If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
My irritation is that I know what it is, and I've said no thanks many times, but I'm still asked regularly by the likes of Amazon, and they usually pick a time when I'm trying to order something quick¹. It is one of the growing number of things in life that simply have no “no” option, it is always “yes or later” - I wouldn't mind so much if “later” meant “I know the option exists, I'll ask for it if I change my mind, don't bother me again otherwise”. Call me cynical, but if companies are trying to nag me into something I very much doubt the main benefit is mine. I'm sure there are many people out there who go along with it simply because they are sick of being asked repeatedly.
I also don't see the real benefit with the way things are often implemented anyway. When the credential recovery process is sending a magic email or text, making SMTP or SMS the weak link of the chain just as it often is for passwords so I'd be giving up my preferred workflows for no better security.
----
[1] A short while ago I actually ordered from somewhere else because of this, bitter twit that I am. “I wonder if I can get this almost certainly drop-shipped item on next day delivery via Prime?”, [goes to Amazon to check], [get passkey prompt], “sod it, I'll go back to the original place”.
you either add the card then remove it, get a separate card, or find a way to use credits somehow -- but in the case of the latter two, Junior could still slam a few buttons and eat up all available funds on that card -- just without the impact of your regular card.
Same or next day shipping on most things I order is wild, when something goes beyond a 2-3 days on Amazon it even feels odd
And the “do you actually need the item/s that fast” isn’t the response I am looking for
Gf just logged in to hotmail without knowing her password because of a popup. I tried to explain but there was no understanding to be had.
This is how the world works. You either understand it or suffer it unknowingly.
Passkeys are one of the few protocols that supports against phishing (Accidentally giving away your credential to some rough site) so it has its benefits and more so for enterprise users.
It becomes challenging and is ill suited when its pushed to general public. A middle ground could have been to give it as an option to user instead of forcing it on the user. For some reason its not cool enough.
From a company's perspective
- Authentication is a friction and the discoverable credential (where you just click on username button and log in) reduces the friction for user, making it easier for user to make that purchase decision
- Account take over attempts (ATOs) do take a dip, saves quite a lot of resources on customer support side for the companyThe people responsible show a distinct lack of understanding when it comes to consent.
>Want to dance? [Yes or Maybe Later]?, also drink this [Yes]"
I got a new cell phone and installed Microsoft Swiftkey and tried to login to Microsoft. It said my device's password or security manager would popup, but it never did and it never showed an option to login via password, just a mostly blank screen. I tried logging in from my laptop browser and it immediately tried using a passkey, but I've never created a passkey for Microsoft, so it errored out, still never showing an option for password login. I tried again and it errored out again and FINALLY showed the option to login via password. It had to fail 2 times to finally show the option for password login.
I was finally able to login via password, then had to go to Microsoft's passkey management page to create a new passkey, store it in 1password, and use that on my phone.
I'm a software engineer and it was annoying and time consuming and took a minute to figure out. How are non engineers supposed to even use this crap?
He didn’t have access to it the other day and we needed access to his account. He didn’t remember his password, and we were unable to reset it because you need the passkey! No other options to authenticate for a reset were available.
Add in the fact that I was trying to help him with this by long distance call and you can imagine the frustration.
It’s been fine.
One of these days the product managers who push these things thinking "oh, it's easy, you just . . ." are either going to be explaining it to confused Mom or Dad, or they're going to be elderly and irritated themselves. Until then I hope they stub their toe or step on random Legos regularly.
Originally it was about difficulty migrating to a new laptop with a different version of Windows, but I was quite firm about it because when I realized it wasn't able to do secure connections for some reason, so the instant they took their laptop to public Wi-Fi...
Also in the process of helping my dad with his phone, 76 and my grandmother 99. Maybe this works better with Apple, but the biggest problem on Android is, that it feels like every update shuffles everything around. Allmost no point in explaining, that they can solve some things on their own.
And all the time new things on the screen, new features they don't understand, need nor asked for.
just hang their heads in shame and walk into the sea
I'd wish the world would just become boring again.
I just made one for PayPal using my MacBook which seems to have ended up in Bitwarden rather than the mac thing. But there's nothing in Bitwarden to say list all passkeys. Not sure how I check elsewhere. Maybe they should email you "you have created a paypal passkey in Tim's Bitwarden" or something. Then at least you could search the email for "passkey"?
I wonder if I can use Bitwarden on another device with that? I honestly don't know.
This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport). iOS and Android support this, and it’s generally not a locked-down thing if other devices wanted to do it too.
The only use case left is in “how do I login if all my devices are stolen/fall into a body of water” in which there really isn’t an answer beyond “get (a|your) device back, sign back into your password manager, use that to get back into critical accounts”.
Ok but how do I share my Netflix or Spotify accounts for example with those?
If they also allow passkeys as an alternative form of login that doesn't need 2FA you can use those to make the account sharing more secure.
When setting up sharing with someone first change the password to something else, and then share the account name and password. After they log in the can add a passkey to the account on their device or devices.
Then you can change the password back to your real password. When they want to use the account they login with their passkey.
If the service doesn't accept login passkeys but does allows passkeys for 2FA, you have to use real password sharing, but at least they can have a passkey for 2FA which may be easier than how you know handle 2FA.
How do people handle 2FA with account sharing? If the site uses TOTP you can give them the QR code that you received back when you made the account (you do save a screenshot of such QR codes for backup, right?).
But how do you handle SMS 2FA, which seems to be far more commonly offered than TOTP?
For email 2FA I suppose you could set up a filter on your incoming mail that forwards any incoming code emails to the people you shared with, and hope that the time limit on the code is long enough for this to work.
However, passkeys can and are available to be shared via password managers. They’re not locked to the secure chip on the device where they live usually. iOS’ Passwords app has a share button and 1Password lets you share passkey-containing items.
In fact, the QR code login feature makes it even easier to do a one-time sign in to your account for a friend, if you don’t want them to be able to login to your account indefinitely.
0: Netflix doesn’t support passkeys because their main audience is people signing in via smart TVs and whatnot, which largely don’t support CTAP or Webauthn in general)
Me to said companies: I will do what I want.
Me to company: Damn, guess you shouldn't have been an asshole about it, kind of backfired on you.
A malicious website can display a QR code too. I think this "feature" could cause some of the security issues that passkesys were intended to solve.
I use Keepass and the free tier of Dropbox, to keep my passwords strong and available across multiple devices. (Dropbox not required, you can store the database on a thumb drive.) Backups are no problem.
Keepass (or KeepassXC) stores other data as well, including the correct URLs for sites. So my workflow is simply to click the URL from within Keepass, copy the username and password, and paste them into the login screen. So easy even an adult can do it! (Humor attempt)
For convenience, Keepass database can be unlocked with either a password or biometrics (your fingerprint).
(Not affiliated with Keepass, just a happy longtime user.)
Basically, it's very hard if not basically impossible to spoof a QR code to access the real passkey via a malicious site. (caveat, without already having compromised something like the user's DNS, maybe? Even then the site would likely fail the cryptographic checks.)
When every passkey interaction is a different variety of user interaction nightmare, it's not very convincing that it's a good idea in the first place
These may seem like nitpicks, but there's probably a thousand rare scenarios like these that exist. You inevitably have to consider them when you're moving from punching in letters and numbers that you remember in the normal, low-tech way to a complex networked two-device workflow.
They use bank like Ally or Discover with no physical branches.
They use a mortgage provider like Rocket mortgage with no physical branches.
They use a medication delivery service with no physical customer facing pharmacies.
They have an employer that only facilitates reimbursement for expenses via online tools.
etc...
I guess "survive" has a sliding scale, but if I lost access to critical accounts... my life is going to FUCKING SUCK in a non-trivial and very impactful way almost immediately, on many fronts.
And if your answer to that problem is "well, just call them"... then we're right back to the point the article is making: "An account’s security is still dictated by the weakest recovery method"
Passkeys aren't a meaningful improvement in security - assuming you do actually have decent password hygiene like a password manager.
What am I missing? Either we retain passwords as backup for a lost or stolen device - in which case, all the security concerns are still there - or we only use passkeys, in which case we've added a clear nonrecoverable point of failure in the system.
Then we introduce all these "security" mechanisms that make it literally impossible to recover an account without backup codes.
Where do you store the backup codes? The average person, if they store it at all, will store it on a plain text file or in a sticky note.
Except that this creates a much more brittle system. Systems are safe when they are routinely tested/used. If you routinely have to enter your password, you are aware you need it. If you don't need your password, and you never have to enter your backup codes, you won't feel the importance of them until you actually need them.
It's the whole "I have backups" vs. "the backups actually work" problem except it's pushed onto the users who have zero technical knowledge.
When I said "survival", I meant it in the "being able to make do with few resources in a time of crisis" way, not that you will literally die if you can't access an account. Losing a crucial device without a fallback of being able to log in somewhere else quickly can mean immediately losing access to payments (the most crippling, especially if you're not home), being stranded in an airport or even not having an identity document (in countries with digital ID systems). Any of these happening can lead to enormous losses in time, money or worse, depending on when and where this event hits you.
And when that happens I'm usually glad my credential is a passkey on my keyring, as chances are if I don't have my phone and I haven't auth'd on to some computer I almost certainly don't have access to my password vault. But hey, my passkey works just fine without my phone. And I can trust that once I unplug my authenticator and log out of that session, there's no long lasting credentials left behind. I don't get that with passwords.
Aren't passkeys great?
You get mugged.
They take your phone and keyring.
They can't do anything with it since it's locked, but you don't have it.
Aren't passkeys great?
I have a backup key at home
Mission accomplished
I know plenty of people who only have a phone, no other devices. They don't backup that phone, they should but they don't. They don't use a password manager either, maybe they should, but they don't.
My issue with passkeys are that they are designed for a reality that don't exist, or at least only exists for people who are already doing a lot to secure their devices.
They are designed for a wealthy technologically inclined user with a very stable lifestyle and trusted resources and connections to other people. You know, the exact people who developed them.
Are you talking about your phone here?
But, again, if you don't trust your phone then how likely is it that you will be prepared to trust a public computer?
The number of people sharing GP's concerns for reasons of poverty rather than because of their personal security posture will be vanishingly small.
I assume the QR code contains a token for the device, which is used by the app to authorize the login and the server automatically logs in the client on the device with the matching token.
Seems a lot safer to me than using my login credentials on a potentially unsafe device.
1. It might be on a voice network but not on a data network; for instance, if you don't have a data plan.
2. Modern smartphones are actually a hybrid of a traditional cell phone and a traditional PDA, and you might be using it for the PDA part.
> Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms.
What if the computer you want to log in on doesn't have a WiFi chip?
It doesn't have to be an old computer; for instance, the desktop computer I built last year uses a wired gigabit Ethernet connection to the router right next to it, and doesn't have (or need) any WiFi or Bluetooth chip.
That's a technocratic reply, not one that is useful in the real world.
As noted by the person you're replying to, it's not his computer. It's a public library.
Most computers in non-residential settings will have various features locked down, including Bluetooth.
Hotels, clubs, airport lounges, various government facilities… there are thousands of places where you might really need to use a computer but don't control the technology.
In the same vein as 2fa, going up to a fresh computer and trying to log into anything is now a nightmare. Every service has a 2fa that somehow loops into another provider that also has 2fa.
And some 2fa, if not many, make accounts weaker. Apple's solution to get around 2fa is to put in SOMEBODY ELSES phone number that I trust, as a backdoor. It's an insane solution. And its normalized, and nobody questions it.
its just three additional passwords.
should you type the same brother name in each time? should you even answer with a name?
don't get me wrong, they were insane, but they can be repurposed.
They're cheap enough if you lose one it's not the end of the world. Goes on your keyring. Doesn't require esim management. Use NFC swipe/usb-plug-in + pin to use.
This two fatal flaws are what limits their usefulness to enterprise SSO and perhaps some other limited uses where the organization has the ability to replace tokens. (Even in a distributed enterprise, enterprise SSO may not be a good fit for hardware tokens, if they can't get replacements out to employees fast enough).
Everything is SYNCED immediately.
What if you have a ransomeware that destroy everything on the same day your house and all backups burn down. And you cant get it from immutable backups as you wrote that decryption key in paper. And the bank will not allow you to access it as the govt deported you elsewhere.
And since I have at least two at all times, the possibility of one of them breaking changes… not much really.
Paper can burn or get tossed, backups files can go corrupt, and I really don't understand what is that extra risk hw keys introduce…
There is at least one valid (in my opinion) reason to not like hw keys though: they cost real money to acquire, so you probably want an extra margin in your budget for the unlikely case they indeed decide to break.
FIDO2 USB Security key -> Bitwarden (With master password) -> Every other method (topt/password)
I have 3 FIDO2 USB Security keys, One I carry with my persons at all times, one that stays with my main machine at all times and an offsite backup that is sitting in a friend's server, if my house burns down, I can either physically collect the key or use USB-IP to authenticate back into bitwarden and enroll a new key. (Actually all 3 are at home right now but that's ok)
And yes, Google or Apple - dont say you should not keep passwords in your database and sync it with dropbox. DIY.
Rest of us want convenience.
I am a doctor -- and a lawyer and an orbital mechanics specialist, as well as a highly respected behavioral therapist -- so you can trust my advice. Also, feel free to consult an AI on this topic; it would make for an amusing benchmark.
I suspect that most people that ostensibly do this actually only enroll one for non-critical accounts and then depend on some fallback mechanism.
I’m not sure what work has been done on this since Mozilla Persona. I certainly wouldn’t want Google and Apple, or governments, to be the sole gatekeepers.
A third party OAuth provider puts you at the mercy of the service provider, the other can work fully on your client side even if the app provider were to disappear tomorrow.
The only advantage I can think of is that you have a centralized place to revoke credentials in case your password manager does get compromised.
No second factor, compromised passkey manager leads to compromise of all accounts. This is a huge problem.
> A third party OAuth provider puts you at the mercy of the service provider, the other can work fully on your client side even if the app provider were to disappear tomorrow.
Yes that’s what I was saying, it needs some thought and careful work. It would need to be decentralized, and I’m not sure that current standards are up to the task.
Sad reality is that such usecase is less and less common, thus, no one cares about it. I think majority of my friends would not be able to access their email, or facebook or alike, if they were forced to use my computer in emergency.
Some sites allow passkeys as an option for MFA, so that could be an issue if the passkey is your only MFA option and MFA is required. But I imagine email would pretty much always be a fallback.
I don't know if they fixed it, they probably did. Edit: Maybe not, because the recovery option at the end is just nuts: https://learn.microsoft.com/en-us/answers/questions/5454924/...
I've definitely done this, but not sure if the workflow was at the OS or browser level.
I'm honestly confused by all the negativity in the comments. Passkeys are great for convenience. Just leave your password login enabled as a backup. That defeats any security benefit, but oh well.
For people in this position, if they had their phone, they probably wouldn't be logging in on a computer anyway.
For instance YouTubers usually have a different account for their channel than the one they use privately, and don't want their channel account logged in everywhere.
That means having to log in as a guest when push comes to shove. And similar setups are common for most self-employed keeping a "work" account IMHO.
And many are moving to virtual wallets like Cashapp rather than banks with a physical presence where you can take out money without a phone.
It’s a bad situation.
Person 1: "People that end up in this situation that can easily happen should be punished to the full extent of the law with no mercy!"
[Exact situation happens to Person 1]
Person 1: "This is the greatest injustice, do people have no empathy? I could not have avoided this situation!"
Some password managers will only fill if a domain matches, but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in. I've also seen lots of them do stuff like happily autofill on any prefix of the domain, so your credential for `something.example.com` will autofill into `fake-something.example.com`.
Same thing is going to happen with passkeys for non-technical users for exactly the same reason you stated. People will think the integration is busted and manually copy/paste the non-passkey credentials in. In that way, I would argue that passkey is not stronger protection against phishing attacks unless its the only way to login. It is, at best, a convenience for users.
I've seen people do this AFK as well, and I'm always helpfully suggesting them the correct way of solving this: verifying the URL again, and if correct, add it to the password manager so it remembers in the future, and never copy-paste passwords on the web. Basically 50/50 if they take the advice or come back after a week asking if it's safe to copy-paste the password into the website, and I try to inform again.
Shockingly, I saw one developer peer copy-pasting a password into a website, but I guess for these people there is no hope.
I've tried using the Firefox integration in the past - more than once - and I don't know... it had so many warts that I got fed up with it and turned it off. And now I have 1Password (from work) also doing its best to feed me credentials all the time. So trying the KeePass integration again is going to have them both drawing suggestion dropdowns all the time..
But ok, I'll give it another honest shot. Because of your comment.
Historically I've seen lots of sites do a subdomain shuffle for login pages every now and then which routinely breaks domain matching, introducing false positives that users have to deal with, making them numb to the threat too. Passkeys baking in the domain check with no workaround means that sites can't do that, which is a benefit.
Why would you trust the very same password managers that don't handle passwords properly to handle passkeys properly?
I'm not sure why you're making a distinction. In many cases the browser is the password manager.
Password managers have had to be permissive enough to work with most websites, and there is no standard for it. There have been sites that blocked the autofilling of passwords and so on as well.
My point wasn't this one particular flaw in some password managers is the reason to use passkeys (the copy/paste point is the much bigger issue anyway), just that it's an example of how relatively brittle the password manager process is. Having it a core part of the spec gives stronger guarantees.
Sites that do this irritate me so much. Ones that try to block pasting and stuff… like somebody intentionally baked that into the site. Who? And what was their rationale? Are they really so arrogant to think people are going to carefully type in some elaborate password not once but twice?
That and blocking paste in fields like bank account numbers and stuff.
Surely somebody here has been asked to implement these mis-features. Please explain what went through the heads of the people responsible for it?
There's no real regulation requiring blocking paste but it has become an annoying informal standard of sorts.
The passkey integration goes the other way, which is much more reliable.
Gell-Mann amnesia effect
https://en.wikipedia.org/wiki/Michael_Crichton#%22Gell-Mann_...
The problem is exactly that they're being forced on nontechnical users when the UX isn't even good enough yet to sell them to technical users.
This is why you use hardware keys which work across devices like yubikeys and the like.
I have two of the old neos and two of the newer usb c + NFC enabled ones.
No issues.
But I have not found any way to use my browser's passkey to login on my PS5. I can scan a QR code, but that requires logging into the mobile app with a passkey. And I can't add one to my mobile phone because I can't login on mobile... the passkey is on my laptop, and it won't autofill from 1Password (Android).
at least in Apple land, if you try to sign on on a device that you don’t own (let’s say a work laptop where you’re not signed in to your apple id) it’ll give you a QR code to scan with your iPhone and it’ll do faceID on your iphone then do some bluetooth handshake to use your passkey on the other device. I’m not sure if this is Apple exclusive or if android/windows/linux would be able to do the same
> The last option is to use “Hybrid Transport”, where you scan a QR code and connect via Bluetooth simultaneously to the computer. Whilst this option is secure and works in theory, reality is plagued with edge-cases where connections fail or Bluetooth is straight-up unsupported.
No doubt there exist services that do not offer recovery method for passkey or mfa enabled account. But this is entirely on them (the service), to blame for, not the passkeys or the users. It’s bad implementation.
Oh well.
You scan the qr code from your phone and it logs you in on that device. The experience is pretty amazing, honestly.
The tragedy of passkeys is that they're a step back from the security offered by the likes of Yubikeys.
But because passkeys are pushed by both Google, Microsoft and Apple: there is is simply no fighting these three. It is impossible.
Passkeys won not because they're better (they're not and the entire concept of "secret behind a hardware security module" that can be transferred to another system defeats the whole point of a HSM in the first place) but because the powers-that-be decided that passkeys are to be used.
It's still a win: the commoners are better served with passkeys.
But a secret in control of Google/Apple/Microsoft that can be backed up is not a secret I control: it's a complete step back from yubikeys.
Passkeys won and we better get used to them (and, yup, there are usability issues as you mentioned).
Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.
And the confusing mechanism hurts there too: I'm always a little bit afraid that i'm somehow more in danger because I keep them in a vault that's shared on all my devices rather than a TPM, because whenever the protocol is explained the "it can't leave your device" part is highlighted as the main source of the security, except.... mine obviously do leave my device, with the vault, so.....
Sites can request hardware-bound tokens, which would block any software based password managers. It's an option in the protocol but one not yet widely utilized.
It should not be in the protocol. And I don't trust Apple and Google not to lock it away from me.
I want my own open source manager and if that is attempted I want it to lie about it.
https://developer.android.com/privacy-and-security/security-...
It does not seem fine for any other site to do this.
This may be the only place where it would be good with a software patent: corporate would not mind having to pay 10 usd/user/year, Google would never.
The entire value proposition, and the reason big sites are pushing them, is they take the user out of the loop of authentication. You are no longer authenticating the user, you're authenticating the users device.
For websites you don't have to worry about cookie theft and dealing with the support load of users needing their accounts reset or dealing with fraud. You can also do some level of attestation to hardware which makes automated account creation more difficult.
For the user it offers no additional benefits. You still have something secret that gets presented to a website to login. Password managers solved this problem. But now for some reason you can't log in when you buy a new laptop.
I am already seeing my "normie" friends getting locked out of accounts due to not understanding passkeys. If they don't have their phone, or it's dead, or it breaks, or is stolen, they just can't access their account anymore. They have no idea how they work or what they're trading off, nor do they understand that they should have prepared for this scenario ahead of time somehow. Upon telling them "yeah you have to use your phone now that you have a passkey" they all universally say "wtf, that's stupid, I never want to have that happen again, I will never use a passkey again."
Passkeys should never have been built for general audiences, they are a huge mistake, I hope they cease to be relevant and die due to everyday folks realizing they're inconvenient and the "more secure" gains ain't worth it for the usability nightmares.
In a weird way this is good news for us. If people are losing passkeys, getting locked out, and incurring non-trivial support costs as a result to the relevant companies, then there's no way those companies will crank down even harder by requiring hardware keys.
As an option, I don't mind it existing for situations like a work environment. Work environments are so much easier because there is a clear line to get my credentials reset, from scratch if necessary, even if I lose everything. The problem is that the consumer authentication case is even harder because it lacks that clear line without also creating a backdoor.
So I insist on centralizing my passkeys into a password manager. I have no passkeys outside of my password manager and will continue to reject them. If it's important enough to slap authentication on, it's important enough for me to not lose it because I couldn't choose where to stick it, which is in a basket that I protect very, very carefully.
Honestly I just don't see how something like Amazon could ever turn on the "require hardware key" feature without blowing their own foot off, or really any consumer-facing service. Everyone loses keys. To a first approximation nobody is going to buy three keys and correctly manage setting up all of them to work with every service. Even if we magically stipulate that all sites support it and they all have some integrated unified approach so that there's no software-side friction at all to register all three at once everywhere, you just get too many people who stuck all three keys on one keychain, people whose houses burned down, people who so successfully stored both backups "securely" that they have no memory of where they are anymore or how to get them back, an endless parade of lost keys. The consumer as a whole is not capable of managing hardware keys.
Given how often my household loses its second car keys for extended periods of time I am not exempting myself from this. My work key lives a much simpler life... it just sits in one place, doing work things. My family would hardly last a month if everyone had to carry around physical keys to log in to things.
I haaaaaate this. And every time I'm like, "do I not already have one??" Passkey implementation has been half-assed by everyone.
What setup are you using? Because I don't have that problem on Linux + Firefox at all
It's totally possible there's something specific about my situation, or the way it was set up in the first place that enables this, idk, but somebody else replied saying they have the same experience so it's not just me.
And even if it was just me, it's still clearly something wrong on the provider's implementation, because it should not be possible for software to sidetrack the user into a passkey enrollment flow, when that user logged in with a passkey to open the current session.
Some probably kinda strong counterevidence to that though is that this doesn't happen on all sites, only Amazon. I've never been prompted to make a new passkey after passkey login on the 12 other sites that I have passkeys in bitwarden for.
I’ve similar issues even in a lower level with LastPass where it won’t even let you enter your two factor if it doesn’t recognize where you’re coming from but then you have to be connected to your email, but your email password is stored in LastPass. There is a real possibility of being locked out at all devices at the same time and not being able to get in to the first one.
Passkeys have been a massive quality-of-life improvement. Yes, there's the minimal risk of lockout if you lose access to the passkey (though almost every site I've used that implements pk's lays it on top of their traditional user/pass auth flow), but generally speaking most people use iCloud or their Google account to store their passkeys, and because those sync everywhere, this isn't a real risk.
I love not needing to deal with 1Password's autofill being flakey and having to CMD-C/CMD-V passwords/passphrases/OTPs on these sites.
I like Yubikeys as well but they are super inconvenient by comparison when dealing with multiple devices. Setting them up is also very user-unfriendly in general; doubly so compared to passkeys.
Now, what I'd REALLY F'IN LOVE to see go away is the passwordless/magic link auth flow wherein you authenticate by clicking a magic link that gets sent to your email or text message inbox.
"Emails are super easy to hack and we're still not sure whether text messages are safe to send on US carriers, so let's have everyone click on a link sent by email or text so that they don't have to deal with those pesky passwords that iOS or Android will automatically suggest for them." Like, what?
Source? And if somebody hacks my Gmail account, won't they be able to access my Google-synced passkeys?
Magic link auth isn't any less secure than any site that has a password-reset flow.
It was innocent enough until it asked for a truckload of permissions, like being able to change the launcher, which they ofc tapped "Allow" to since permission request fatigue is real and still a bit of an unsolved problem.
So the app delivered on its promise and changed their phone's launcher. It had a fake Gmail widget that showed them their mail but, of course, wasn't actually tied to the actual Gmail app and was an easy way of getting a refresh token for their account.
Bingo bango bongo: their email was now at risk.
They changed their password after I told them to right away upon them asking me to look at their phone because "it was slow."
> Magic link auth isn't any less secure than any site that has a password-reset flow.
Which is exactly the problem. Cloning someone's SIM/eSIM and immediately performing password resets is a well-known security issue.
This seems really naive? That's the only flow that's at the basis if you get locked out. What else, do you put people on the phone to verify people by asking their name and date of birth? That's even worse!
But it’s definitely annoying for a frequently used service.
Putting the potential negatives under the rug for a second…
I would be nice to have email that (1) you can’t get locked out of arbitrarily, (2) acts similarly to US mailbox (in its protections and universal service), (3) acts as an identity
Is this a bad idea?
It should be a mailbox with E2E encryption where the keys are stored on your ID card. Backups stay on secure servers that are legally protected from anyone including the police and only given out when you're getting a new ID at a government service center, encrypted with the cards public key so a hacker in the card issuing system can't steal it.
Every user gets a persistent address used as their identity, and any number of anonymous ones. Locking someone out would be both illegal and inconvenient for the government if all their official business is going through the mailbox.
I'd much rather have stricter legislation around password resets built into existing reg frameworks like PCI or HIPAA. If you store a form of payment or PII with a provider, then some form of human verification should be needed to perform a password reset.
And unfortunately is something I start to see to family members/friends that are not tech experts when they ask me to setup them up a new phone... at least the passwords they would have written them in some notebook that they had at home, or always used the same for everything, but with passkey... and when you tell them that they lost access to their email, possibly the files backed up to Google Drive/Google Photos, etc they are surely not happy.
Also passkeys makes it difficult to get access to your account in an emergency scenario, what if I loose my phone and I'm not signed in to other devices? Maybe I've setup an SMS as a recovery method, but first I have to get to my phone company to request another SIM card, maybe I'm on vacation on the other side of the earth in vacation for 2 weeks, I'm locked out of my Google account, and from all accounts that uses the passkey as a sign-in method (including, for example, the account that I need to use to check in on my return flight, or my banking app that I need to pay stuff!)
Not even Google reliably lets you fall back to a password, according to the comments in this article. Losing access to your google is anywhere from major inconvenience to professional disaster.
Expecting every user (site using passkeys) to implement complicated flows is a time-tested recipe for disaster, and it's a bummer to see that unfolding yet again with passkeys.
Do they sync between Android and iPhone devices?
I use 1Password, but passkeys have made things even easier. I'd rather have them than any 2FA method. So many websites make me use a login/password AND then send me an email or text with a code. Every. Single. Time. You're really telling me you would rather do that than have a passkey?!
And, like you said, passwordless email auth is really terrible.
Exactly, if you lose your passkey you just sign in with your password like you did previously. I'm yet to find an app/website that has passkeys only and no passwords.
Seems like a total non-issue to me.
If you can still be phished, remind me what the point of any of this was, again?
You're still slightly less likely to get phished if you only ever login with passkey and only use the password in case of lost passkey. Of course you could get phished that one time but entering your password once (maybe never) has got to be better than entering it daily.
I don't have any passkey accounts where I didn't start off with a password and after adding a passkey the password login method was always retained. What services are people using where you don't need to set a password?
So no password login, but then you can recover your account by adding an additional passkey by receiving an email.
If you want to log into, say, Google, but the passkey flow is the only way in, then you're almost-completely SOL unless you have some way of getting the passkey out of your iCloud keychain and into the keychain of the phone you're setting up.
If you still have your old phone, you can scan the QR code and get in that way. If you don't, then you're completely SOL.
We need to get away from shared secrets for authentication. Passkeys are fundamentally a way to do that, but they aren't perfect. Personally I wish TLS and Passkeys both were way less complicated. I think we could use asymmetric encryption for authentication without certificate authorities and secure enclaves and all that and still be more secure in general than we are today. Think ssh keys. But no browser or webserver does that.
I think our best bet is probably to aggressively use passkeys and work (as was done with with TLS) to make them better until it mostly fades into the background like TLS has.
The best solution I've found is yubikeys. I keep them on my keychain with my car's key fob. If I lose that key fob I don't know how I get my car started. It's not like the old days where you could pick the lock or get a few copies of the key made for cheap. Same with yubikeys. I worry about losing my yubikeys about as much as I worry about losing my car keys. A little, but not too much. I use both so often that it's not too hard to keep track of them.
And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".
Passwords with 2FA are simply better and more freedom friendly.
Even if you throw your phone into a volcano and buy a new one, you can still receive SMS verification.
Though realistically I use a passkey for services I care about and a password manager for the rest.
The most flexible, independence preserving thing to do is to use a third party password manager like Bitwarden, and make that the default passkey flow for your devices. If desired, you can self-host something like Vaultwarden so that you can both keep the keys independent of third parties and walled gardens and also propagate them to other client devices.
To be clear I'd much rather not have learned / implemented any of this, and I don't use passkeys unless forced, but this seems like a valid coping strategy.
The reason is the ever increasing number of hijacks of social media presences and code hosting portals, with the latter being a serious financial threat. Done right, passkeys stay in the Secure Enclave, at least for anything Apple and most of the Android sphere. There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
Passkeys could be the savior of all security problems worldwide from a capability point of view and tech companies would still ruin it by trying to force ways it pushes you into their ecosystem instead of just being whats both secure and convenient.
As an example, I have 3 different passkey _APPS_ on my phone and cannot go down to one because of various reasons with each (such as MS authenticator, forced for integrating to Microsoft at work).
Click "I lost my device", enter contact, get a reset link via email/sms
I’d buy that there are too many different confusing ways to recover from this situation, but not that it’s impossible
Fun fact: Google can decide to reject these. Lose access to the original device, try to rely on recovery codes to login with known current password on family member’s device… nope!
I'm with you 100%.
There will be evil and stupid uses.
The brain-damaged people who think disabling paste on password fields is a security feature will be all over forcing device-attested passkeys as soon as they learn about it.
Evil people will see it as a proxy attestation of humanity.
Either way it will be rammed down our throats if passkeys are widely adopted.
Perhaps I missed something or perhaps it really is that user hostile. It wouldn’t surprise me in the slightest.
My annoyance with the prompts is not evenly spread over the sites I use, it just so happens the same sites that think short login periods = security (it does not) are also the same sites that think passkeys are the best thing since sliced bread.
I have such a low opinion of any company that logs me out every time I turn around and those are the same disrespectful companies that think it's appropriate to spam me with passkey requests when I login. My dislike also extends to those companies they have a "Remember me" or "Remember this choice" checkbox that is decorative, as in it doesn't do anything. Often paired with clicking external links in things like a banking website "Warning: You are leaving this site!", yeah, I know how the internet works, I don't need to be babied by a completely ineffectual dialog (if you think normies are reading that and not just clicking through, you are living in a fantasy world).
I'm glad to see this view becoming more mainstream. Passkeys are grotesquely insecure.
The only possible way to consider them more secure is if phishing attacks were more common and more damaging than lockout, which is so implausible that I reject the idea that someone could take that position in good faith.
Lockout is a real risk, but there is nothing insecure about passkeys. Private keys stored on the secure enclave + biometrics or passcode before any signature is produced + origin binding mogs a static string and a 6-digit TOTP (often generated with a secret key outside the secure enclave) that can be phished and entered from anywhere. Also, in many (possibly the majority) of scenarios where someone is locked out of their passkeys, they’d also be locked out of TOTPs and passwords.
> The only possible way to consider them more secure is if phishing attacks were more common and more damaging than lockout
You’d be surprised.
secure - adjective
se· cure si-ˈkyu̇r -ˈkyər
securer; securest
1
a: free from danger
b: affording safety (a secure hideaway)
c: TRUSTWORTHY, DEPENDABLE (a secure foundation)
d: free from risk of loss
Passkeys as a sole/required method of authentication increase the risk of permanent loss. In any other configuration they do not mitigate phishing risk.
It is not possible to say there is nothing insecure about them.
If a car breaks down every 50 miles we would call it unreliable. If a car’s doors don’t lock we would call it insecure.
That is some serious semantic bleaching!
I’m not disputing the fact that “secure” has different meanings in different contexts. My point is that when we talk about the “security” of authentication methods, we almost always are referring to its resistance to attacks, exploits, social engineering, etc.
If you tell the average non-technical person that “passkeys are insecure,” they’ll think that it’s easier for (WLOG) Russian hackers to phish or bypass their way through some website’s passkey requirement.
And to be clear, I don’t think it’s ridiculous to say that right now, the risk of lockouts outweighs the security benefits of passkeys. But this is a fixable problem. If it gets easier to securely recover or back up passkeys, I think we can reach what is more clearly a “best of both worlds” of security and reliability.
> security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts
The author says "security" against man-in-the-middle attacks. Are they not using the typical cybersecurity-context meaning of "secure" that I just mentioned? (Resistance against exploits, attacks, social engineering, etc.) And note that they say "higher probability scenario of losing access to your accounts" rather than something like "lower security against account loss" which would have been admittedly understandable, but a bit less clear since the more common cybersecurity meaning of "security" was just used.
> deliberately tried to bring up an alternative meaning
I am using the typical understanding of what "secure" means both 1) in the context of the quote from the article you used and 2) generally in the context of authentication methods. Let's not act like I dug up some obscure and irrelevant alternative definition.
> and into your hypothetical context
Is it really so unrealistic and hypothetical to think about how non-technical people (i.e., the vast majority of people) will interpret the at best questionable statement that "passkeys are insecure"? I stand by my claim that most people will get the wrong idea when they hear that.
The calculus changes if the service is a bank or your stock broker, which, if you are in any reasonable jurisdiction, if you can prove your identity (in court) they are legally obliged to ensure they give you back your money.
But, for the vast majority of other internet services... I honestly don't think anyone would want to MITM my instagram account for example.
I don’t use passkeys because I like BitWarden and two factor
Just sayibg
(At least til I get around to setting up my new usb c yubikeys!)
Same as traditional physical keys, you don't have a single key, you have multiple ones precisely so that if you lose/break one, you are not stuck and can go to the local locksmith and get another one in minutes.
In fact it's even nicer since you can just re-use the backup key with no security loss by revoking the other one, and buying another key.
I have multiple identical ones.
> [...] and can go to the local locksmith and get another one in minutes.
Can I go to the digital equivalent of a locksmith (like a backup software) and duplicate my passkey? Can I do that with only my passkey in hand (without having to do anything to the corresponding lock, or having to contact its issuer), like I recently did with a physical key?
So if we are enforcing MFA requirements and allow this kind of clonable key, then we should really require some other factor that is not clonable.
That's the core silliness of this whole passkey mess, IMHO. So many turns of rhetoric and weird compromises, we have cargo cult security and no real understanding of what security level is in place.
Instead of the best of worlds, we can accidentally have the worst of worlds without realizing until it is too late and we're painted into one of those ugly corners.
In fact if you have the technical skills to make your own physical key and respect standards, e.g U2F, you don't even need to buy one and it will work with existing devices and services. I can recommend the Precursor for an interesting exploration of that from a verifiable software/hardware perspective.
Want to get a RealID? You can spend 30 minutes scanning and uploading your supporting documents through the website, or you can hand your documents to the person at the desk and they'll evaluate it in 30 seconds. Over thousands of people, it's rational for the organization to optimize away that 30 second review (it also gives people a recovery option if they don't bring the right documents.) For the customer who is competent enough to bring the right documents, the latter approach is way more efficient. I regularly have to put myself in the "I'm old and hate technology, so lets do this the manual way at the desk" flow even though I'm totally capable of doing the electronic flow.
<<ducks>>
But for regular end users where services are primarily motivated to take money from those users and lock them into their ecosystems, they are a usability disaster and yet another exploitation vector.
It's one solution for two very different usecases, and it just does not work. There is an approach that could work for end users who own their own accounts, but they need to go back to the drawing board and rewrite the protocol with the assumption that the keystore is hostile to the user's interests. That means strong guarantees on key portability so users can migrate away from hostile keystores, and absolutely no ability for services to restrict the user's choice in passkey provider software.
This is a big part of it. An employee at a business will be able to talk to someone in person and say 'I can't login. Can you reset my password?' or whatever equivalent, and be made whole. Even if the business is is made up of 10000 people and the identity of the employee is for some reason in question, the situation can still be resolved with a passport or a driver's licence.
Google is never going to make you whole again if you're locked out of your account, unless you're a celebrity and make a stink. There is no help desk where you can prove who you are (and even if you could, would you want to? That's a whole second domain of problems that I'm not sure will ever be solved completely).
My bigger problem with passkeys is how there's no universal way to register more than one device (in case the first one is lost).
Proton Pass is a specific way to do that, but not a universal way. Bitwarden can't use proton pass to move keys around, google can't, firefox can't.
Logging into a site with your device is like putting your card into the terminal. The site can ask for a password the way the terminal asks for a PIN, but if your device supports Passkeys, that’s like your card having a chip, and it’ll use that instead.
So think of Passkeys like using a chip card.
I dunno how well this analogy works down to the last detail but it has gotten it across to all the parents I’ve used it with
Tada, passkeys.
The fearmongering of losing google account should stop. Yes, some people lose it. There are a larger proportion losing/getting pwned by repeat use. For the majority - just pressing the fingerprint to access an account (like amazon/eBay) via passkey is great.
Fairly technical co-workers - I used to suggest them to buy USB security key few years ago. Now that same fairly technical some how has at least 2 devices with them - so they just skipped the USB security key need - and just use Google (in Android) or iPhone in Apple ecosystem. Everything just works.
Yes, there will be a poor soul that may lost everything with only one device.
It shouldn’t be this way, but it is.
Not everyone has access to server grade hardware.
Until they lose access to that account and then it becomes my problem to solve.
And you need to accept it works for millions.
I'd love a hardware sold in multi-packs and "born" at the factory with identical internal device key encryption keys (DKEK). I'd love, even more, if a token just allowed you to "commission" new ones w/ a user-specified DKEK on first use.
I'd use one token as a daily driver and store the other(s) in safe location(s), empty of my personal key material. (Or, if I can just commission a new token w/ my DKEK, store a printed copy of my DKEK in a safe location.)
Give the token a mechanism to "type" a backup of its internal state, encrypted with the DKEK, as a USB HID keyboard. That gives me an easy way to backup the token each time I enroll a new website.
If I lose my daily-driver token I just pull a spare from storage, import my last backup, and I'm up and running.
That would kick ass. No "You just need to buy two tokens and enroll them in every website" bullshit.
You would need some out of band way to collect and save your key IDs and publish revocations.
I’m not sure if this would work from a security theoretic perspective, need to think about how the request is signed and transmitted so someone can’t fake a key being “alive” when it’s really “dead”.
I do agree this would be incredibly useful if it can be made to work.
Are there hardware token implementations where mere possession of the token is all that's necessary to use the passkeys stored on it? That's incredibly stupid, and should have been disallowed by the standard, if that's the case.
>What if I switch browsers on my phone
>What if I get a new phone
You can let Apple sync your passkeys between devices using iCloud Keychain. Then you can create a passkey on one device and have it available on all of your devices. Google also syncs passkeys to the cloud and lets you use them on Windows (with Chrome)
>What if I change from android to iOS or visa versa
I resolve this by storing most of my passkeys in my password manager. I still store the "important" ones (like online banking) in my phone so a password manager breach doesn't make me lose my money.
>What if I need to log into the site on my Wii U's browser?
Passkeys were designed to let you have more than one, so if you have a device that doesn't let you use your password manager, then just set up another passkey.
This means if you go on a trip somewhere you absolutely need two devices. If you kill your phone and want to buy another one ASAP, you wont be able to do anything with the new device until you can convince the platform it's you. With passkeys you're just SOL. Imagining if you needed a phone to get back from your trip - e.g. etickets, auth needed etc. - it becomes a nightmare scenario.
A third party manager makes it easier, but it's a lot less usable that the first party ones.
Reasonable people make different life choice, having to constantly think about backup strategies whenever I'm away from home would be so stress inducing to me.
If you browser vendor has implemented passkey then all good.
Most things are built for the majority users. Most don't change. Most don't debate browser wars in hn. Life is like that.
For Wii etc. You just scan the QR code shown in the TV interface. all just works.
Yes, if you want 100% privacy and will do only your own dovecot server then it is not for you.
Yes, if you are edward snowden then not for you. For rest of us - it is useful
Yes, you can afford to host everything locally. Not everyone can.
To your point, I for example would add point c) - Is linked to the device you are using currently. If you want to use another device to log in you are in a world of complexity and pain.
Are you part of the 99.99999% users of one of iOS+Apple or Androidlike+Google/Tencent or HarmonyOS+Huawei? If that's the case, you don't need to as the key is automagically saved by your OS' platform and synced with your new device.
Otherwise, you're such an extreme outlier that you probably either know what you're doing or can find out by yourself, right?
This absolutely does not encourage confidence in me. We all know how easy it can be to get locked out of a Google account and have no way of getting back in unless you have enough clout to make a huge noise online so a human there pays attention instead of you being stuck in the 'ol support-bot-run-around loop. It doesn't happen often when you consider how many users there actually are out there, but the potential inconvenience is high enough that “fairly rare in the grand scheme of things” is still enough to be reason enough to be wary.
That's a pain point in everyone's day that should make the benefit easy to understand.
Ironically on macOS we used to have an app called Keychain which unfortunately was effectively renamed to Passwords for non-technical users.
Unlike physical objects they may reside in a TPM, a software vault, an export/backup, or any combination thereof. You may or may not be able to recover or migrate them, depending on where/how they were made.
Therefore you may need multiple per service, or maybe not. Services which only allow one may end up locking you out with no recourse. You get to find out.
None of this is obvious or self explanatory to normies.
As for normies, passkeys or passwords it doesn't make a difference. Either you have people who use love1969 everywhere or those who constantly lose their passwords.
All passkeys accounts for normies require an email or phone number, which is what you can use to recover a password or passkey exactly the same way.
Passkeys really are not any more difficult to explain than 2-factor authentication. Anyone who’s currently been able to actually create an Apple or Google account and successfully navigate their devices up to a passkey screen will be able to grok how it works.
People around here really ought to stop thinking users are complete idiots. Hell, you don’t even to scroll that far to read people calling users “normies” for crying out loud. What is this? High school?
Roughly one per smart-phone that they've ever used. They don't know the passwords or even the email address of any of them, not even the latest.
I always operated under the assumption that the passwords app was just a more casual view into the keychain
Maybe that's a bad assumption
Sure, its explained. But not in a satisfactory way that would reach all users at their level.
This is a bit of an exaggeration and out of proportion, but I think my ideal would be one of the big tech companies should have bought out something like a super bowl ad. Something that actually conveys the idea "hey, we know you've used passwords since you were able to type on a keyboard, but here's new technology that's better and here's why" in plain language that the average person can understand.
Unfortunately, XKCD 2501 continues to be relevant. [1]
If it's that unclear to me, I can't imagine how it can be to the average user.
The way they explain them is atrociously unclear, borderline negligent for services that nag people to activate it for accounts where they may hold valuable data for their personal lives. And while I don't want to spend much time finding out the details as long as I have the option to decline them, I suppose if they can't explain it and convince people of its advantages, it's because it's just bad tech.
Then on top of that there's a whole 2nd factor layer which _also_ typically involves a touchid press but for a totally different reason (as the 2nd factor, not to unlock the password safe storing my passkey.
It's just an ugly inconsistent dance, dozens of times a day.
I know these gripes are mostly about implementation, and partially about user-facing software, and partially about user choices, but it doesn't make it any less ugly for the user.
And don't you just love the fact that now Apple and Google and Microsoft have MORE control of my identities across the web?
if passkeys had a simple text challenge response text option it would be fine, you would basically be using something like PGP logins. and would be easy to implement in a password manager interface.
as a result, I have zero interest in passkeys. a pity as it could have been useful (cold storage password manger + physical passkey). you can never trust any service to honor "backup" login options, got burned once for "suspicious activity". that is, if you lose a login option (passkey is lost) they can demand it in the future to "verify".
Let's add to that: What if you're on holiday and your phone gets stolen or is suddenly 20 meters under water because it fell off the boat?
What if you are a normal person who only has a phone and it simply dies for one reason or another?
You get a new phone then hire the boat again, go above where your phone fell in and hope it syncs your passkeys?
You either should treat your passkeys with a backup like any data, this can mean multiple hardware keys or a cloud backup of your passkey, like bitwarden or the provider's native backups.
The idea of multiple hardware keys, which have to be enrolled individually to every site, is just not an ordinary end-user friendly activity.
So passkeys may be great for technical users (who are happy doing that) or corporate users (where centralized IT systems can be put in place) but not for standard non-corp users (which realistically, is most people)
Not talking about you. After all passkeys are not there to protect people who have home labs and don't recycle passwords anyway? They're for normal people who only have one device.
> who are happy doing that
You think they're happy? I'd say they grudgingly comply at best.
Suppose you do want a secure solution for the main sites your stuff is on. But every piece of shit content mill also wants to set up a passkey.
Edit: wow i missed this:
> a cloud backup of your passkey
... which is protected with what, a passkey?
And yet you love passkeys? How much will you love them when you're locked out of something you can't do without?
Yes. The security benefit can't be overstated.
> How much will you love them when you're locked out of something you can't do without?
I certainly wouldn't be happy if this did happen, but it would be my stupidity (or the stupidity of those who implemented it on the service/platform where the problem occurred) which I would blame more than the fault of the tool. I do keep all passkeys in Bitwarden now so that's something at least.
With the app you use to store those keys (a password/key manager) it's the same - you simply wouldn't have an autofill working. Sure, people can and will circumvent this for the benefits of the scammers, just like they can circumvent passkeys using non-passkey login option, indeed:
> weakest recovery method: SMS
> If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details.
Similarly, don't other modern password storage methods have the same property?
> lacks the decades of UX polish towards password autofill.
A lot of years in those "decades" have been wasted polish-wise: you still can't log in with a single button, e.g., many popular sites only fill a username first, then require an extra dealy and action before accepting a password
Sure they work fine on a technical level, but they're frustrating and confusing for the vast majority of people I know.
I worry I am going to get locked out of my Google account, muggles don't. Doesn't stop them from getting locked out.
Apple has a vision where you have an iPhone and a mac at home and a mac at work and a vision pro and an Apple TV and all of that and your passcodes "just work". Doesn't work for the "rest of us", like we're already used to AirPods punishing us for using Windows.
I have many of those and I fucking don't want them to "just work". My iPad is not my iPhone. My Mac Mini is not my iPhone. Yet my iPad at home pops up the speech-to-text voicemail notifications from phone calls that I chose not to answer while I am miles away at work. It's so fucking annoying that you can't specifically turn that off.
My usual "go kit" has my iPhone in my leg bag and then my iPad is either my main bag or one of those pouches that waitresses wear which has plenty of room to pack a tablet. I like using the hotspot (being parsimonious with data) and being able to respond to texts with tbe big screen. It's also nice that I can share passwords and passkeys easily between them.
Other aspects of the "Apple Lifestyle" make no sense to me, like I an a mirrorless photographer and use my iPhone like my Sony, I will go out with my selfie stick and shoot 200 selfies, transfer them to my computer, pick the best 3, them clear them all out.
I plugged my iPhone into my Mac when my wife was logged in and it tries to back up the whole 'freakin phone and renames it "Olivia's Phone" which is just nuts. Of course their answer is that you never clean out your phone, you just upload it all to iCloud, where I think the value proposition is you can pay $1 a month and stop all the dialogs nagging you to get it... Now only if I could have made the badge for Apple Arcade to go away by trying the free trial and canceling it!
If it works without any issues, great.
But if you ever run into one of the 50 messed up situations, good luck.
I actually prefer non-resident U2F in some ways. You don't have to store anything on your key, you are just signing requests. This is relevant where U2F/FIDO keys have limited slots for 'resident' keys.
In principle, it's great. You have one good password to remember for the average user, and that's enforced by their device's probably good enough security posture.
They are resistant to being phished and they won't reuse the same one everywhere. They then don't end up going from hunter2 to hunter2! everywhere.
But my experience for users is that they worry they are giving their biometrics to Amazon or whoever and so the UX just confuses them.
The certification aspect was new to me too last time passkeys came up. Sites can require that a given passkey has been certified.
The patchy support for them is also frustrating. MacOS does not support NFC FIDO/U2F. iOS does.
For less tech savvy folks, passkeys are a godsend since they don’t have to remember passwords or fish around for codes
This is, in my opinion, the most serious problem with passkeys. I'd like to adopt them, but this is a blocker.
The same is true for passwords with a password manager.
> If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details.
Also not really a problem with randomly generated site-specific passwords in a password manager.
Really all the browser vendors had to do was add an API to make automatically generate a password that is then stored in the user's password manager the low friction option.
If sites fixed this issue instead of pestering me for a passkey I'd be happy.
But they also introduce single points of failure, as the article points out. I can't even remember how many times I've had to help a family member recover their account or get confused when they can't sign in on a new device. It's incredibly frustrating that this flow is promoted as the default for so many services.
1password is the best solution I've found for the average person. It's not perfect (it's definitely more complex than writing down your passwords on a piece of paper or using the same password everywhere) but it's much easier than juggling yubikeys. I know so many non-technical staff members who prefer the OS or browser keys even if it means another account recovery is lurking around the corner.
I proposed an alternative scheme many years ago: https://www.researchgate.net/publication/343318317_Privacy-a... . By allowing "offline" keys you can also treat them as higher priority, and use them to revoke any lesser keys from attackers if your account is compromised.
It would also be nicer to get rid of usernames, but that's a fight against the data-gathering powers that we're unlikely to win.
As an example, recently Sony asked me to setup passkey. I did. But it skipped bitwarden somehow and went on my phone.
I tried to login to my Playstation account on the computer and it directed me to continue logging in on my phone. I did so and then the web client just said an error occurred.
I turned passkey off on Sony.
It should always have remained a second factor device. It’s not impossible to teach people to use these, European banking did it for years. There’s just no will to do it.
Under this scenario, the first factor can be a short password or even a PIN.
I have physical passkeys, one attached to my keys and another on my desk at home and I absolutely hate software based passkeys. Every single time I'm asked for a passkey it always ask me if I want to use my Apple Keychain first and I wish I could default to physical.
Decoupling logins from the big cloud providers is a clear win for freedom and protection against abuse. People are frequently cut off from their cloud accounts for whatever reason, and I expect this problem to increase as global disorder increases.
(To be clear, I don’t think people should be legally forced to use tokens, but I do think that industry should be heavily encouraged in that direction.)
there's some issues with passkeys, but not being able to memorize them is a feature
same ux, different security properties.
>Except that at least I can memorize a password by heart just in case.
"just in case" should be a thought out recovery flow, rather than hoping that you remember the password of the account you need to access.
double triple emphasis on "memorized"
For the average user, which doesn’t use a password manager, this is great. It means they can’t get phished. And it’s also great for the average password manager user, who keeps dozens of insecure and reused passwords in their vault because they manually thought of a password when signing up instead of randomly generating one.
If you’re already using a password manager and random passwords, the UX is designed to be the same. It’s just a way to get regular people to do this.
Passkeys just make it harder/riskier.
It’s basically server side of passkeys as boring as possible: self-hosted Go binary, Postgres, REST API, and no requirement to move users into another IAM system.
Would be interested in criticism from the passkey skeptics here.
The only issue I've had is sometimes a website has poor support for my password manager, and I can't find a way to put in my passkey. That is very annoying. The benefits are worth that IMO - can't forget my passkey, can't phish my passkey, can't be hacked serverside. It's a clear upgrade to passwords
I also don’t love how many websites and apps use them in stupid ways like using them alongside other 2FA or login methods when the passkey alone should be sufficient.
My gripe with passkeys is they are almost always implemented without a second factor.
You’ve mentioned the rare case of 2FA with a passkey as being a bad thing, but in my opinion those few cases are actually doing it RIGHT.
With passwords and 2FA, if someone manages to copy your primary authenticator (password) they will still be locked out because they don’t have your secondary authenticator. This protects you against malware that steals your password database.
But the way most companies implement passkeys (single auth), if someone steals your passkey database they can use it immediately. For all of the true measurable benefits that passkeys bring (not memorizable, higher entropy, automatic storage and use in a database) they are almost always used in a way that has this huge drawback: no 2FA.
This is not an issue with passkeys directly, it’s an issue with how services implement passkeys.
My Yubikey supports passkeys and protects them with a PIN of my choosing. No services need challenge me further.
Yeah, but I agree with the headline. I don’t want to be tricked into enabling this “feature” that I find burdensome, but some sites try hard to coerce enabling it. The modern web is a bummer.
Windows still required entering a local PIN, sometimes 2-3 times. I think the account recovery didn't scale, though haven't really tested/explored with any real users :)
The option pops up in the middle of a normal log-in flow. I'm guessing most non-techies don't know how it's implemented.
Oddly, some login flows display a normal user/pwd form, but you get the in-browser "use a passkey?" option/popup which further confuses matters.
Thankfully, me, wife, and all our parents are tech-savvy enough to use password managers, so the fallout from lost passkeys hasn't be an issue. But I certainly see how it would be an issue for anybody entering passwords from memory or similar.
Anyway, companies should be educating users more on passkeys, how they work and where they get stored.
0 intermediary yet proper and convenient authentication. If that friend ate the key (which he didn't) I'd just use my backup key, a cheaper non biometric one.
I think it's not more popular because people don't care enough about security to buy actual keys, rely instead of 3rd parties that they don't actually trust, e.g. Microsoft, Google, etc then... complain it's not good enough.
It most definitely isn't. Any 2nd factor that is not the device I am currently using (either a yubikey or my phone) has a non-zero chance of not being near me when I need it, leading to the constant question of "where the fuck did I put that darn thing", only to find out that the cat has decided to believe the yubikey is a mouse and tried to devour it, the phone's battery went dead...
> Phishing through the standard login flow is eliminated by passkeys, but it creates a false sense of security. An account’s security is still dictated by the weakest recovery method: SMS, email links, security questions, and so on.
Passkeys are too strong and may cause account loss.
Passkeys are too weak and can be bypassed by account recovery.
Turns out, given the variety in the ecosystem, both these things are true depending on where you look.
(But you still can’t “copy” a key, which is unfortunate).
In fact, I think it's technically possible. But it's true, as of today I don't think anybody supports it.
I was experimenting on solokeys with ios, in principle we could backup Passwords (the ios/mac app) into a solo key, space permitting, including passkeys, regular passwords and totp (not wifi passwords). I believe the same is for Android, but haven't tested yet. This is all experiments I've been doing on my own, there's nothing ready to be released.
As someone who's OpSec puts swiss cheese to shame Passkey has been a godsend. My passwords are actually much better because of it.
Very odd. I use passkeys extensively with BitWarden and I love it to the point where it's my preferred way of securing things at this point.
The fact that the website presents the question to BitWarden in a structured way (what website, what username) means that I never fight with selecting the right account to get the password for (because I commonly have multiple accounts for a single site) and it generally makes the login flow much smoother.
Environment is MacOS with Brave/Firefox + iOS.
It wanted me to log in for some reason even though it had worked fine for months. Login uses my Google log in.
When I try that, Google asks me for a hardware key to complete the login, even though it's my phone and I'm already logged in.
Eventually I figured out that if you select "log in using another device" and then click cancel when it brings up the qr code, you can select a push notification on "another device", which actually pops up on the same device. Do that once and it fails. Do it a second time and it succeeds.
All to use the tailscale app on my own phone.
As a service provider myself, I've evaluated and said "Nah" to passkeys - because it's simply increased Customer Service contacts I have to invest in, whenever a user changes or loses devices, or any of the hundreds of ways Passkeys are not portable.
And guess what, the Tech companies pushing this have zero liability for user login support or security breaches. It's always me. There is no need for me to work hard and spend CS contacts, to wall off my users to the OS or Browser vendor.
I'll simply do passwordless Email or SMS 2FA / Magic Links and own my users without the overhead of Customer contacts, thank you.
Why you missed the last line of my answer? How did you get an impression to go back to broken passwords?
I must say it's pretty amazing how well-integrated is Bitwarden with iOS now, passkeys, password generation, everything. I have disabled Apple passwords manager, and Bitwarden feels like the native solution.
it's all backwards, I agree, even worse that we trust "sync to the cloud" but don't allow users to own their credentials.
That said, I don't like passkeys either.
They didn't want to cooperate, and they wanted to make passkeys transferable within you cloud account, while not cooperating with anyone or anything else. The result was that you have no predictable and stable pattern/protocol/interface, or even general description, for how, for instance, a website connects to the passkey or even a hardware key, if you wanted it.
We basically have all the browsers, the operating systems, and the password managers, all fighting over who gets to store and present the passkey. And everybody assumes that they are the only one that exists and actively tries to fight the others is they can.
The basic technology is really good and could work well, but the large asshole tech firms focused on self-interest and walled gardens and made it insufferable.
Locked out of device? You should use a password manager which you can still log into again on a new device.
Want to log into a service on a device you don’t own? Log into by scanning a QR code with your passkey (windows offers this standard when you keep a passkey on a different device for example).
GitHub breaks with this, PayPal breaks with this...
If the browser supports them and stores them securely you're safe as houses even after a breach.
As many USB-security keys can be used passkeys.
On any site where I create them the login experience gets worse. Sometimes I get a QR code to scan (terrible, almost never works too). Sometimes I am offered to login with passkey which I have and it doesn’t work. Almost always I need to fallback to password and it just sucks.
I hate passkeys. I wish there was a checkbox somewhere to tell all websites that I never want to use them.
Probably hundreds of millions or even billion people have devices that support biometric auth. How is that not mature?
Brilliant security: a highly secure high-tech shiny front door that can randomly fail to open, so you still need the low-tech back door, which is the one potential thieves will use.
Mind you, it can work if the back door is old but sturdy (basically, for a bank that will ask for KYC authentication, or in the worst case you can set foot in the brick-and-mortar branch showing your face and ID and ask for access) but for pretty much every other service it introduces risks for very little or no gain.
Password managers are great IMO, I can use some absurdly long password, backup is reliable, I can use them across devices. For extra secure stuff 2FA works the same, I've got an app with codes I can easily back up and use from multiple devices.
Passkeys tend to obscure everything and take away a lot of control.
(Or since syncing passkeys usually works within ecosystems, you might just need a passkey per OS.)
The purpose of rotating passwords is to cycle out potentially compromised ones, due to phishing attacks, keyloggers, shoulder snoops, etc. But those cannot exist with a passkey.
What kind of compromise are we talking about? Was the device stolen? Then yeah, you need to rotate passkeys (and all your passwords, and remotely cancel all your live sessions, none of which is new).
Was the device hacked from afar and the data read off of it? The passkey is probably fine. You can rotate it if you want to, it's not a bad idea, I probably would to be certain, but you're not pwnd even if a bad guy got a shell for a while, heck even if they got a root shell.
I understood the question to be "should passkeys be rotated regularly" to which the answer is probably no because there's not really a compromise mechanism that periodic rotation defends against as far as I know.
Rotation defends against secrets that leak through normal use and without your knowledge, like a password entered into a phishing page or snooped over your shoulder or cracked from a breached hash. Passkeys aren't vulnerable to those things because they never travel over a network, are never seen by the server, are never seen by their own users.
You change the locks on your house when a key goes missing, or is known to be in the hands of somebody you don't want getting in, it's not something you do every three months just in case. Same with passkeys.
Ideally optionally followed by a 2FA (naturally, via text, delivered straight to my Mac, even further diluting the questionable security of the whole exercise) and naturally, to be repeated every 2 days or so, since "stay logged in" is the biggest lie after "I've read and accepted the ToS".
Your phone (which is probably what, 80% of relevant traffic these days?) likely has a perfectly fine password manager built in. This "sign in via email" trend must be every scammer and phishers biggest dream come true...
I am looking at a new project that uses magic links sent by texts. I have been there and done that with authentication systems and that's good enough for a low stakes ludic activity.
Microsoft is especially poorly prepared for this - Often if you have a passkey, it will CONTINUE To ask you to create a passkey (a new and different one), and it may save it in a different place, which is infuriating.
Strong password + MFA is the way, and I don't see that changing.
I don't know who designed this or who thinks these are acceptable affordances, but it seem to be part of the same disingenuous push that's behind passkeys in general.
Like, seriously?
If you think passkeys aren't ready yet, blame the people implementing it on their platforms.
My company has already responded to multiple breaches where this has been what quickly follows an initial intrusion.
1. Write it down on a piece of paper and put it in a safe deposit box.
2. Read it on one device (or from a piece of paper!) and enter it manually on another device.
Plain text is the ultimate form of cross-platform portability. Passkeys are the ultimate form of vendor lockdown. The passkey vendors won't even allow you to view the private key, unlike with ssh keys, which you can also write down on a piece of paper. It's vendor cabal to destroy computing freedom in the name of "security", always the excuse. Tech company paternalism at its worst.
If passkeys were meant to be user friendly then there'd be a secure optical transfer mode to QR code them from device to device with the screen and camera.
Easy to implement (receiver flashes a public key, sender encrypts to that key and flashes the QR code back).
That it doesn't exist for a protocol meant to work with phones tells you exactly where the thinking was headed.
Of course, at the rate we see security failures everywhere, I'm not entirely convinced writing your passwords on post-it notes wasn't such a bad idea after all.
It's entirely one sided solution.
Like, no company should be storing anything but a salted hash of their users' passwords.
Passkeys work nicely, and I'll use them, in cases where I want decent security, but I don't consider them the "Philosopher's Stone" of regular end-user security. I think they are still a bit too "fiddly" for your average Joe[line].
People have replied it's possible to extract the private key, but it's not clear to me that that's usable (maybe it is I don't know). It's certainly not in line with what passkey devs want people to do and not do, so I'm not interested in "fighting" against the "flow" so to speak.
I'm happy with TOTP, as I can manage and use the codes where I want, under my control.
But, hey, here is the new startup idea for you: make passkeys great!
<sarcasm>On the plus side, this way passkeys can also be tied to age/identity verification.</sarcasm>
The author's assertion that the greatest risk to an individual is account lockout versus phishing or password harvesting is just not grounded in reality. I get phishing emails and SMSs daily. The criminal ecosystem running these campaigns is extremely active already and set to become even more so with LLMs. These campaigns are by far the biggest threat to normies.
Whereas account lockout happens most often with multiple failed password entries, which passkeys completely eliminate. I just don't know where this risk evaluation comes from.
The author also points out that even with passkeys, if you're able to also log in with e.g. security questions, you still have a much weaker security footprint for that account. This is true, but it's also true of a TOTP second factor. So I'm not sure what the criticism is here.
The exportability argument is a real weakness and something I'd like to see addressed. Passkeys don't have an equivalent for backup TOTP codes that you can just write down somewhere or trivially store yourself. But it probably wasn't in v1 because the people who designed passkeys figured that websites would not go all in on them immediately and would preserve other authentication methods, which is exactly what's happened.
so much better than fumbling around with a password managers
And why do the OSes push for this so hard? Because the goal of the execs is lock-in and control. And their lackeys here on HN who implement this stuff and their families are the 1% who are all-in on one ecosystem so they arrogantly believe "this all works great and the masses are just too stupid to get it".
Attestation already destroyed user freedom in mobile app ecosystem. You can't just implement your version of some mobile banking app or whatever just by using original app's API, because dark overlords of gated app comunities allowed app authors to prevent this on OS level by giving them attestation tools.
They provide crappy usability, they're expensive, they're easy to lose, you can't use the physical keys when doing remote desktop access.
My job requires me to use them. I use only for the job and nothing else. For sites requiring 2FA, I use TOTP (time-based one time passwords) from KeePassXC.
It's a minor inconvenience, but happens so regularly I hate it. It also stops the login flow until I dismiss the prompt, which is also annoying as I could've already gotten to the page I wanted to get to in the time it took to dismiss the dialog.
Website problems:
* First big problem: you try to kludge them as an "add-on" to a password or SMS "2fa". Just rip the band aide off and let people go 100% passkey by default. It's actually really easy for users. We do a push at the end of their onboarding flow and have a 95% conversion. Users love it and its seamless.
* Don't make people enter a username. Just have a "login with passkey" button first, and thats it. If the HIPPO in your organizations insists a username-password still be available, make the user navigate to a secondary page first to do so. Make the passkey the first-class citizen.
Password Manager problems:
* Google, Apple, Microsoft are trying to lock people in to proprietary password managers. Microsoft's password manager, plus their "microsoft account" experience is a steaming pile of shit. The key here would be portability. An export format exists for the public key (thats how enrollment works): It's a but of digits in ANSI X9.62 format. Not hard. The private key would be an unbelievably simple export.
Protocol problems, and I'm happy to be wrong here:
* The client does not sign the server issued nonce (aka the 'challenge') during the authentication flow. This is kinda weird IMHO. Technically, yes it is secure, but it relies solely on the TLS channel heuristics. It'd be much better to have the client prove the signature on enrollment as layered security.
To address the author fears on attestation: This is a real threat to users... imagine a website "only accepting passkeys from OUR password manager". Luckily, Apple has done us all a favor and outright killed that part of the protocol by refusing to send this required fields there, protecting all users.
Overall, you should use them. We need one tiny change to the protocol and better password managers.
If you use an untrusted machine, you either revert to the least secure backup method (your master password in Bitwarden) or don't log in.
If your phone is your trusted device and becomes lost/stolen and then replaced, you revert to the least secure backup method e.g. password, security questions, or even waiting to be manually verified. This can be problematic if your online bank requires 2FA so you can purchase the replacement phone.
The QR + Bluetooth thing sounds dumb as hell.
Kiwi Browser doesn't support passkeys even with Bitwarden on my device. I have to choose between an inferior (for my needs) browser or passkeys.
-----
Rather than passkeys, which always rely on a trusted device, my preference is, "I use a password manager and site-specific generated passwords, and when I try to log in with only a password on your site, send me an email (whether pass or fail), plus never require 2FA except for banking and perhaps to change email/password"
It's unlikely I'll lose access to email notifications at the same time someone tries logging in with a phished password (except, obviously, my email password, which should only be changeable with 2FA) unless I am specifically physically targeted or astonishingly unlucky.
If someone uses a fake website or other MITM method to grab my credentials, I'll be fine because I'll get the "hey PennRobotics you logged in to crabcakes.com just now from a iPhone" message and then immediately triage that unexpected situation.
If I need to log in to a website in private mode or on a different device, it takes an extra 30 seconds to log in to my password manager plus no device dependency.
-----
The passkey problem for me? You need some hardware or else it's glorified 2FA or even (in the case of the Paypal app) 1FA applied twice, and as soon as you lose EITHER the hardware or the "what you are/what you have" part of 2FA you enter a world of trouble.
Also, ToS lockouts happen. When Google terminates your account (for any variety of imaginative or realistic reasons) there isn't really any method to use or export your passkeys anymore.
I can see why they would be problematic for people who otherwise live life with a single love2025 password though.
Or do you demand that the user has an email with that 128-bits authn too, with a key on the same phone that was lost?
1Password everywhere, on iOS, Mac, and Windows. I’ve run into none of the issues elsewhere in the comments. Everything just works, including in-app logins.
Maybe your other password managers are just bad at implementing the right browser/OS hooks?
The only part that is very persuasive is the part about storing your passkeys with Google or Apple integrations, and what happens if they ban your account. But the same argument would apply if you’re only storing your passwords in a Google or Apple password manager.
I use passkeys and I always store them in a password manager I control - but usually I also store another one in the OS on Windows, Apple, and Google. Best of all worlds. Also, I appreciate that idiots aren’t forcing me to “change my passkeys” every 90 months like they STILL do with passwords!
Their security is nearly universally undermined by reset mechanisms.
There are virtually no sites where passkeys cannot be bypassed.
No grandma, don’t use the unphishable one-click passkey setup that syncs across all your devices. Instead, install a third-party password manager (no, no, not the one built in to your device or browser), then another TOTP app on your phone. It’s slower and more susceptible to phishing, but uhhh, what if you’re among the one in a million people that has their Google or Apple account wrongly banned?
My Macbook can sync passkeys from my Android phone?
The UX is obviously a lot smoother if you have an iPhone and use iCloud keychain for everything, but that’s not an uncommon setup.
At some layer you have be able to access your services with password/totp if only for recovery. Passkeys add a layer for minimum benefit, in my opinion.
Yes, push based totp and passkeys are more phish proof but for non techies, managing them is its own job.