3 ms·

> The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. My irritation is that I know wh

> The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. My irritation is that I know what it is, and I've said no thanks many times, but I'm still asked regularly by the likes of Amazon, and they usually pick a time when I'm trying to order something quick¹. It is one of the growing number of things in life that simply have no “no” option, it is always “yes or later” - I wouldn't mind so much if “later” meant “I know the option exists, I'll ask for it if I change my mind, don't bother me again otherwise”. Call me cynical, but if companies are trying to nag me into something I very much doubt the main benefit is mine. I'm sure there are many people out there who go along with it simply because they are sick of being asked repeatedly. I also don't see the real benefit with the way things are often implemented anyway. When the credential recovery process is sending a magic email or text, making SMTP or SMS the weak link of the chain just as it often is for passwords so I'd be giving up my preferred workflows for no better security. ---- [1] A short while ago I actually ordered from somewhere else because of this, bitter twit that I am. “I wonder if I can get this almost certainly drop-shipped item on next day delivery via Prime?”, [goes to Amazon to check], [get passkey prompt], “sod it, I'll go back to the original place”.

ProjectArcturis 13d ago
I dropped Amazon entirely a couple years ago because they didn't provide any way at all to separate my credit card from my kid's Fire tablet and I didn't want to be on the hook for thousands in charges because he pushed the wrong button. It's remarkably easy! It has made basically no change to my life except that I'm a little smug about not using Amazon.
- gxs 13d ago
  What do you use instead? My main reason for using Amazon is the shipping which no one else can come close to Same or next day shipping on most things I order is wild, when something goes beyond a 2-3 days on Amazon it even feels odd And the “do you actually need the item/s that fast” isn’t the response I am looking for
  - MrDrMcCoy 13d ago
    Shop.App doesn't have everything, but they do have a lot and many merchants have fast shipping options. I always try to search them and Newegg before trying Amazon.
    - sandmn 12d ago
      Newegg marketplace is a funny place. Not only many items are more expensive than elsewhere, I had my orders delivered literally in Amazon or Walmart packaging. There are genuine merchants that made a choice to work with Newegg but there are many resellers from other stores as well.
  - jonahhorowitz 13d ago
    Target/Walmart/BestBuy. They both have fast shipping options as well as store pickup. Sometimes (if you live somewhere more rural) they have _faster_ shipping times than Amazon.
    - kps 13d ago
      I'm not in the US, but friends there tell me that Home Depot routinely delivers from the local store within a few hours. (Here, unfortunately, their web site is useless crap.)
      - ethbr1 13d ago
        Walmart / Home Depot / Lowes / Kroger are generally going to beat Amazon on quickest delivery for most people for most items, if they want to, by virtue of their local brick and mortar footprint. One reason I imagine Amazon pushed so hard for short delivery times was knowing eventually their legacy peers would leverage this against them.
        al_borland 12d ago
        Not to mention a long delivery time gives people more opportunity to simply go to the store and get something, while they’re out running other errands. I live in a well populated suburban area. If I’m willing to actually leave my house, I can get most things much faster than Amazon can deliver them. This also helps keep those local businesses running, so shipping doesn’t become the only option in the future.
- screamingninja 13d ago
  Could you create a separate account for the tablet without that credit card? Just curious.
  - red-iron-pine 13d ago
    but then how do you pay for things if/when you want to buy the little one something? you either add the card then remove it, get a separate card, or find a way to use credits somehow -- but in the case of the latter two, Junior could still slam a few buttons and eat up all available funds on that card -- just without the impact of your regular card.
    - thesuitonym 13d ago
      This is something that Apple really got right. My kids can initiate any kind of purchase they want (At least, those that are allowed based on Screen Time controls) but every purchase stops and waits for approval from me or my wife. Even if the item is free. No faffing about with credits, or extra cards, or setting limits.
    - machomaster 13d ago
      Just use a bank with a decent service (like Revolut), create a separate card number for your kid (10s within the bank app), where you put more money when needed and can easily put the number on hold or activate it whenever you please.
      - Smoosh 13d ago
        Like this Revolut? https://cybernews.com/security/revolut-data-breach-75-million-records/ https://cybernews.com/security/revolut-data-breach-75-millio...
        machomaster 13d ago
        > After the publication went live, Revolut reassured that the review is still ongoing. "We have so far still found no indications of any breach." > "We have checked the user and card identifiers contained in the alleged records against our systems, and none of them correspond to valid or genuine Revolut identifiers," the spokesperson said.
Telaneo 13d ago
> My irritation is that I know what it is, and I've said no thanks many times, but I'm still asked regularly by the likes of Amazon The people responsible show a distinct lack of understanding when it comes to consent.
- ryandrake 13d ago
  Silicon Valley has no concept of consent and boundaries. If computing was a night club, "Silicon Valley" is the guy who goes up to every woman saying "Want to dance? [Yes or Maybe Later]?"
  - pixl97 13d ago
    I don't think you carried on the analogy far enough. >Want to dance? [Yes or Maybe Later]?, also drink this [Yes]"
    - sippingabonedry 13d ago
      A better analogy would be slipping something into her drink whilst handing her a 12-page stapled terms of service agreement in which she unknowingly gives full consent.
      - pixl97 13d ago
        Meta: As you see the anal box as already been checked with unerasable ink.
nntwozz 13d ago
> The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. Gf just logged in to hotmail without knowing her password because of a popup. I tried to explain but there was no understanding to be had. This is how the world works. You either understand it or suffer it unknowingly.
sandeepkd 13d ago
I think this is the biggest reason why these category of discussion happens in the first place, there is a gap between what technology is good for, whats its ideal for and then the products motivation to push it on to the user assuming it would give a good name to the company. Passkeys are one of the few protocols that supports against phishing (Accidentally giving away your credential to some rough site) so it has its benefits and more so for enterprise users. It becomes challenging and is ill suited when its pushed to general public. A middle ground could have been to give it as an option to user instead of forcing it on the user. For some reason its not cool enough. From a company's perspective - Authentication is a friction and the discoverable credential (where you just click on username button and log in) reduces the friction for user, making it easier for user to make that purchase decision - Account take over attempts (ATOs) do take a dip, saves quite a lot of resources on customer support side for the company
- tyre 13d ago
  IMO it’s well-suited to the general public! What is the average person’s threat model? Re-using passwords. What is their most common annoyance? They forget their passwords. Built-in password managers are great for this. But they’re not universal (e.g. I believe using Apple Passwords on Mac doesn’t carry over to Android.) Passkeys are amazing. They’re basically magic to the average person. No typing passwords; no remembering; simply vibing, securely. I don’t think people are regularly logging in to a huge number of accounts on other devices. Maybe they are! I doubt it.
  - TeMPOraL 13d ago
    > What is the average person’s threat model? Re-using passwords. Wrong. As article points out, it's not having access to their account. Followed by not being able to easily delegate access to their account to a trusted third party (like a spouse, a friend). Password reuse addresses the first problem, however imperfectly. Ability to share password over any channel, including analog, addresses the second. Passkeys defeat both.
    - jesseendahl 13d ago
deaton 13d ago
Amazon does benefit from increased account security; they don't have to refund non-fraudulent orders after all. For most people, a passkey is genuinely more secure.
- hakavlad 13d ago
  What about availability? The article is precisely about that.
FireBeyond 13d ago
Amazon and PayPal are horrible for this. Clicking out of the dialogs and modals to actually get logged in? (Shout out to PayPal for a dark pattern that implies "continue to login" but is actually "continue to set up PassKeys", and you actually need to "cancel" to actually login).
jareklupinski 13d ago
> by the likes of Amazon, and they usually pick a time when I'm trying to order something quick they have an algorithm that can predict the likeliest moment you'll not see or panic-hit the "ok" button in haste
- dspillett 12d ago
  I think it is simpler than that: they ask irritatingly often, and I'm often looking quickly to see if I can get something on next-day delivery, so the two factors coincide.
f30e3dfed1c9 11d ago
"if companies are trying to nag me into something I very much doubt the main benefit is mine." Bingo.

ProjectArcturis 13d ago

I dropped Amazon entirely a couple years ago because they didn't provide any way at all to separate my credit card from my kid's Fire tablet and I didn't want to be on the hook for thousands in charges because he pushed the wrong button. It's remarkably easy! It has made basically no change to my life except that I'm a little smug about not using Amazon.

gxs 13d ago
What do you use instead? My main reason for using Amazon is the shipping which no one else can come close to Same or next day shipping on most things I order is wild, when something goes beyond a 2-3 days on Amazon it even feels odd And the “do you actually need the item/s that fast” isn’t the response I am looking for
- MrDrMcCoy 13d ago
  Shop.App doesn't have everything, but they do have a lot and many merchants have fast shipping options. I always try to search them and Newegg before trying Amazon.
  - sandmn 12d ago
    Newegg marketplace is a funny place. Not only many items are more expensive than elsewhere, I had my orders delivered literally in Amazon or Walmart packaging. There are genuine merchants that made a choice to work with Newegg but there are many resellers from other stores as well.
- jonahhorowitz 13d ago
  Target/Walmart/BestBuy. They both have fast shipping options as well as store pickup. Sometimes (if you live somewhere more rural) they have _faster_ shipping times than Amazon.
  - kps 13d ago
    I'm not in the US, but friends there tell me that Home Depot routinely delivers from the local store within a few hours. (Here, unfortunately, their web site is useless crap.)
    - ethbr1 13d ago
      Walmart / Home Depot / Lowes / Kroger are generally going to beat Amazon on quickest delivery for most people for most items, if they want to, by virtue of their local brick and mortar footprint. One reason I imagine Amazon pushed so hard for short delivery times was knowing eventually their legacy peers would leverage this against them.
      - al_borland 12d ago
        Not to mention a long delivery time gives people more opportunity to simply go to the store and get something, while they’re out running other errands. I live in a well populated suburban area. If I’m willing to actually leave my house, I can get most things much faster than Amazon can deliver them. This also helps keep those local businesses running, so shipping doesn’t become the only option in the future.
screamingninja 13d ago
Could you create a separate account for the tablet without that credit card? Just curious.
- red-iron-pine 13d ago
  but then how do you pay for things if/when you want to buy the little one something? you either add the card then remove it, get a separate card, or find a way to use credits somehow -- but in the case of the latter two, Junior could still slam a few buttons and eat up all available funds on that card -- just without the impact of your regular card.
  - thesuitonym 13d ago
    This is something that Apple really got right. My kids can initiate any kind of purchase they want (At least, those that are allowed based on Screen Time controls) but every purchase stops and waits for approval from me or my wife. Even if the item is free. No faffing about with credits, or extra cards, or setting limits.
  - machomaster 13d ago
    Just use a bank with a decent service (like Revolut), create a separate card number for your kid (10s within the bank app), where you put more money when needed and can easily put the number on hold or activate it whenever you please.
    - Smoosh 13d ago
      Like this Revolut? https://cybernews.com/security/revolut-data-breach-75-million-records/ https://cybernews.com/security/revolut-data-breach-75-millio...
      - machomaster 13d ago
        > After the publication went live, Revolut reassured that the review is still ongoing. "We have so far still found no indications of any breach." > "We have checked the user and card identifiers contained in the alleged records against our systems, and none of them correspond to valid or genuine Revolut identifiers," the spokesperson said.

Telaneo 13d ago

> My irritation is that I know what it is, and I've said no thanks many times, but I'm still asked regularly by the likes of Amazon The people responsible show a distinct lack of understanding when it comes to consent.

ryandrake 13d ago
Silicon Valley has no concept of consent and boundaries. If computing was a night club, "Silicon Valley" is the guy who goes up to every woman saying "Want to dance? [Yes or Maybe Later]?"
- pixl97 13d ago
  I don't think you carried on the analogy far enough. >Want to dance? [Yes or Maybe Later]?, also drink this [Yes]"
  - sippingabonedry 13d ago
    A better analogy would be slipping something into her drink whilst handing her a 12-page stapled terms of service agreement in which she unknowingly gives full consent.
    - pixl97 13d ago
      Meta: As you see the anal box as already been checked with unerasable ink.

nntwozz 13d ago

> The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. Gf just logged in to hotmail without knowing her password because of a popup. I tried to explain but there was no understanding to be had. This is how the world works. You either understand it or suffer it unknowingly.

sandeepkd 13d ago

I think this is the biggest reason why these category of discussion happens in the first place, there is a gap between what technology is good for, whats its ideal for and then the products motivation to push it on to the user assuming it would give a good name to the company. Passkeys are one of the few protocols that supports against phishing (Accidentally giving away your credential to some rough site) so it has its benefits and more so for enterprise users. It becomes challenging and is ill suited when its pushed to general public. A middle ground could have been to give it as an option to user instead of forcing it on the user. For some reason its not cool enough. From a company's perspective - Authentication is a friction and the discoverable credential (where you just click on username button and log in) reduces the friction for user, making it easier for user to make that purchase decision - Account take over attempts (ATOs) do take a dip, saves quite a lot of resources on customer support side for the company

tyre 13d ago
IMO it’s well-suited to the general public! What is the average person’s threat model? Re-using passwords. What is their most common annoyance? They forget their passwords. Built-in password managers are great for this. But they’re not universal (e.g. I believe using Apple Passwords on Mac doesn’t carry over to Android.) Passkeys are amazing. They’re basically magic to the average person. No typing passwords; no remembering; simply vibing, securely. I don’t think people are regularly logging in to a huge number of accounts on other devices. Maybe they are! I doubt it.
- TeMPOraL 13d ago
  > What is the average person’s threat model? Re-using passwords. Wrong. As article points out, it's not having access to their account. Followed by not being able to easily delegate access to their account to a trusted third party (like a spouse, a friend). Password reuse addresses the first problem, however imperfectly. Ability to share password over any channel, including analog, addresses the second. Passkeys defeat both.
  - jesseendahl 13d ago

deaton 13d ago

Amazon does benefit from increased account security; they don't have to refund non-fraudulent orders after all. For most people, a passkey is genuinely more secure.

hakavlad 13d ago
What about availability? The article is precisely about that.

FireBeyond 13d ago

Amazon and PayPal are horrible for this. Clicking out of the dialogs and modals to actually get logged in? (Shout out to PayPal for a dark pattern that implies "continue to login" but is actually "continue to set up PassKeys", and you actually need to "cancel" to actually login).

jareklupinski 13d ago

> by the likes of Amazon, and they usually pick a time when I'm trying to order something quick they have an algorithm that can predict the likeliest moment you'll not see or panic-hit the "ok" button in haste

dspillett 12d ago
I think it is simpler than that: they ask irritatingly often, and I'm often looking quickly to see if I can get something on next-day delivery, so the two factors coincide.

f30e3dfed1c9 11d ago

"if companies are trying to nag me into something I very much doubt the main benefit is mine." Bingo.