Hacker News Reader

Comment by systemvoltage | Hacker News Reader

Like many round trips we have made, I suspect in the year 2035, we’ll look back and say to ourselves: “Yeah, password was super based. Just copy paste it in the box and you’re logged in. Can store it anywhere, even in a notebook. Safekeep it by printing them. No need for HyperBigTechCorp. Portable. Those gray beards had it right the whole time.”

Can we please stop the bandwagon for a moment and inquire about the downsides of Passkey?

View on HN

Technologically there's nothing really bad about them (imagine a managed version of ssh keypairs). Technically they could even be backed by physical devices like Yubikeys and never touch the cloud.

My worry is the actual implementation, where platforms might lock you into their cloud as the sole provider simply by not implementing interoperability...

How do you bootstrap it? You get robbed at gunpoint by some ruffians and they take your wallet, cellphone, keys, and laptop. Hopefully they can't get into your accounts, but never mind that, how do you get back in to everything?

Recovery code system? Like 2FA today, generate a special bootstrap key you can print and save.

This isn't that uncommon. Things like disk encryption also do this (e.g. bitlocker)

> generate a special bootstrap key you can print and save

So ... a password?

Also in this scenario you've been robbed. It's quite possible that either they took your printed out passkey also since it was in your wallet, or you're not at home where you can get the pass key from your file cabinet or safe.

Not really. A password is meant to be memorized and reproduced correctly regularlt, whereas a recovery key doesn't need that and can be very long and complicated since it is rarely used.

Probably easier to start a new life at that point.

You don't.

Reply on news.ycombinator.com