4 ms·

I respectfully disagree with the author! Passkeys have been a massive quality-of-life improvement. Yes, there's the minimal risk of lockout if you lose access

• madog 15d ago
  > Yes, there's the minimal risk of lockout if you lose access to the passkey (though almost every site I've used that implements pk's lays it on top of their traditional user/pass auth flow) Exactly, if you lose your passkey you just sign in with your password like you did previously. I'm yet to find an app/website that has passkeys only and no passwords. Seems like a total non-issue to me.
  • morgoo 15d ago
    One of the big benefits of passkeys is that you can completely remove the ability to log in with a password!
    • tcoff91 15d ago
      Just spitballing here, but it seems like a good mix of phishing resistance & lockout recovery would be to have passkey-only auth, but with email recovery. So no password login, but then you can recover your account by adding an additional passkey by receiving an email.
      • jayknight 15d ago
        Just make sure you don't lose the passkey to log into your email.
        • Synthetic7346 14d ago
          Isn't it the same as my password manager's vault? I only remember my master password so if that vault is lost I can't even log in to my email
          • jayknight 14d ago
            Kind of, but I have some of my most important passwords and account recovery codes duplicated on paper in a secure place. If there was ever a service that only allowed passkey login (do those exist?), you can't print those out.
        • tcoff91 14d ago
          I'd still prefer password+2fa+backup codes for email.
    • nunez 14d ago
      I wouldn't be okay with that. Say you're setting up a new iPhone with a new iCloud account because you forgot the password to your old one. (Unlikely scenario amongst us nerds, but very very likely outside of our bubble.) If you want to log into, say, Google, but the passkey flow is the only way in, then you're almost-completely SOL unless you have some way of getting the passkey out of your iCloud keychain and into the keychain of the phone you're setting up. If you still have your old phone, you can scan the QR code and get in that way. If you don't, then you're completely SOL.
  • epihelix 15d ago
    Ok, so the big security risk that passkeys are supposedly designed to stop, is actually still there? If you can still be phished, remind me what the point of any of this was, again?
    • madog 14d ago
      Ignoring any supposed security benefits, personally I use it because it's much more convenient/ faster than logging in with a password since. You're still slightly less likely to get phished if you only ever login with passkey and only use the password in case of lost passkey. Of course you could get phished that one time but entering your password once (maybe never) has got to be better than entering it daily. I don't have any passkey accounts where I didn't start off with a password and after adding a passkey the password login method was always retained. What services are people using where you don't need to set a password?
  • deleted 15d ago
    [deleted]
• boronine 15d ago
  Majority of websites use email to authenticate (“forgot password” flow). Passwords/passkey is just an optional convenience for quicker login.
• drtz 15d ago
  > and because those sync everywhere, this isn't a real risk. Do they sync between Android and iPhone devices?
  • hobo123 14d ago
    I wouldn't even know how to sync any of those to my Linux PC.
• rdsubhas 15d ago
  > what I'd REALLY F'IN LOVE to see go away is the passwordless/magic link auth flow This seems really naive? That's the only flow that's at the basis if you get locked out. What else, do you put people on the phone to verify people by asking their name and date of birth? That's even worse!
  • stetrain 15d ago
    I think they're referring to sites where that is the only way to sign in, which I have seen a few of. Basically you can never register a password or passkey, every sign in requires going to your email and waiting for the link to arrive.
    • n6242 15d ago
      I've seen Slack and Claude doing this among others, it's turned into one of my leading red flags for untrustworthyness.
      • stetrain 15d ago
        I get the idea. If email links are secure enough to use for password resets, just do that every time. Then you eliminate a whole category of password attacks. But it’s definitely annoying for a frequently used service.
        • callc 15d ago
          Maybe this gets us closer to some idea of email being a more protected digital service, that has some legal guarantees? Putting the potential negatives under the rug for a second… I would be nice to have email that (1) you can’t get locked out of arbitrarily, (2) acts similarly to US mailbox (in its protections and universal service), (3) acts as an identity Is this a bad idea?
          • nunez 14d ago
            Horrible idea. This will require every email vendor to certify with every country they provide service to that wants to do something like this, which will pretty much kill any small/indie email hosting providers. I'd much rather have stricter legislation around password resets built into existing reg frameworks like PCI or HIPAA. If you store a form of payment or PII with a provider, then some form of human verification should be needed to perform a password reset.
• kyle-rb 15d ago
  > Emails are super easy to hack Source? And if somebody hacks my Gmail account, won't they be able to access my Google-synced passkeys? Magic link auth isn't any less secure than any site that has a password-reset flow.
  • nunez 14d ago
    A family member installed an app into their Android phone from the Play Store. It was innocent enough until it asked for a truckload of permissions, like being able to change the launcher, which they ofc tapped "Allow" to since permission request fatigue is real and still a bit of an unsolved problem. So the app delivered on its promise and changed their phone's launcher. It had a fake Gmail widget that showed them their mail but, of course, wasn't actually tied to the actual Gmail app and was an easy way of getting a refresh token for their account. Bingo bango bongo: their email was now at risk. They changed their password after I told them to right away upon them asking me to look at their phone because "it was slow." > Magic link auth isn't any less secure than any site that has a password-reset flow. Which is exactly the problem. Cloning someone's SIM/eSIM and immediately performing password resets is a well-known security issue.
    • dsl 14d ago
      If you are blanket accepting permissions passkeys do nothing to fix the attack you describe (on device phishing).
    • kyle-rb 14d ago
      > Cloning someone's SIM Yeah I don't trust SMS either, that's why I said email. You can do a lot more to protect your email account than your phone number. It's very disconcerting to think about how many malicious apps like that must exist in the Play Store, but again, gaining access to someone's Google account is still game over if that's how you're syncing passkeys.
• alerighi 15d ago
  To the day where your device breaks, you had set a passkey to access your Google account (because the phone did prompted it up and you did not understand and clicked yes), you did not setup a recovery method (such as another email/SMS) or you did setup a recovery method that still depends on the Google passkey access (e.g. a second email account where you sign in with Google or has Google as a two factor verification!) and you are locked out of your Google account. Good luck at that point contacting Google assistance, you may as well consider that account as lost forever since there is no way to talk with an human being. And unfortunately is something I start to see to family members/friends that are not tech experts when they ask me to setup them up a new phone... at least the passwords they would have written them in some notebook that they had at home, or always used the same for everything, but with passkey... and when you tell them that they lost access to their email, possibly the files backed up to Google Drive/Google Photos, etc they are surely not happy. Also passkeys makes it difficult to get access to your account in an emergency scenario, what if I loose my phone and I'm not signed in to other devices? Maybe I've setup an SMS as a recovery method, but first I have to get to my phone company to request another SIM card, maybe I'm on vacation on the other side of the earth in vacation for 2 weeks, I'm locked out of my Google account, and from all accounts that uses the passkey as a sign-in method (including, for example, the account that I need to use to check in on my return flight, or my banking app that I need to pay stuff!)
  • PennRobotics 15d ago
    Partner's mom lost phone. Partner called me with mom's password. I went to Find Hub. Entered email and password. "Hold on, we're sending the lost phone a verification text."
• pottertheotter 15d ago
  I'm in the same spot. It seems like every month a post pops up here that's "I hate passkeys" and most of HN seems to agree. I use 1Password, but passkeys have made things even easier. I'd rather have them than any 2FA method. So many websites make me use a login/password AND then send me an email or text with a code. Every. Single. Time. You're really telling me you would rather do that than have a passkey?! And, like you said, passwordless email auth is really terrible.
• pianoben 14d ago
  Low risk of lockout, but about as high-severity as one can imagine. Yes in theory sites should offer a password fallback, but how many actually do? And of those that attempt it, how many get it right? Not even Google reliably lets you fall back to a password, according to the comments in this article. Losing access to your google is anywhere from major inconvenience to professional disaster. Expecting every user (site using passkeys) to implement complicated flows is a time-tested recipe for disaster, and it's a bummer to see that unfolding yet again with passkeys.
  • jayknight 14d ago
    >Not even Google reliably lets you fall back to a password, according to the comments in this article. I logged in with my google password (on my TV, the other method using my phone wasn't working for some reason) the other day even though I normally use a passkey from my phone or computer. It worked just fine.
    • phyzome 14d ago
      Sometimes it works, sometimes it doesn't. I've had Google block my login because it was sus (it was a new computer or something...) and they wanted to verify a whole bunch of information. If you haven't given them that info, you just get locked out.
• spider-mario 14d ago
  > I love not needing to deal with 1Password's autofill being flakey and having to CMD-C/CMD-V passwords/passphrases/OTPs on these sites. But that requires that website implement support for passkeys, and is that easier than just implementing a login form that doesn’t break password managers’ autofill?
• hollow-moe 14d ago
  > those sync everywhere, this isn't a real risk I hope your main account at one of these two providers gets banned for whatever reason so you'll never utter such frivolous claims ever after :)
• qlte 14d ago
  Yes, at this point I have probably saved literal hours in time added up by being able to skip MFA prompts on sites/apps I use regularly via a passkey login flow. It was becoming ridiculous how often I'd hit a "verify who you are with your phone/email" gate even on services I use constantly, a gigantic waste of time.