Passkeys do marginally improve security against MITM and phishing attacks, but they are primarily for protecting the lowest common denominator from themselves: people who re-use passwords and/or don't use a password manager.
If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
> But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own?
at least in Apple land, if you try to sign on on a device that you don’t own (let’s say a work laptop where you’re not signed in to your apple id) it’ll give you a QR code to scan with your iPhone and it’ll do faceID on your iphone then do some bluetooth handshake to use your passkey on the other device. I’m not sure if this is Apple exclusive or if android/windows/linux would be able to do the same
I’m a big dummy who commented before reading the article, this is actually called out there
> The last option is to use “Hybrid Transport”, where you scan a QR code and connect via Bluetooth simultaneously to the computer. Whilst this option is secure and works in theory, reality is plagued with edge-cases where connections fail or Bluetooth is straight-up unsupported.
drtz · · focus · HN ↗
If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
jedbrooke · · focus · HN ↗
at least in Apple land, if you try to sign on on a device that you don’t own (let’s say a work laptop where you’re not signed in to your apple id) it’ll give you a QR code to scan with your iPhone and it’ll do faceID on your iphone then do some bluetooth handshake to use your passkey on the other device. I’m not sure if this is Apple exclusive or if android/windows/linux would be able to do the same
pastel8739 · · focus · HN ↗
jedbrooke · · focus · HN ↗
> The last option is to use “Hybrid Transport”, where you scan a QR code and connect via Bluetooth simultaneously to the computer. Whilst this option is secure and works in theory, reality is plagued with edge-cases where connections fail or Bluetooth is straight-up unsupported.