Hacker News Reader

Comment by tonymet | Hacker News Reader

This still feels like a beta product, with a foot-gun of a UX

* I activated the passkey, but since i had one saved from an old device, it did not set up my new device. So i got locked out of my account (luckily i have a backup option)

* How does this work with desktop PCs that don't have a camera?

* Now we have a web of primary, secondary, n-ary authentication methods that need managed. Password, app 2-fa, phone 2-fa, tokens etc. Any one could be a weak link in the chain. Now warnings, notifs & reporting is needed to maintain security among all the auth methods.

It reminds me of the XKCD "standard" that now means we have n+1 protocols

View on HN

Definitely agree with concerns regarding the UX. While I'm sure many of us here can understand the following paragraph from the article...

> In fact, if you sign in on a device shared with others, you should not create a passkey there. When you create a passkey on a device, anyone with access to that device and the ability to unlock it, can sign in to your Google Account.

... I wonder about the general layperson, especially older generations who (in my experience) tend not to use very secure passwords or MFA. Historically, all they would need to do is use their username and password, and now they are into their account, regardless of which device or location they are at. With passkeys, they have to not only learn a new login paradigm, but also remember that it's different if they are signing in at e.g. the library vs on a desktop at home.

I believe the tech industry needs a special segment of Accessibility catering to the elderly

We are not taking responsibility for the unusable UX we are applying to cars, home appliances, phones, consumer devices, televisions, etc.

Mechanical and even electronic devices have an intuitive direct-feedback UI. Flip on an old iron and it heats up.

Modern devices are multi-modal, with soft-touch keys and modal LCD displays. Some buttons are long-press (variable input).

And don't get me started on cars. Total chaos.

The way it works with desktop is that the browser displays a QR code, and scan it with the camera app, which allows you to register or log in.

Pretty sure you scan the QR code using your phone's camera. Trying to find a page that confirms this...

thanks i re-read apple’s docs and you’re right. I was thinking (metaphorically) QR-code=Passkey but on desktop QR-code = lock, phone=Key

Sign in on a different device with the passkey stored on your iPhone iPhone stores your passkeys in iCloud Keychain, so they’re automatically used whenever you’re signed in with your Apple ID on another device (iOS 16, iPadOS 16, macOS Ventura, or tvOS 16 required). However, if you use a device that’s not associated with your Apple ID, you can still sign in to an account by using the passkey stored on your iPhone. Signing in usually consists of the following steps: Use the other device to go to your account sign-in screen. On the sign-in screen, tap the account name field. Tap “Other options,” “Passkey from nearby device,” or similar, then follow the onscreen instructions to display a QR code on the screen. Use your iPhone camera to scan the QR code.

the docs https://support.apple.com/guide/iphone/sign-in-with-passkeys...

To the second point: windows hello supports a variety of methods, one of them being without a fingerprint or camera. You can add it right now to your account.

For linux users, not entirely sure which environments support any form of "biometrics".

Reply on news.ycombinator.com