Passkeys–Microsoft, Apple, and Google’s password killer–are finally here | Hacker News Reader

Passkeys–Microsoft, Apple, and Google’s password killer–are finally here

arstechnica.com

26 pointstosh12 comments

So according to this very sensational article, we should now trust all login credentials to Apple, Google and Microsoft. So just like the horrible (in my opinion ) OAuth setup where we sign in using one of their services, we will now have even less control as we won’t even have a password to save in a safe etc.

Basically, if you loose access to your device and need to login from somewhere else (not your device) you won’t be able to at all.

Yeah I'm already annoyed at the present where I can't log into half my services without being near my phone. I'm sick of it and I can't see this going well as a Linux user.

It seems like passkeys can be moved around, but this article doesn’t describe the process.

Apple’s support article describes it a little better but it doesn’t offer a lot of details surrounding passkeys leaving one vendor and moving to another. It seems to be possible, but the article doesn’t describe steps in detail.

https://support.apple.com/guide/iphone/sign-in-with-passkeys...

“Note: If you want to save your credentials to an external security key or to a different device not associated with your Apple ID, you may be able to select Other Options, Save on Another Device, or similar (instead of Continue). Then follow the onscreen instructions.”

Passkeys also do work on laptops without the need for a phone.

This tech isn’t going to replace passwords overnight, and maybe it won’t replace passwords at all. It seems like it’s just being introduced by the big three and more options will exist to support it.

Dashlane, for example, is offering beta support:

https://support.dashlane.com/hc/en-us/articles/7888558064274...

(I personally wouldn’t describe this article as sensational.)

An according to you very sensational comment passwords are perfect and using any alternative is foolish and makes you a slave to big tech.

It seems like it is just PKI but streamlined enough for consumers to use, and you can put your keys wherever you want. The big guys are using this as an opportunity to push their own password managing solution but dashlane has it in beta and I'm hopeful that it will come to bitwarden too.

> “Users no longer need to enroll each device for each service, which has long been the case for FIDO (and for any public key cryptography)," said Andrew Shikiar, FIDO's executive director and chief marketing officer. "By enabling the private key to be securely synced across an OS cloud, the user needs to only enroll once for a service, and then is essentially pre-enrolled for that service on all of their other devices. This brings better usability for the end-user and—very significantly—allows the service provider to start retiring passwords as a means of account recovery and re-enrollment.”

I'm not so sure I like the idea of my private keys being synced to "the cloud". I much prefer my current workflow where my yubikey is the sole owner of my private key. It is unclear to me if I will be able to continue using this method with passkeys.

ELI5? buzzword soup in the article.

I don’t agree, the article was straightforward.

remember, I'm 5 years old.

But you joined 13 years ago ;-)

Big Oauth is coming for you. Dont loose your phone.

They're not tied to phones

Reply on news.ycombinator.com