying public keys, not private keys. (Or since syncing passkeys usually works within ecosystems, you might just need a passkey per OS.)
• littlecranky67 15d ago
  I try to boycott passkeys due to built-in attestation feature in the standard. Not active now, but given how Google+Apple already use the passkey feature to lock you into their ecosystems, it is just a matter of time until their service will require that the passkey is attested from a non-rooted Google or Apple device. I think this will especially be true for Google to prevent AI scraping bots. Turning this on does not require anything, once passkeys are widely used, Apple, Google and Co. simply can flip a switch.
  • EvanAnderson 15d ago
    > Not active now, but given how Google+Apple already use the passkey feature to lock you into their ecosystems, it is just a matter of time until their service will require that the passkey is attested from a non-rooted Google or Apple device. I'm with you 100%. There will be evil and stupid uses. The brain-damaged people who think disabling paste on password fields is a security feature will be all over forcing device-attested passkeys as soon as they learn about it. Evil people will see it as a proxy attestation of humanity. Either way it will be rammed down our throats if passkeys are widely adopted.
    • rc_kas 15d ago
      My favorite FireFox plugin : https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/ https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...
  • halyconWays 15d ago
    I imagine that's why they're pushing them so hard, especially given Google's recent anti-user lockdowns. I have a hard time imagining they'd expend so many resources to protect a tiny percentage of users from having their accounts hacked...there's no way they actually give a shit about that. Their bread and butter is instead protecting the value of their product, which is their captive userbase.
  • nbobko 15d ago
    TIL about the attestation. Ohhhh, why can't we just have nice things?
• rdsubhas 15d ago
  It's the stupidity of Service Providers to adopt passkeys in the first place. As a service provider myself, I've evaluated and said "Nah" to passkeys - because it's simply increased Customer Service contacts I have to invest in, whenever a user changes or loses devices, or any of the hundreds of ways Passkeys are not portable. And guess what, the Tech companies pushing this have zero liability for user login support or security breaches. It's always me. There is no need for me to work hard and spend CS contacts, to wall off my users to the OS or Browser vendor. I'll simply do passwordless Email or SMS 2FA / Magic Links and own my users without the overhead of Customer contacts, thank you.
  • dwb 15d ago
    I understand many passkey complaints but not this one. Why, for you as a service provider, are passkeys not just better (or at least equivalent to) passwords? You collect and verify an email address at signup and the account can be recovered in the same way as with passwords, or passwordless-email. No CS-verified recovery needed.
    • rdsubhas 15d ago
      > Why, for you as a service provider, are passkeys not just better (or at least equivalent to) passwords? Why you missed the last line of my answer? How did you get an impression to go back to broken passwords?
      • dwb 15d ago
        All right, my framing was a little too tight. Sure I can see why an email/SMS passwordless loop is easier for you, but it’s a more annoying user experience than your OS/browser/password manager just filling in your credential directly.
• alper 15d ago
  I had to setup a Passkey recently and wanted to store it in 1Password and the experience was quite absurd. I don't know who designed this or who thinks these are acceptable affordances, but it seem to be part of the same disingenuous push that's behind passkeys in general.
  • deleted 15d ago
    [deleted]
• oxcartctl 15d ago
  [dead]
• commandersaki 15d ago
  Passkeys are a great way for attackers to have a secondary login into your account (e.g. Outlook, Gmail, etc.)
• OutOfHere 15d ago
  Passkeys lock you into a third-party provider ecosystem that you really should be trying hard to avoid getting locked into. They also add a quantum safety risk. Stay away.
• Grombobulous 15d ago
  I love passkeys as a tech enthusiast with a password manager that can hang on to them but I don’t love them as a confusing user experience for the average joe. I also don’t love how many websites and apps use them in stupid ways like using them alongside other 2FA or login methods when the passkey alone should be sufficient.
  • tigereyeTO 15d ago
    You’re the first person in these comments to mention 2FA with passkeys. My gripe with passkeys is they are almost always implemented without a second factor. You’ve mentioned the rare case of 2FA with a passkey as being a bad thing, but in my opinion those few cases are actually doing it RIGHT. With passwords and 2FA, if someone manages to copy your primary authenticator (password) they will still be locked out because they don’t have your secondary authenticator. This protects you against malware that steals your password database. But the way most companies implement passkeys (single auth), if someone steals your passkey database they can use it immediately. For all of the true measurable benefits that passkeys bring (not memorizable, higher entropy, automatic storage and use in a database) they are almost always used in a way that has this huge drawback: no 2FA. This is not an issue with passkeys directly, it’s an issue with how services implement passkeys.
    • kogir 15d ago
      It’s the passkey that should be protected with MFA (biometrics, PIN), not the account with the third party service. My Yubikey supports passkeys and protects them with a PIN of my choosing. No services need challenge me further.
    • Grombobulous 15d ago
      I think passkeys with single auth are fine because of how they end up being stored and managed. If you use them via Windows, iOS, Android, or macOS, they are tied to the biometrics on your device. Someone has to steal your device and unlock it to get in. They have to have something you know (phone unlock password) and something you have (biometrics). In a password manager case, trust is moved from the client device to the password manager itself. It is assumed that the password manager implements these things. For example, my 1Password needs to have both my password (something I know) and secret key or existing logged in device (effectively, something I have, as I don’t regularly type in my secret key as a password and don’t have it stored digitally except for within the password manager itself) to be logged in.
• BirbSingularity 15d ago
  That's why I just implanted my NFC passkeys. I've got one in my left hand and one in my right forearm. If I lose access to them, I have other, much larger problems.
• kccqzy 15d ago
  The author talks about the problem with using hardware keys, but they neglect to mention that many websites and apps simply do not allow the use of hardware keys! They will insist you use Apple or Google syncable keys. So after you have spent the money to buy 2 or 3 hardware keys, you find that they are not accepted.
  • account42 15d ago
    That websites get any say at all about which client-side software or devices you use is already a misfeature makes passkeys a nonoption.
• frizlab 15d ago
  Personally I love passkeys and think it’s not deployed enough. It works great (for me anyways!) and it is SO MUCH better than “login with email” that is everywhere now.
• EPWN3D 15d ago
  I went in expecting yet another screed about how passkeys were not issued by RMS in a FOSS encyclical, and therefore not only were they insecure, but they were also a morally bankrupt abomination. I was pleasantly surprised to read an actual thoughtful critique, albeit one I largely disagree with. The author's assertion that the greatest risk to an individual is account lockout versus phishing or password harvesting is just not grounded in reality. I get phishing emails and SMSs daily. The criminal ecosystem running these campaigns is extremely active already and set to become even more so with LLMs. These campaigns are by far the biggest threat to normies. Whereas account lockout happens most often with multiple failed password entries, which passkeys completely eliminate. I just don't know where this risk evaluation comes from. The author also points out that even with passkeys, if you're able to also log in with e.g. security questions, you still have a much weaker security footprint for that account. This is true, but it's also true of a TOTP second factor. So I'm not sure what the criticism is here. The exportability argument is a real weakness and something I'd like to see addressed. Passkeys don't have an equivalent for backup TOTP codes that you can just write down somewhere or trivially store yourself. But it probably wasn't in v1 because the people who designed passkeys figured that websites would not go all in on them immediately and would preserve other authentication methods, which is exactly what's happened.
• karlshea 15d ago
  Every time passkeys are brought up on HN it’s nothing but complaining and/or refusing to learn the basics about something new, but I’ve been switching to them on every site I can for months with literally no problems. 1Password everywhere, on iOS, Mac, and Windows. I’ve run into none of the issues elsewhere in the comments. Everything just works, including in-app logins. Maybe your other password managers are just bad at implementing the right browser/OS hooks?
  • michimagdesign 15d ago
    Passkeys work great with Bitwarden too. With it being set up on all of my devices I actually often prefer the passkey experience. Too many people depend on OS password managers or even the ones built into their browsers.
• patrickmay 15d ago
  From TFA: "Both Apple and Google want your identity anchored to their operating systems. The “happy path” on their devices is to use their synced passkey management tied to your Apple or Google account. If their automated systems decide one day to ban your account, you irreversibly lose access to all your passkeys used across all third-party accounts too." This is, in my opinion, the most serious problem with passkeys. I'd like to adopt them, but this is a blocker.
  • pamcake 15d ago
    If this is your only blocker you could still use passkeys with a different provider, like KeepassXC?
    • Macha 15d ago
      Not while the spec has provisions to allow sites to mandate certain providers.
  • dariosalvi78 15d ago
    you can use password managers that support passkeys, or a HW key
• pqdbr 15d ago
  Related: the UX is currently terrible. Every time I go to a website that has passkey flow, I'm presented with: - MacOS native UI; which I cancel; then I see - Bitwarden UI; which I cancel; then I see - Chrome UI; which I cancel; Like, seriously?
• inquirerGeneral 15d ago
  [dead]
• esafak 15d ago
  Well I like them, as an option. I offer using passkeys and email interchangeably; if you lose one you can recover with the other. Passwords, SMS, TOTP are out for me.
• MeetingsBrowser 15d ago
  > By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts. > Phishing through the standard login flow is eliminated by passkeys, but it creates a false sense of security. An account’s security is still dictated by the weakest recovery method: SMS, email links, security questions, and so on. Passkeys are too strong and may cause account loss. Passkeys are too weak and can be bypassed by account recovery.
  • beej71 15d ago
    > Passkeys are too strong and may cause account loss. Passkeys are too weak and can be bypassed by account recovery. Turns out, given the variety in the ecosystem, both these things are true depending on where you look.
• utopiah 15d ago
  Just yesterday I was showing to a friend how I logged in my self-hosted forge with my own hardware key. 0 intermediary yet proper and convenient authentication. If that friend ate the key (which he didn't) I'd just use my backup key, a cheaper non biometric one. I think it's not more popular because people don't care enough about security to buy actual keys, rely instead of 3rd parties that they don't actually trust, e.g. Microsoft, Google, etc then... complain it's not good enough.
• tonymet 15d ago
  Username and password was a predictable flow. Passkeys are just a small component in the modern obstacle race of logging in. Every few months a new credential or ritual to access your own resources .
• exabrial 15d ago
  These are the four flaws with Passkeys I've found after implementing them on our website. I actually like them now. But, It made me discover why people dislike them. The vast majority of problems are _the way websites implement them_ and _the way password managers today_ work. Website problems: * First big problem: you try to kludge them as an "add-on" to a password or SMS "2fa". Just rip the band aide off and let people go 100% passkey by default. It's actually really easy for users. We do a push at the end of their onboarding flow and have a 95% conversion. Users love it and its seamless. * Don't make people enter a username. Just have a "login with passkey" button first, and thats it. If the HIPPO in your organizations insists a username-password still be available, make the user navigate to a secondary page first to do so. Make the passkey the first-class citizen. Password Manager problems: * Google, Apple, Microsoft are trying to lock people in to proprietary password managers. Microsoft's password manager, plus their "microsoft account" experience is a steaming pile of shit. The key here would be portability. An export format exists for the public key (thats how enrollment works): It's a but of digits in ANSI X9.62 format. Not hard. The private key would be an unbelievably simple export. Protocol problems, and I'm happy to be wrong here: * The client does not sign the server issued nonce (aka the 'challenge') during the authentication flow. This is kinda weird IMHO. Technically, yes it is secure, but it relies solely on the TLS channel heuristics. It'd be much better to have the client prove the signature on enrollment as layered security. To address the author fears on attestation: This is a real threat to users... imagine a website "only accepting passkeys from OUR password manager". Luckily, Apple has done us all a favor and outright killed that part of the protocol by refusing to send this required fields there, protecting all users. Overall, you should use them. We need one tiny change to the protocol and better password managers.
  • hahamaster 15d ago
    I don't know much about passkeys, I have never implemented them. I once tried to find out more about them but all I could see is "you're going to regret using this one day".
• deaux 15d ago
  Passkeys suck because only the wealthiest 5% of the world is all-in on one ecosystem (such as Apple) while the remaining 95% uses a Windows laptop, an Android phone and (for the top 5-35%ish) maybe an iPad. All of these OSes push hard to get you to store your passkeys with THEM so it ends up a shitshow with everything scattered everywhere. And why do the OSes push for this so hard? Because the goal of the execs is lock-in and control. And their lackeys here on HN who implement this stuff and their families are the 1% who are all-in on one ecosystem so they arrogantly believe "this all works great and the masses are just too stupid to get it".
• SkyeCA 15d ago
  They're a solution to a problem that were created by people who are completely out of touch with normal users and how they use computers. Sure they work fine on a technical level, but they're frustrating and confusing for the vast majority of people I know.
  • PaulHoule 15d ago
    Depends. They make it pretty easy for people who don't think about the consequences of things. I worry I am going to get locked out of my Google account, muggles don't. Doesn't stop them from getting locked out. Apple has a vision where you have an iPhone and a mac at home and a mac at work and a vision pro and an Apple TV and all of that and your passcodes "just work". Doesn't work for the "rest of us", like we're already used to AirPods punishing us for using Windows.
    • fg137 15d ago
      Similar for "automatically enabling Bitlocker and uploading the keys to microsoft server". If it works without any issues, great. But if you ever run into one of the 50 messed up situations, good luck.
      • alt227 15d ago
        I have worked with windows PCs for a living for many years and I have never seen one do that.
        • fg137 15d ago
          Hint: google "lost bitlocker key reddit.com"
      • mrguyorama 15d ago
        No, microsoft uploading disk encryption keys to your account is the exact opposite situation. It's microsoft purposely reducing security to ensure there is a recovery path, because average people don't need or want the security tradeoffs where "You permanently lose access and it mathematically cannot ever be recovered" is a failure mode. If it was possible for a key to your house to have that failure mode, nobody would ever lock their doors
• kstenerud 15d ago
  I just had a very annoying interaction with the tailscale Android app: It wanted me to log in for some reason even though it had worked fine for months. Login uses my Google log in. When I try that, Google asks me for a hardware key to complete the login, even though it's my phone and I'm already logged in. Eventually I figured out that if you select "log in using another device" and then click cancel when it brings up the qr code, you can select a push notification on "another device", which actually pops up on the same device. Do that once and it fails. Do it a second time and it succeeds. All to use the tailscale app on my own phone.
• diego_moita 15d ago
  I hate them, mostly because I am forced to use them. They provide crappy usability, they're expensive, they're easy to lose, you can't use the physical keys when doing remote desktop access. My job requires me to use them. I use only for the job and nothing else. For sites requiring 2FA, I use TOTP (time-based one time passwords) from KeePassXC.
• otter-in-a-suit 15d ago
  I take passkeys over the unbearable cargo cult that follows LLM companies, namely companies' newly found obsession to "sign in via email". Ideally optionally followed by a 2FA (naturally, via text, delivered straight to my Mac, even further diluting the questionable security of the whole exercise) and naturally, to be repeated every 2 days or so, since "stay logged in" is the biggest lie after "I've read and accepted the ToS". Your phone (which is probably what, 80% of relevant traffic these days?) likely has a perfectly fine password manager built in. This "sign in via email" trend must be every scammer and phishers biggest dream come true...
  • PaulHoule 15d ago
    Almost everything has supported email-based password reset since 90's for all the problems it entails. I am looking at a new project that uses magic links sent by texts. I have been there and done that with authentication systems and that's good enough for a low stakes ludic activity.
• account42 15d ago
  > Passkeys are a fantastic technology. Since they are bound to the site they are created for, they cannot be phished by a hacker’s fake login screen. The same is true for passwords with a password manager. > If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details. Also not really a problem with randomly generated site-specific passwords in a password manager. Really all the browser vendors had to do was add an API to make automatically generate a password that is then stored in the user's password manager the low friction option.
  • rcxdude 15d ago
    If you're doing that you might as well use public/private keys. The issues with passkeys are around user experience and education about how they are stored, and a lack of good backup options like enrolling a not-present device as opposed to relying on syncing them through an external service.
    • account42 15d ago
      The difference is that no password manager I used ever tried to hide my passwords from me.
  • fph 15d ago
    The huge UX drawback of password managers vs. passkeys is sites that have arbitrary requirements. "Your password must be between 9 and 12 characters long, and include at least two capital letters and a special symbol". Well, my password is randomly generated, and enforcing that there are two capital letters would just reduce entropy. If sites fixed this issue instead of pestering me for a passkey I'd be happy.
• Shorel 15d ago
  For me passkeys work wonderfully synced in Bitwarden on Windows, Linux, and Android. I have no idea what this article trying to say, except some negative opinion that should IMO be ignored.
  • PennRobotics 15d ago
    The article was clear and reflects my own opinions: If you use an untrusted machine, you either revert to the least secure backup method (your master password in Bitwarden) or don't log in. If your phone is your trusted device and becomes lost/stolen and then replaced, you revert to the least secure backup method e.g. password, security questions, or even waiting to be manually verified. This can be problematic if your online bank requires 2FA so you can purchase the replacement phone. The QR + Bluetooth thing sounds dumb as hell. Kiwi Browser doesn't support passkeys even with Bitwarden on my device. I have to choose between an inferior (for my needs) browser or passkeys. ----- Rather than passkeys, which always rely on a trusted device, my preference is, "I use a password manager and site-specific generated passwords, and when I try to log in with only a password on your site, send me an email (whether pass or fail), plus never require 2FA except for banking and perhaps to change email/password" It's unlikely I'll lose access to email notifications at the same time someone tries logging in with a phished password (except, obviously, my email password, which should only be changeable with 2FA) unless I am specifically physically targeted or astonishingly unlucky. If someone uses a fake website or other MITM method to grab my credentials, I'll be fine because I'll get the "hey PennRobotics you logged in to crabcakes.com just now from a iPhone" message and then immediately triage that unexpected situation. If I need to log in to a website in private mode or on a different device, it takes an extra 30 seconds to log in to my password manager plus no device dependency. ----- The passkey problem for me? You need some hardware or else it's glorified 2FA or even (in the case of the Paypal app) 1FA applied twice, and as soon as you lose EITHER the hardware or the "what you are/what you have" part of 2FA you enter a world of trouble. Also, ToS lockouts happen. When Google terminates your account (for any variety of imaginative or realistic reasons) there isn't really any method to use or export your passkeys anymore.
• ideasman42 15d ago
  They're great when you don't own a phone - when you can't use random 2FA "Apps". As many USB-security keys can be used passkeys.
  • ur-whale 15d ago
    > when you can't use random 2FA "Apps". You don't need a phone to do 2FA : https://github.com/pcarrier/gauth https://github.com/pcarrier/gauth
    • account42 15d ago
      Not all 2FA is TOTP or a similarly-open scheme.
• AdamJacobMuller 15d ago
  > When storing passkeys in a password manager like Bitwardenor KeePassXC, you end up fighting the platform Very odd. I use passkeys extensively with BitWarden and I love it to the point where it's my preferred way of securing things at this point. The fact that the website presents the question to BitWarden in a structured way (what website, what username) means that I never fight with selecting the right account to get the password for (because I commonly have multiple accounts for a single site) and it generally makes the login flow much smoother. Environment is MacOS with Brave/Firefox + iOS.
• red_admiral 15d ago
  > Both Apple and Google want your identity anchored to their operating systems. The “happy path” on their devices is to use their synced passkey management tied to your Apple or Google account. <sarcasm>On the plus side, this way passkeys can also be tied to age/identity verification.</sarcasm>
• hn_submit 15d ago
  The future of authentication is....CertFP. Basically the same as passkeys, but a based on certificates that you can backup somewhere. If the browser supports them and stores them securely you're safe as houses even after a breach.
• xp84 15d ago
  The article asserts with little proof that lockout risk is a big problem. But consumer sites themselves basically 100% of the time have a recovery path that amounts to a SMS code or emailed code. The only part that is very persuasive is the part about storing your passkeys with Google or Apple integrations, and what happens if they ban your account. But the same argument would apply if you’re only storing your passwords in a Google or Apple password manager. I use passkeys and I always store them in a password manager I control - but usually I also store another one in the OS on Windows, Apple, and Google. Best of all worlds. Also, I appreciate that idiots aren’t forcing me to “change my passkeys” every 90 months like they STILL do with passwords!
  • buckle8017 15d ago
    Passkeys are mostly useless because of that. Their security is nearly universally undermined by reset mechanisms. There are virtually no sites where passkeys cannot be bypassed.
    • xp84 15d ago
      I know I can't speak for everyone, but I at least don't see the passkey as even pretending to solve that. There frankly is no solution for the problem you are talking about, because the 'average person' is extremely disorganized and barely understands anything about security or authentication, let alone how to manage their passwords/secrets effectively. And it appears consumers "don't want" that... arguably for good reason. We accept a tiny chance of being hacked in exchange for knowing that if our house burns down with all our devices in it, we won't be locked out of an Apple/Google account for life, even if we weren't wise enough to keep a DVD full of exported passkeys or lists of recovery codes in a safe remote location. Passkeys are in practice for one thing and one thing only (and they're very good at it!): Replacing passwords with something that unlike passwords: 1. The secret doesn't need to travel anywhere so it can't be stolen at authentication time 2. Uniform and large entropy not bounded by memorability, creativity, or misguided dumbass website owners ("Please use THESE AND ONLY THESE 'special' characters: ! @ $ % _ ") 3. Impossible to be improperly reused 4. Each device's secret is independently revocable. 5. Extremely difficult to 'phish' on a fake website. Even if we don't fix the "analog hole" so to speak where you can either SMS-reset or socially-engineer someone into resetting it, if we could kill passwords globally and replace with Passkeys, it would be probably the biggest win for security. I'd challenge anyone to name a better single thing we could do.
• thousand_nights 15d ago
  am i the only one on HN who really likes passkeys? so much better than fumbling around with a password managers
  • beej71 15d ago
    Lots of people like them, but it's clear from the complaints there's another large group for whom they are problematic. Enthusiasts are going to have to actually address those issues if they want adoption.
• nunez 15d ago
  I respectfully disagree with the author! Passkeys have been a massive quality-of-life improvement. Yes, there's the minimal risk of lockout if you lose access to the passkey (though almost every site I've used that implements pk's lays it on top of their traditional user/pass auth flow), but generally speaking most people use iCloud or their Google account to store their passkeys, and because those sync everywhere, this isn't a real risk. I love not needing to deal with 1Password's autofill being flakey and having to CMD-C/CMD-V passwords/passphrases/OTPs on these sites. I like Yubikeys as well but they are super inconvenient by comparison when dealing with multiple devices. Setting them up is also very user-unfriendly in general; doubly so compared to passkeys. Now, what I'd REALLY F'IN LOVE to see go away is the passwordless/magic link auth flow wherein you authenticate by clicking a magic link that gets sent to your email or text message inbox. "Emails are super easy to hack and we're still not sure whether text messages are safe to send on US carriers, so let's have everyone click on a link sent by email or text so that they don't have to deal with those pesky passwords that iOS or Android will automatically suggest for them." Like, what?
  • madog 15d ago
    > Yes, there's the minimal risk of lockout if you lose access to the passkey (though almost every site I've used that implements pk's lays it on top of their traditional user/pass auth flow) Exactly, if you lose your passkey you just sign in with your password like you did previously. I'm yet to find an app/website that has passkeys only and no passwords. Seems like a total non-issue to me.
    • morgoo 15d ago
      One of the big benefits of passkeys is that you can completely remove the ability to log in with a password!
      • tcoff91 15d ago
        Just spitballing here, but it seems like a good mix of phishing resistance & lockout recovery would be to have passkey-only auth, but with email recovery. So no password login, but then you can recover your account by adding an additional passkey by receiving an email.
• Barbing 15d ago
  Great writing and points Ethan!
• axus 15d ago
  Passkeys match a very unique situation where I don't want to store anyone's email address, don't want them to type anything, generally want to store as little information as possible. Also don't want it to be easy for people to share/steal passwords/accounts, and prefer storing on the local device. Windows still required entering a local PIN, sometimes 2-3 times. I think the account recovery didn't scale, though haven't really tested/explored with any real users :)
• einpoklum 15d ago
  I've not yet encountered a site which has even suggested I use something like a passkey. Under the assumption that you're doing the Right Thing, and avoid using Apple, Alphabet and Microsoft's services - this is a non-issue. In fact, even if you use their non-login-requiring services (e.g. YouTube, Bing, Google search) - again no passkeys in your life.
• eviks 15d ago
  > Since they are bound to the site they are created for, they cannot be phished by a hacker’s fake login screen. With the app you use to store those keys (a password/key manager) it's the same - you simply wouldn't have an autofill working. Sure, people can and will circumvent this for the benefits of the scammers, just like they can circumvent passkeys using non-passkey login option, indeed: > weakest recovery method: SMS > If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details. Similarly, don't other modern password storage methods have the same property? > lacks the decades of UX polish towards password autofill. A lot of years in those "decades" have been wasted polish-wise: you still can't log in with a single button, e.g., many popular sites only fill a username first, then require an extra dealy and action before accepting a password
• wnevets 15d ago
  I absolutely hate that so many sites are begging me to use them.
• MotoriX 15d ago
  I feel like we're solving one security problem while creating another. Passkeys make phishing much harder, but putting so much trust in Apple, Google or a password manager for account recovery creates a pretty significant single point of failure.
• nottorp 15d ago
  > When you have to handle a colleague’s computer, it gets much more inconvenient. Let's add to that: What if you're on holiday and your phone gets stolen or is suddenly 20 meters under water because it fell off the boat? What if you are a normal person who only has a phone and it simply dies for one reason or another? You get a new phone then hire the boat again, go above where your phone fell in and hope it syncs your passkeys?
  • AntonyGarand 15d ago
    You should always plan for your currently active device to be bricked suddenly and act accordingly. You either should treat your passkeys with a backup like any data, this can mean multiple hardware keys or a cloud backup of your passkey, like bitwarden or the provider's native backups.
    • nottorp 15d ago
      Bet you have a home lab. Not talking about you. After all passkeys are not there to protect people who have home labs and don't recycle passwords anyway? They're for normal people who only have one device. > who are happy doing that You think they're happy? I'd say they grudgingly comply at best. Suppose you do want a secure solution for the main sites your stuff is on. But every piece of shit content mill also wants to set up a passkey. Edit: wow i missed this: > a cloud backup of your passkey ... which is protected with what, a passkey?
    • raesene9 15d ago
      The key word in the post you're replying to is "normal". Non-technical people don't (in my experience) plan for this kind of thing, like at all. The idea of multiple hardware keys, which have to be enrolled individually to every site, is just not an ordinary end-user friendly activity. So passkeys may be great for technical users (who are happy doing that) or corporate users (where centralized IT systems can be put in place) but not for standard non-corp users (which realistically, is most people)
      • deleted 15d ago
• datron 15d ago
  The point about Google or apple or your passkey manager banning your account is a reason I'm still using random passwords in Keepassxc. I don't know if there is an open source passkey manager that syncs across devices that is self hostable. Anyway, companies should be educating users more on passkeys, how they work and where they get stored.
• deleted 15d ago
  [deleted]
• dariosalvi78 15d ago
  passkeys are excellent for security and horrible for usability. We did a students' project on that and decided to not invest on them, yet. But, hey, here is the new startup idea for you: make passkeys great!
• AIiscoming 15d ago
  I wouldn't mind it if all the services stop working properly when you use a Passkey but still want to use your other stuff like password and 2fa through app... GitHub breaks with this, PayPal breaks with this...
• ecesena 15d ago
  > By design, you cannot create a backup of passkeys on a hardware key In fact, I think it's technically possible. But it's true, as of today I don't think anybody supports it. I was experimenting on solokeys with ios, in principle we could backup Passwords (the ios/mac app) into a solo key, space permitting, including passkeys, regular passwords and totp (not wifi passwords). I believe the same is for Android, but haven't tested yet. This is all experiments I've been doing on my own, there's nothing ready to be released.
  • tadfisher 15d ago
    That quote is referring to the mechanism for backing up passkeys that only exist on a hardware security key, which deliberately does not exist. Moving keys onto a security key is possible for some devices, but that is a deliberate compromise, as these devices are designed to generate their own keypairs and never leak secret key material (thus preventing backups).
    • ecesena 15d ago
      Ops, I may have misinterpreted. I read it as take a passkey and copy/store it inside a hw sec key. Thanks for clarifying!
• deleted 15d ago
  [deleted]
• ethin 15d ago
  I love passkeys. Really. They completely eliminate the need for a password and OTP in most cases (when actually used as they were intended and not as a second factor only), although I always set up both in case. Although I will never, ever like how Google does it. I set up my first Google account with them and now Google absolutely refuses to allow me to authenticate to it because it wants a passkey I don't have (and of course there's no way of not using said passkey) or it wants me to use an Android phone I (also) don't have (I traded it in a couple years ago). And, of course, it provides absolutely no way around that problem. So eventually I just gave up and created a new one for the (rare) times I do need a Google account for anything.
  • jmull 15d ago
    > refuses to allow me to authenticate to it because it wants a passkey I don't have... it wants me to use an Android phone I (also) don't have And yet you love passkeys? How much will you love them when you're locked out of something you can't do without?
    • ethin 15d ago
      > And yet you love passkeys? Yes. The security benefit can't be overstated. > How much will you love them when you're locked out of something you can't do without? I certainly wouldn't be happy if this did happen, but it would be my stupidity (or the stupidity of those who implemented it on the service/platform where the problem occurred) which I would blame more than the fault of the tool. I do keep all passkeys in Bitwarden now so that's something at least.
      • jmull 15d ago
        > The security benefit can't be overstated. Security benefit appears strongly overstated. Compared to using a password manager (including generated secure passwords for each account), there isn't a significant security benefit. passkeys require using a manager as well, so there isn't much point. > ...but it would be my stupidity... All people are stupid sometimes. A security flow that doesn't account for this very well isn't a very good security flow. (Related: everyone tends to be unlucky eventually, and, unfortunately, everyone becomes incapacitated/dies eventually. Security flows need to account for these as well. Not to mention that in my experience, no software company continues to offer a quality service at a reasonable price forever. You're lucky to get 10 years. Having access to my accounts tied to a single piece of software is likely to become a big pain at some point.)
• poppycock23 15d ago
  I hate that there's no accepted definition whether passkeys should be considered MFA or not. As a result, some sites treat it as MFA and you just provide passkey and you're in, which I like. Other sites still ask for a second factor after I provide a passkey which I think is stupid. At that point, it's simply another password I can't remember. I should not be prompted for a second factor after I log in with a passkey.
• megous 15d ago
  I don't like attestation. That is dangerous to user freedom. I don't mind other parts of this technology. Attestation already destroyed user freedom in mobile app ecosystem. You can't just implement your version of some mobile banking app or whatever just by using original app's API, because dark overlords of gated app comunities allowed app authors to prevent this on OS level by giving them attestation tools.
• yoz-y 15d ago
  I just don’t get how passkeys are supposed to be an improvement. On any site where I create them the login experience gets worse. Sometimes I get a QR code to scan (terrible, almost never works too). Sometimes I am offered to login with passkey which I have and it doesn’t work. Almost always I need to fallback to password and it just sucks. I hate passkeys. I wish there was a checkbox somewhere to tell all websites that I never want to use them.
• fg137 15d ago
  I find it annoying that so many apps and websites push passkeys onto users without informing them the basics of passkeys, including how it's associated with those specific devices/password managers or how to prepare in case a device is lost. Meanwhile as a user who uses a password manager to generate a different password for every site and has autofill enabled everywhere, passkeys barely improve my life if not making things more confusing.
• HoldOnAMinute 15d ago
  I hated them at first, but since I am already dependent on iCloud Keychain to manage my passwords, I just figured there is not really any additional risk. I just make sure I will always have multiple, healthy devices, which are always patched, charged, and sync'ed. And don't put them all in the same physical location at one time.
  • recursive 15d ago
    Multiple authentic Apple(TM) devices? What a coincidence, that the solution to security should be so beneficial to a giant corporation.
• przemub 15d ago
  > When storing passkeys in a password manager like Bitwardenor KeePassXC, you end up fighting the platform I must say it's pretty amazing how well-integrated is Bitwarden with iOS now, passkeys, password generation, everything. I have disabled Apple passwords manager, and Bitwarden feels like the native solution.
• r_i_m_b_a_u_d 15d ago
  Linux support seems really bad, so not very useful for me
• torstenvl 15d ago
  > To an individual, the greatest risks are instead permanent account lockout, automated account bans, and device loss. By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts. I'm glad to see this view becoming more mainstream. Passkeys are grotesquely insecure. The only possible way to consider them more secure is if phishing attacks were more common and more damaging than lockout, which is so implausible that I reject the idea that someone could take that position in good faith.
  • _wbpr 15d ago
    > Passkeys are grotesquely insecure. Lockout is a real risk, but there is nothing insecure about passkeys. Private keys stored on the secure enclave + biometrics or passcode before any signature is produced + origin binding mogs a static string and a 6-digit TOTP (often generated with a secret key outside the secure enclave) that can be phished and entered from anywhere. Also, in many (possibly the majority) of scenarios where someone is locked out of their passkeys, they’d also be locked out of TOTPs and passwords. > The only possible way to consider them more secure is if phishing attacks were more common and more damaging than lockout You’d be surprised.
    • torstenvl 15d ago
      > Lockout is a real risk, but there is nothing insecure about passkeys. secure - adjective se· cure si-ˈkyu̇r -ˈkyər securer; securest 1 a: free from danger b: affording safety (a secure hideaway) c: TRUSTWORTHY, DEPENDABLE (a secure foundation) d: free from risk of loss Passkeys as a sole/required method of authentication increase the risk of permanent loss. In any other configuration they do not mitigate phishing risk. It is not possible to say there is nothing insecure about them.
      • _wbpr 15d ago
        Reliability != security If a car breaks down every 50 miles we would call it unreliable. If a car’s doors don’t lock we would call it insecure.
• _wbpr 15d ago
  > A combination of randomly generated passwords stored inside a third-party password manager, paired with an independent TOTP app, gives control to the user without giving up the flexibility of plain text. No grandma, don’t use the unphishable one-click passkey setup that syncs across all your devices. Instead, install a third-party password manager (no, no, not the one built in to your device or browser), then another TOTP app on your phone. It’s slower and more susceptible to phishing, but uhhh, what if you’re among the one in a million people that has their Google or Apple account wrongly banned?
  • unethical_ban 15d ago
    Infosec for 15 years, and I do not want passkeys either. Anything that attaches itself to hardware is susceptible to loss. Anything that attaches itself to hardware makes it harder to use services from a new device. At some layer you have be able to access your services with password/totp if only for recovery. Passkeys add a layer for minimum benefit, in my opinion. Yes, push based totp and passkeys are more phish proof but for non techies, managing them is its own job.
  • Whitespace 15d ago
    > syncs across all your devices My Macbook can sync passkeys from my Android phone?
    • _wbpr 15d ago
      Yes, there are several ways. You can use Google password manager on your MacBook. I believe 1Password and Bitwarden support this too. You can also use the Android phone itself as a passkey device with the QR code flow. The UX is obviously a lot smoother if you have an iPhone and use iCloud keychain for everything, but that’s not an uncommon setup.
• ofjcihen 15d ago
  Just a small clarification, attackers can definitely steal a passkey from your key store and use it if your corporate settings are incorrect IE. device attestation is turned off. My company has already responded to multiple breaches where this has been what quickly follows an initial intrusion.
• rconti 15d ago
  My situation at work is absolutely untenable. Constant redirects, logins that used to have passwords but now have passkeys, but you don't find out until you enter the password. Chrome hijacks the passkey dialog and wants me to use my yubikey, but I have to fumble around and bypass that to then get it to prompt me for a passkey in Apple Passwords. (as long as 1Password isn't trying to intercept my passkey requests today!) Then on top of that there's a whole 2nd factor layer which _also_ typically involves a touchid press but for a totally different reason (as the 2nd factor, not to unlock the password safe storing my passkey. It's just an ugly inconsistent dance, dozens of times a day. I know these gripes are mostly about implementation, and partially about user-facing software, and partially about user choices, but it doesn't make it any less ugly for the user.
• alistairSH 15d ago
  My only issue is the ... unclarity... with them. The option pops up in the middle of a normal log-in flow. I'm guessing most non-techies don't know how it's implemented. Oddly, some login flows display a normal user/pwd form, but you get the in-browser "use a passkey?" option/popup which further confuses matters. Thankfully, me, wife, and all our parents are tech-savvy enough to use password managers, so the fallout from lost passkeys hasn't be an issue. But I certainly see how it would be an issue for anybody entering passwords from memory or similar.
• tway235 15d ago
  password managers that allow to export OUR passkeys: Bitwarden, Enpass it's all backwards, I agree, even worse that we trust "sync to the cloud" but don't allow users to own their credentials.
• avazhi 15d ago
  I have not and will not use them. There have been a few times a site has required one and I’ve just moved on to something else.
• Simulacra 15d ago
  Passkeys are really an abdication of cyber security responsibility by the vendor. Offload everything onto the consumer, and you have plausible deniability for anything that happens.
• pnw 15d ago
  Why doesn't Chromium let me turn this 'feature' off?
• dchftcs 15d ago
  One point that Google wants to own all your data but have the power to ban you with a faulty ML algorithm with no recourse. False banning that affects someone's normal life must be punished if the service provider tries to lock you in. You and lock people in or have power to arbitrarily ban them, not both
• rkagerer 15d ago
  I really wish I could block the repeated "Set up a passkey" nag by preventing my browser from advertising passkey capabilities. I don't understand why we can't have a Off switch on the client side.
  • pndy 15d ago
    You're not the first commenting on this and I wonder what's the trigger because I haven't seen a single suggestion for setting up a passkey anywhere.
• pastel8739 15d ago
  We added passkey support to devices for convenience, but I feel like it is a big part of what has made them so confusing. The mental model of a hardware security key is _so much_ more familiar and intuitive. (But you still can’t “copy” a key, which is unfortunate).
• benry1 15d ago
  I LOVE passkeys. That said, I store them in my password manager, which means anywhere I have access to my password manager, I can easily login via passkey. I can understand they would be a pain if I was often using new devices and did not have a password manager. I also admit it can increase the risk of lockout, but the sites I have passkeys for generally have recovery methods. The only issue I've had is sometimes a website has poor support for my password manager, and I can't find a way to put in my passkey. That is very annoying. The benefits are worth that IMO - can't forget my passkey, can't phish my passkey, can't be hacked serverside. It's a clear upgrade to passwords
  • hobo123 15d ago
    I feel if the _website_ needs to have support for your _password manager_, then that technology is way too fragile for me to want to use it.
• deaton 15d ago
  I don't like passkeys either (I use a password manager anyway, and long secure unique passwords), but I understand the need. But yeah it really annoys me when every website wants to give me a passkey, or wants me to use a passkey, instead of just taking me to a page where I can enter my novel-length password.
• zeitgeistcowboy 15d ago
  The risks mentioned are not equal. I’d prefer getting locked out of my account to having all my money stolen.
• alsetmusic 15d ago
  The page forces a jump to top when in reader mode in Safari on my iPhone. Hostile. Wanted to read the article, but left out of annoyance. Yeah, but I agree with the headline. I don’t want to be tricked into enabling this “feature” that I find burdensome, but some sites try hard to coerce enabling it. The modern web is a bummer.
  • ethanhawksley 15d ago
    heya! sorry about that, I don't usually have an iPhone on me to test updates to my site so I must've broken something in its reader mode. I'll be borrowing one tomorrow and try figure out what's causing this :)
• monjuick 15d ago
  Relevant side project of mine: https://monjuik.github.io/shellty-passkey-server/ https://monjuik.github.io/shellty-passkey-server/ It’s basically server side of passkeys as boring as possible: self-hosted Go binary, Postgres, REST API, and no requirement to move users into another IAM system. Would be interested in criticism from the passkey skeptics here.
• steve_avery 15d ago
  My biggest gripe with passkeys is that the spec seems to force non-interoperability. I use a password manager and I would have no issue storing a private key in a profile there, but I am literally not allowed to be able to copy the private key. If a spec thinks it knows better than me, I won't use it. And don't you just love the fact that now Apple and Google and Microsoft have MORE control of my identities across the web?
  • teravor 15d ago
    some password managers can pretend to be a passkey. but I don't use them because it requires finicky brittle configuration (and docs lookup whenever you want to redo it). if passkeys had a simple text challenge response text option it would be fine, you would basically be using something like PGP logins. and would be easy to implement in a password manager interface. as a result, I have zero interest in passkeys. a pity as it could have been useful (cold storage password manger + physical passkey). you can never trust any service to honor "backup" login options, got burned once for "suspicious activity". that is, if you lose a login option (passkey is lost) they can demand it in the future to "verify".
• FireBeyond 15d ago
  I also despise that in between OSes, browsers and certain sites I am having to close/cancel/skip sometimes three or even four dialogs to say "No, I'm not interested in changing my login method to passkey" (PayPal is one example).
• hkchad 15d ago
  I have passkeys on literally everything that will support them and store them in 1Password. I can access them on my laptop, phone, desktop without issue.
• abustamam 15d ago
  I like the idea of passkeys. And ive been seeing better support for them. I use Bitwarden as a passkey manager and it mostly works across devices. What's irritating is when the provider messes up passkey integration. As an example, recently Sony asked me to setup passkey. I did. But it skipped bitwarden somehow and went on my phone. I tried to login to my Playstation account on the computer and it directed me to continue logging in on my phone. I did so and then the web client just said an error occurred. I turned passkey off on Sony.
• secabeen 15d ago
  It's the classic "make your problems worse to fix my problems" that you see across tech. Since they don't care if you get locked out or leave their platform, it's designed to make them maximally profitable. It's the same thing you see when sites "offer" to let you do pre-registration work before an event or transaction, even though doing that work at registration is often trivial. Want to get a RealID? You can spend 30 minutes scanning and uploading your supporting documents through the website, or you can hand your documents to the person at the desk and they'll evaluate it in 30 seconds. Over thousands of people, it's rational for the organization to optimize away that 30 second review (it also gives people a recovery option if they don't bring the right documents.) For the customer who is competent enough to bring the right documents, the latter approach is way more efficient. I regularly have to put myself in the "I'm old and hate technology, so lets do this the manual way at the desk" flow even though I'm totally capable of doing the electronic flow.
• janandonly 15d ago
  I don’t get the hate for passkeys. It feels like a state sponsored attack at a reasonable (not perfect) tech. Locked out of device? You should use a password manager which you can still log into again on a new device. Want to log into a service on a device you don’t own? Log into by scanning a QR code with your passkey (windows offers this standard when you keep a passkey on a different device for example).
• outlore 15d ago
  Passkeys in bitwarden have been working pretty well for me overall. Website support is still spotty. Sometimes passkey logins won’t work, or other times the website will still ask for a “third” factor code. For less tech savvy folks, passkeys are a godsend since they don’t have to remember passwords or fish around for codes
• cedricgle 15d ago
  What happens with the Fifth Amendment when a platform imposes passkeys and you don't have a device with a pin (if that even possible to combine them) ?. Given you don't see the password, then you can't memorize it.
• intellix 15d ago
  the only thing I don't get is why a 4 number PIN on Windows Hello counts as a passkey. Obviously it can be as long as you want but
  • alt227 15d ago
    the pin is not the passkey, the pin is security to access the module which holds your passkey.
• krupan 15d ago
  Fake websites pretending to be legitimate websites in order to steal your passwords was considered a HUGE problem. That's why TLS includes website certificates. The implementation is kind of a mess with commercial Certificate Authorities (CAs) being too expensive for small businesses to use, CAs getting hacked, or downright shady CAs that couldn't be trusted. A lot of websites didn't use TLS because of these problems. It took decades to get to the point we are at today where we have Let's Encrypt and all websites using TLS. Yet phishing still works because fake websites can use a URL that looks legit and they can get a certificate for that URL. We need to get away from shared secrets for authentication. Passkeys are fundamentally a way to do that, but they aren't perfect. Personally I wish TLS and Passkeys both were way less complicated. I think we could use asymmetric encryption for authentication without certificate authorities and secure enclaves and all that and still be more secure in general than we are today. Think ssh keys. But no browser or webserver does that. I think our best bet is probably to aggressively use passkeys and work (as was done with with TLS) to make them better until it mostly fades into the background like TLS has. The best solution I've found is yubikeys. I keep them on my keychain with my car's key fob. If I lose that key fob I don't know how I get my car started. It's not like the old days where you could pick the lock or get a few copies of the key made for cheap. Same with yubikeys. I worry about losing my yubikeys about as much as I worry about losing my car keys. A little, but not too much. I use both so often that it's not too hard to keep track of them.
• rietta 15d ago
  I’m still terrified how normal people are going to navigate being locked out of their email account because their device that was their passkey is no longer accessible and there’s no backup solution to restore access. I’ve similar issues even in a lower level with LastPass where it won’t even let you enter your two factor if it doesn’t recognize where you’re coming from but then you have to be connected to your email, but your email password is stored in LastPass. There is a real possibility of being locked out at all devices at the same time and not being able to get in to the first one.
• verytrivial 15d ago
  In a corp environment, it is the business's problem when a user's passkey devices fails. In a personal environment, it is the user's problem. Specialized knowledge and preventive processes in the corp environment aren't present in the personal context, and saying "pretty please" to Google or Apple when something goes wrong is usually a waste of time. I 100% agree with TFA -- "damage expectation" is probably higher with passkeys.
• projektfu 15d ago
  Multiple sites (e.g. Microsoft) currently ask me to use the passkey to log in after I enter my username, but the passkey doesn't seem to be stored anywhere. I usually will end up scanning the QR code to check if it's on my phone and get a negative answer. Then I have to go through the regular password + 2FA ritual I was already ready to use. After that, I am not given the option to store a passkey on the device I am currently using or on my phone. Process repeats next time. So much fun using passkeys. I think there are two sites where I can actually log in using them. I also don't like the way the pop-up is always so automatic and interrupting. Why not a button like other ways to log in?
• mahboi 15d ago
  I use passkeys, but the UI seems less user-friendly than SSH which is conceptually similar. When I SSH into a machine that has me in authorized_keys, it just logs me in. Passkeys are like 8 clicks telling the site and browser repeatedly that I want to use the damn passkey. Can't it be "remember me forever"?
• rc_kas 15d ago
  Very much in agreement with this post. They are secure, they also cause me great fear of getting locked out of my own accounts if my hard drive crashes.
• nly 15d ago
  I mean, they're basically just client SSL certs, but used for auth instead of transport It's entirely possible for server side app to tie a client certificate to a user account and offer one click login and it has been since the 90s.
• TeMPOraL 15d ago
  Very solid points, and I love the focus on the fact that passkeys are addressing threats irrelevant to regular people, while ignoring those that matter. But I think it's still incomplete, because it's missing the biggest blind spot in design: Password sharing is a feature, not a bug. Security industry failed to implement the most basic feature one does with access control at individual level, which is delegation of authority. Physical security in form of "bearer" devices, such as keys, credit/debit cards, transit tickets (except those newfangled ones bound to photo ID), etc. all support this by default. Ad-hoc delegation of authority is a normal thing to do, something we do all the time without thinking. Asking your kid or friend to do groceries for you? You hand them your debit card and give the PIN. Need a nanny to walk your kid from school and stay with them until you're back? You make them a copy of your house keys. This carried over naturally to technology realm. A colleague needs to get some data that happens to exist only on your machine, while you're away? In normal non-corporate places, you just write the password on a post-it and give it to them, or put it in a drawer and tell them to go look there. Security industry failed to provide a reasonable alternative path for over four decades now, and instead continues to deny the very existence of the need for ad-hoc delegation of authority. Passkeys are a bad choice for regular users largely because they're designed to prevent delegation - on top of the other issue, that the author correctly recognized, which is that by far the biggest threat to regular user is that of loss of access to account.
  • john_strinlai 15d ago
    >passkeys are addressing threats irrelevant to regular people phishing is very relevant to regular people
    • TeMPOraL 15d ago
      Not really that much in comparison to losing access when needed. It's relevant to corporate employees, where phishing is worthwhile to attackers, while losing access means creating a ticket on internal helpdesk and having rest of the day off.
      • john_strinlai 15d ago
• sauercrowd 15d ago
  I find Passkeys are amazing once you accept they are not your only path in, just a much more convenient one. Have your accounts and totp with an authenticator set up, but add on every device you like a passkey to create a fast path. Removes the need for syncing any passkeys, the risk of getting locked out, and the terrible support of 3rd party password managers providing passkeys
• sholladay 15d ago
  I’m convinced that a lot of the passkey hate ultimately stems from the inconsistent and confusing flows that websites have implemented in the name of backwards compatibility with passwords. I have made some apps where passkeys are the only way to log in and it is such a lovely experience. It can be as simple as a single log in button by itself, with no intermediate pages or other UX. There doesn’t even have to be a form to fill out at all. The problem of losing physical access to your passkeys is only really a problem if the site chooses to be strict. There can easily be a “Send a magic link” button where you type in your email. It’s the equivalent of “forgot password”. For most systems, it’s already accepted that your security is only as good as your email provider’s is. Passkeys make it straightforward to have an email-less model, but you always could have done the same thing with passwords. No one forced you to implement “forgot password”, it was simply a practical approach that was worth the security tradeoff. People seem to assume that we should leave that functionality behind in the transition to passkeys but I’m not so sure. It certainly seems more practical than trying to get users to maintain physical backup keys. The concern about exporting passkeys is valid but you can share via AirDrop. Doesn’t that work on Android now? Try to give passkeys a chance. I really think the growing pains are worth it.
  • CodeWriter23 15d ago
    Nah, it's the transmission of the keys to Apple or Microsoft. We flatly rejected key escrow during the Clinton Administration, and I continue to reject it. And no, I absolutely do not trust their implementation of E2EE to mean there are no backdoors.
    • sholladay 15d ago
      Are you aware that none of that is required when signing up for a site that supports passkeys? I think there is some confusion here caused by sloppy use of terminology among FAANG and the standards groups. You’re right that, strictly speaking, Apple defined “passkeys” as synced credentials. And you’re also right to point out that, as a result, in order to consider them secure, you must trust Apple’s key storage and E2EE iCloud syncing, or the equivalent from other vendors. I wouldn’t blame you for being skeptical about synced credentials. The convenience may not be worth it for you. However, crucially, synced credentials are just one type of FIDO2 credential. The other is a hardware-bound key from a “roaming” authenticator (aka a “security key”). These are never transmitted, never synced, and you can buy the security key hardware that generates and stores them from many different vendors, all of which are designed to be interoperable. In other words, all passkeys are FIDO2, but not all FIDO2 are passkeys. Yet, when a website says it supports passkeys, it probably means it supports all FIDO2. And that’s because WebAuthn, the browser standard used to implement passkey registration and authentication on the web, supports all FIDO2 credentials, not just passkeys. With WebAuthn (and most other systems), by default both platform authenticators (which would typically be synced, like you’re talking about, but not necessarily) and roaming authenticates (which would be typically be a USB security key, not synced) are allowed. I’ve occasionally stumbled upon sites that don’t allow platform authenticators, but I’ve never come across one that doesn’t allow roaming authenticators. It sounds like you want is the latter. Apple could have avoided this mess by simply deciding that “passkeys” are the new name for “FIDO2 credentials” and then we could have synced passkeys and non-synced passkeys. But they apparently thought that was too confusing.
• reboot81 15d ago
  I like passkeys. I dislike how websites vary the implementation of passkeys. One thing Ethan misses: you don’t necessarily need one passkey per site. A single passkey protecting Google, Apple, Microsoft, GitHub, etc. can indirectly authenticate you to hundreds of sites via OAuth/OIDC (Sign in with…), while consuming only one resident credential on the hardware key per identity provider. That makes the “hardware keys can’t store enough passkeys” argument much weaker in practice.
  • hobo123 15d ago
    But that's another thing to avoid because now Google can lock you out of 100s of services at once if they ban your account.
    • hobo123 15d ago
      We really need Firefox Persona back...
• throwawayk7h 15d ago
  What I dislike about passkeys far more than any of those qualms is that they can implement remote attestation. A website should not be able to dictate what application I use for passkeys, what hardware the passkey is stored on, or whether I'm allowed to duplicate my own key.
• Velocifyer 15d ago
  I belive that passwords with TOTP are far better than passkeys.
• Velocifyer 15d ago
  What is the point? As long as you (the service) hash passwords securely, and the users use random passwords with a password manager, you are fine. A password is far easier to type onto another computer or a diffrent web browser.
• loeg 15d ago
  This blog post and also comment section are a tire fire of misunderstanding. Passkeys solve a couple crucial problems 99.99% of users face, including smart, technical ones who use password managers. They have great ergonomics. They do not obviate having some kind of recovery flow and are not intended to.
• Groxx 15d ago
  >This leads to passkeys being the perfect fit for a corporate environment, but a poor fit for personal security. I 100% agree - almost everything about them screams "this is The Ideal Corporate Solution". This isn't a bad thing, it's nice to have a standard for corporate uses. And the attestation-DRM stuff makes perfect sense there, you already have MDM and it fits with that perfectly....... though not all that differently than using MDM to set up client-side certificates. But app/OS support is better, for some reason. Why didn't they just improve that flow? For personal use though, they seem outright hostile to people living in the real world with common failure modes. It's outrageously clear that normal people were a distant afterthought - just look at how hostile it was to syncing at the beginning, and how long it took to get key exporting (and how directly hostile they were to anyone building a stopgap in the meantime).
• miladyincontrol 15d ago
  Honestly I like passkeys much more when the majority of my usage is through my mooltipass rather than using those software keys Really just wish there was a newer gen of the hardware I'm not going to suggest it's a perfect system though, but I do much prefer it to SMS/email "2fa".
• someguynamedq 15d ago
  I personally love not having to type in a password
• flumpcakes 15d ago
  I use passkeys, hardware ones, and I am very happy with it. I don't understand why people dislike passkeys, they are the most secure system we could possibly do and I am also very happy that the major companies are accepting them. It seems to me that people would prefer to be insecure and use something that is familiar and easy to understand, than be secure and have to do something different.
• nbobko 15d ago
  > Although operating systems have recently introduced APIs [...] for third-party tools to hook into, the experience remains fragmented and lacks the decades of UX polish towards password autofill. Autofill outside the browser and inside native applications remains especially inconsistent. I disagree. It is just a wrong statement. Passkeys actually eliminate the flaky autofill part where password managers have to parse input fields. Ever since I learnt about KeePassXC and KeePassDx, I've tried to migrate as much of my accounts to passkeys. The experience is wonderful and KeePass allows me to see the private key behind the passkey - yes, yes, yes!
• GenericDev 15d ago
  [dead]
• publlus_enigma 15d ago
  This article touches on something I've been ruminating about the past few months - the lack of control users have over their own security posture. Like many people, I use dozens of online applications a day, from banking through to childcare booking platforms to online shopping. With data breaches becoming ubiquitous and a common occurrence, providers are under pressure to secure their platforms. This means they're all attempting to implement "best practice", with various degrees of maturity and efficacy. The consequence of this is a huge degree of friction on a daily basis. Myriad authentication apps and schemes. Some using TOTP. Some using SMS 2FA. Some using push notifications through their own app. Some using magic links via email. Some with passwords, some without. Maintaining all these has become a significant administrative burden. But the enforcement, and inability to opt out, means I have limited say in choosing NY security posture for each service. Some accounts I have are throwaways that I couldn't care less if they were compromised. Even with strong and secure passwords, I still need 2FA. Worse, those that I do want a strong security posture with often have a backup recovery scheme, such as magic links via SMS, that I deem inherently insecure. Yet I am expected to trust that the platform provider knows what is best for me. As mentioned in the article, losing access to platforms has been a bigger issue for me than account compromise. For example, I had an old Twitter account I wanted to access once X took over. Although I had the password, they had implemented 2FA since the last time I logged in. Since In didn't have a current email on file with them, I couldn't receive the verification link and have now permanently lost access to that account. Providing that I had the (strong) password, that I was using the same static IP address I originally signed up with, and providing government identification was insufficient to regain control. I'm a fan of passkeys. I now also use a Yubikey. But simple passwords still have their place and can be useful and secure I'd handled well on both sides.
• sitzkrieg 14d ago
  every single website i use that supports passkeys prompts me to save a passkey in pw manager every single time i login. not specific to the password manager or browser really, and existing do not matter. every chrome based browser cant keep track. makes it look like a totally garbage, amateur implementation getting prompts for saving a new passkey constantly
• MetroWind 12d ago
  It ultimately comes down to this: it is utterly dangerous and stupid to depend your accounts on third parties (including your phone).