Thread

1. elteto · 1789734778 · focus · HN ↗

   While the technology itself may be great (I don't really know since I don't use them) it has been co-opted by the tech conglomerates as another form of isolating and walling off users into their ecosystems.

   And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".

   1. reddalo · 1789736878 · focus · HN ↗

      Exactly. That's why I'll never use passkeys: they're just another way to force us into a commercial walled garden.

      Passwords with 2FA are simply better and more freedom friendly.

      1. apexalpha · 1789740307 · focus · HN ↗

         I just bought a passkey... It's a USB device, completely separate from any big conglomerates.

         1. reddalo · 1789744788 · focus · HN ↗

            But then you need to phisically carry it along with you everywhere you go, if you want to log into a service :/

            1. SoftTalker · 1789746441 · focus · HN ↗

               And hope you don't lose it, or leave it in a pocket when you do the laundry, or plug it into a faulty USB port that zaps it, etc.

               1. vel0city · 1789747109 · focus · HN ↗

                  My yubikeys have survived dips in the ocean, spilled beers, run over by cars, dropped in pans of used motor oil, and multiple trips through the washer and dryer. They're still fine even after a decade.

                  1. hnfong · 1789749054 · focus · HN ↗

                     Nothing survives the xkcd 538 wrench attack.
            2. apexalpha · 1789747723 · focus · HN ↗

               Yes, it’s like a key. :)

               Though realistically I use a passkey for services I care about and a password manager for the rest.

               1. eikenberry · 1789749202 · focus · HN ↗

                  Keys can be copied very easily. It’s one of their primary features. Can you easily copy your USB key?

                  1. jazzyjackson · 1789749877 · focus · HN ↗

                     Yubikeys are Secure Enclaves designed to not be copyable

                     1. eikenberry · 1789766960 · focus · HN ↗

                        Right. That's the flaw I was pointing out.
                  2. krupan · 1789752977 · focus · HN ↗

                     Physical keys can easily be copied, and physical locks can easily be picked. That might be fine for your house or storage unit, but for your bank account or your car (newer cars no longer have simple physical keys/locks), we've moved beyond that tech.

                     1. mrguyorama · 1789757224 · focus · HN ↗

                        That any and all physical security measures can be defeated is a feature, not a bug. Almost no human beings actually need that level of security, and the tradeoffs are absolutely not worth it for those of us without Mossad as a threat.

                        How often do people lock themselves out of their own house? Don't you know anyone with ADHD? Imagine any time that happens it is mathematically verifiably permanent as a fact of reality itself. It doesn't matter that the state still views you as the legal owner, you are never allowed in ever again.

                        1. krupan · 1789758219 · focus · HN ↗

                           No web service is like that. They all offer recovery options. We aren't talking about Bitcoin here.

                           1. EvanAnderson · 1789760268 · focus · HN ↗

                              The trend of companies becoming easier to contact is well-documented.
                           2. Telaneo · 1789790539 · focus · HN ↗

                              Tell that to the people who have lost access to their Google account.

                              1. krupan · 1789917517 · focus · HN ↗

                                 Now we aren't talking about a security problem, we're talking about who really owns what. Google can lock you out of your account no matter what kind of authentication they use for that account

                                 1. Telaneo · 1789921403 · focus · HN ↗

                                    It's a lot easier to be locked out with a passkey than without one.

                                    1. krupan · 1789926211 · focus · HN ↗

                                       No it's not. Google flips a bit in their database and no matter what kind of authentication you set up with them, you get denied

                                       1. Telaneo · 1789951491 · focus · HN ↗

                                          This does not reflect my own lived experience.

                                          1. krupan · 1790003831 · focus · HN ↗

                                             I'm not even sure what your point is anymore. If Google decides they don't want you to log in anymore, you can't log in anymore. It doesn't matter if you try to log in with a passkey, a password, your fingerprint, or sending a secret code in with carrier pidgeon. This has nothing to do with passkeys vs passwords vs anything else.

                                             If Google does want you to be able to log in then they will work with you to make that happen, whether you forgot your password, lost your passkey, or your carrier pidgeon died.

                                             Passkeys are not special in this regard at all. What does make them special is that nobody can use a phishing attack to steal your passkey and log in to your account. Nobody can guess your passkey and log into your account. Nobody can intercept your passkey in flight and log in as you. That's the important distinction.

                  3. apexalpha · 1789806022 · focus · HN ↗

                     You can 'copy' it by registering a new one to the service.
            3. finaard · 1789748750 · focus · HN ↗

               That's not the problem for me - I carry a bunch of tokens with me anyway (all my banking stuff is on hardware tokens, for example). My problem is more: My browsers run in containers or VMs, intentionally without hardware access. Getting passkeys to work there would be quite a bit of effort.

Unofficial Hacker News client; not affiliated with Y Combinator.