Passkeys do marginally improve security against MITM and phishing attacks, but they are primarily for protecting the lowest common denominator from themselves: people who re-use passwords and/or don't use a password manager.
If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
> how do I log in on a device that I don't own?
This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport). iOS and Android support this, and it’s generally not a locked-down thing if other devices wanted to do it too.
The only use case left is in “how do I login if all my devices are stolen/fall into a body of water” in which there really isn’t an answer beyond “get (a|your) device back, sign back into your password manager, use that to get back into critical accounts”.
The website should display a qr code you can scan with your phone that allows you to then login, unfortunately a lot of sites don't implement this, and some don't implement backup codes. This isn't the fault of passkeys per se, but of poor implementations.
If you're not happy connecting your phone to the network, then how likely is it that you would you be willing to enter your login details on a machine you don't control?
What if you just can't have internet on your phone? Like if the computer is connected via Ethernet and there's no wifi network you can connect to? What if you're abroad and have no roaming? And the ultimate question about a person that the modern world can barely conceptualize - what if you have a dumbphone? Or what if your smartphone is lost or stolen or dead and you need to access some account? That last one has happened to me, and I sure am glad I know the key passwords that I need for survival.
These may seem like nitpicks, but there's probably a thousand rare scenarios like these that exist. You inevitably have to consider them when you're moving from punching in letters and numbers that you remember in the normal, low-tech way to a complex networked two-device workflow.
What? Did you read the thread? I never said passkeys can only exist on phones. The whole conversation is about "how do I log on with passkeys if something happens to my trusted device?". The parent comments talked about just using your phone, I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services.
> I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services.
And when that happens I'm usually glad my credential is a passkey on my keyring, as chances are if I don't have my phone and I haven't auth'd on to some computer I almost certainly don't have access to my password vault. But hey, my passkey works just fine without my phone. And I can trust that once I unplug my authenticator and log out of that session, there's no long lasting credentials left behind. I don't get that with passwords.
You're asking way too much foresight in this thread I guess. There are some people who have lived lives without any series of unfortunate events, they can't even imagine what the world can serve up.
If nearby (some country) any credit card or even my ID card will get me home. I can walk into a branch of my bank and - with some waiting and paper work - I should be able to get enough cash to get myself home.
Abroad I’d head to the nearest consulate of my home country. Might be difficult to get to if it’s in a far away city. Hard to prepare for abstractly.
But the problem is that you can't really backup passkeys and because people are frankly frequent tricked into using them, they have no good recovery options.
I know plenty of people who only have a phone, no other devices. They don't backup that phone, they should but they don't. They don't use a password manager either, maybe they should, but they don't.
My issue with passkeys are that they are designed for a reality that don't exist, or at least only exists for people who are already doing a lot to secure their devices.
They are designed for a wealthy technologically inclined user with a very stable lifestyle and trusted resources and connections to other people. You know, the exact people who developed them.
> But the problem is that you can't really backup passkeys
The individual passkey? Maybe not. But I don't really need to backup the passkey, I can just have backup passkeys or other backup authenticators, including complicated stored one-time passwords.
To answer your earlier hypothetical, I'm out traveling and I'm mugged. Well, hopefully, I'm not mugged in the part of the travels where I'm carrying truly everything at the moment, and I can just go back to the hotel room and re-auth with a device I saved there Problem solved, no big deal. If I lost truly everything while I'm out, I'd do as suggested elsewhere here and call home to get a trusted friend/family member to read me off the one time password saved at home or whatever.
> My issue with passkeys are that they are designed for a reality that don't exist
The reality of passwords being hijacked is absolutely a reality of today and is a constant issue for tons of people.
> I know plenty of people who only have a phone, no other devices.
And I really don't get why we can't also teach these people to also have a little token they use that can also be a part of their online identity. And sure, for certain kinds of accounts have appropriate levels of recoverability, but for the normal authentication workflows its so much better in so many ways.
>They are designed for a wealthy technologically inclined user with a very stable lifestyle and trusted resources and connections to other people. You know, the exact people who developed them.
And here you go posting
> I'd do as suggested elsewhere here and call home to get a trusted friend/family member to read me off the one time password saved at home or whateve
If you read what I posted you see why you live at a particular place of privileged and are seemingly incapable of putting yourself in another persons position where these things do not hold true.
"If you are a white male earning over 100,000 a year in a stable relationship with living family members, excess savings in the bank, in a stable first world country everything is going to be fine and the rest of you can get fucked" --what you keep repeating in different ways.
I mean I was pointing out that you were being racist and sexist from a position of privilege without realizing you were doing so. A kind of systematic failure caused by not realizing our choices as developers has real world impacts on the less privileged.
You're being racist and sexist by assuming wealthy westerners or those in stable relationships or those being able to call home to family are white males. If that's not racist I don't know what is. I don't think it takes being a white male to be able to call home to family when traveling internationally. You're assuming a point of view is invalid due to someone's race and gender.
Quit being racist and projecting identities on people.
This is about people who would have a hard time recovering digital identities. I imagine there were lots of white males fleeing war in Europe who probably struggled to get access to accounts backed with things like passkeys and other forms of 2FA. But I guess to you their struggles don't matter.
Its almost like you including gender and race was just your own projections of your own hatred for a particular group. You should probably think about things when painting people with such a wide brush of "white males" when trying to paint people in a derogatory fashion.
I spent a chunk of my life homeless. Don't project some identity on me that's not valid, or that I just totally lack some perspective due to your assumption of my race or gender. Its not a fair thing to do, its literally racist and sexist.
You could have tried to make your point without throwing in racist and sexist comments by just saying "wealthy western software developers" or whatever.
Great, now I just need to get back home to use my uncompromised accounts (which would have still been protected by my device as long as they're not NSO Group, but whatever). Gee, it seems my tickets back home were taken with my stolen phone! Not to worry, they sent me an email confirmation, so all I need to do is log into my passkey-protected email on my friend's phone and have them download my ticket in addition to theirs, or print it at a public computer. Oh wait
As long as you still have your passport, which you’d need for international travel anyway, you can get your boarding pass at the airport without any hassle.
drtz · · focus · HN ↗
If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
judge2020 · · focus · HN ↗
This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport). iOS and Android support this, and it’s generally not a locked-down thing if other devices wanted to do it too.
The only use case left is in “how do I login if all my devices are stolen/fall into a body of water” in which there really isn’t an answer beyond “get (a|your) device back, sign back into your password manager, use that to get back into critical accounts”.
201984 · · focus · HN ↗
limagnolia · · focus · HN ↗
201984 · · focus · HN ↗
roryirvine · · focus · HN ↗
tavavex · · focus · HN ↗
These may seem like nitpicks, but there's probably a thousand rare scenarios like these that exist. You inevitably have to consider them when you're moving from punching in letters and numbers that you remember in the normal, low-tech way to a complex networked two-device workflow.
vel0city · · focus · HN ↗
tavavex · · focus · HN ↗
vel0city · · focus · HN ↗
And when that happens I'm usually glad my credential is a passkey on my keyring, as chances are if I don't have my phone and I haven't auth'd on to some computer I almost certainly don't have access to my password vault. But hey, my passkey works just fine without my phone. And I can trust that once I unplug my authenticator and log out of that session, there's no long lasting credentials left behind. I don't get that with passwords.
Aren't passkeys great?
pixl97 · · focus · HN ↗
You get mugged.
They take your phone and keyring.
They can't do anything with it since it's locked, but you don't have it.
Aren't passkeys great?
jazzyjackson · · focus · HN ↗
I have a backup key at home
Mission accomplished
rcxdude · · focus · HN ↗
pixl97 · · focus · HN ↗
dwaite · · focus · HN ↗
I have not yet done an actual test within Japan, however.
realityking · · focus · HN ↗
Abroad I’d head to the nearest consulate of my home country. Might be difficult to get to if it’s in a far away city. Hard to prepare for abstractly.
mrweasel · · focus · HN ↗
I know plenty of people who only have a phone, no other devices. They don't backup that phone, they should but they don't. They don't use a password manager either, maybe they should, but they don't.
My issue with passkeys are that they are designed for a reality that don't exist, or at least only exists for people who are already doing a lot to secure their devices.
pixl97 · · focus · HN ↗
They are designed for a wealthy technologically inclined user with a very stable lifestyle and trusted resources and connections to other people. You know, the exact people who developed them.
vel0city · · focus · HN ↗
The individual passkey? Maybe not. But I don't really need to backup the passkey, I can just have backup passkeys or other backup authenticators, including complicated stored one-time passwords.
To answer your earlier hypothetical, I'm out traveling and I'm mugged. Well, hopefully, I'm not mugged in the part of the travels where I'm carrying truly everything at the moment, and I can just go back to the hotel room and re-auth with a device I saved there Problem solved, no big deal. If I lost truly everything while I'm out, I'd do as suggested elsewhere here and call home to get a trusted friend/family member to read me off the one time password saved at home or whatever.
> My issue with passkeys are that they are designed for a reality that don't exist
The reality of passwords being hijacked is absolutely a reality of today and is a constant issue for tons of people.
> I know plenty of people who only have a phone, no other devices.
And I really don't get why we can't also teach these people to also have a little token they use that can also be a part of their online identity. And sure, for certain kinds of accounts have appropriate levels of recoverability, but for the normal authentication workflows its so much better in so many ways.
pixl97 · · focus · HN ↗
>They are designed for a wealthy technologically inclined user with a very stable lifestyle and trusted resources and connections to other people. You know, the exact people who developed them.
And here you go posting
> I'd do as suggested elsewhere here and call home to get a trusted friend/family member to read me off the one time password saved at home or whateve
If you read what I posted you see why you live at a particular place of privileged and are seemingly incapable of putting yourself in another persons position where these things do not hold true.
"If you are a white male earning over 100,000 a year in a stable relationship with living family members, excess savings in the bank, in a stable first world country everything is going to be fine and the rest of you can get fucked" --what you keep repeating in different ways.
vel0city · · focus · HN ↗
Also, you're posting incredibly racist and sexist statements here. Why does race and gender matter here?
Stop being racist.
pixl97 · · focus · HN ↗
vel0city · · focus · HN ↗
Quit being racist and projecting identities on people.
This is about people who would have a hard time recovering digital identities. I imagine there were lots of white males fleeing war in Europe who probably struggled to get access to accounts backed with things like passkeys and other forms of 2FA. But I guess to you their struggles don't matter.
Its almost like you including gender and race was just your own projections of your own hatred for a particular group. You should probably think about things when painting people with such a wide brush of "white males" when trying to paint people in a derogatory fashion.
I spent a chunk of my life homeless. Don't project some identity on me that's not valid, or that I just totally lack some perspective due to your assumption of my race or gender. Its not a fair thing to do, its literally racist and sexist.
You could have tried to make your point without throwing in racist and sexist comments by just saying "wealthy western software developers" or whatever.
tavavex · · focus · HN ↗
realityking · · focus · HN ↗