Passkeys do marginally improve security against MITM and phishing attacks, but they are primarily for protecting the lowest common denominator from themselves: people who re-use passwords and/or don't use a password manager.
If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
> how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
I agree with you 100%, although I will say that it seems like newer OSes (perhaps it depends on the desktop + mobile combination, or maybe Chrome + Android is enough, not sure) have a way for you to use a passkey from your phone by scanning a QR code. I still think it's not super user-friendly but it is a clever workaround at least. Most people are accustomed to scanning QR codes, so scanning a QR code from your phone to sign in seems like not too big of a leap. (Although I wonder if it conditions users to scan random QR codes to sign in which could be a bigger phishing problem lol...).
drtz · · focus · HN ↗
If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
ibrahima · · focus · HN ↗
I agree with you 100%, although I will say that it seems like newer OSes (perhaps it depends on the desktop + mobile combination, or maybe Chrome + Android is enough, not sure) have a way for you to use a passkey from your phone by scanning a QR code. I still think it's not super user-friendly but it is a clever workaround at least. Most people are accustomed to scanning QR codes, so scanning a QR code from your phone to sign in seems like not too big of a leap. (Although I wonder if it conditions users to scan random QR codes to sign in which could be a bigger phishing problem lol...).