Hacker News Reader

Comment by gowld | Hacker News Reader

Does he explain the flaw anywhere?

He says it's "easy to find" but apaprently he can't find it. https://mastodon.laurenweinstein.org/@lauren/111211489395997...

Why is "weak device password" a reason to avoid passkeys, when those users presumably have weak service passwords as well?

View on HN

It seems like his argument is that putting access to valuable accounts on your phone is a bad practice, because if your phone is stolen at the club after the thief watched you enter your code, then the thief can get at your banking, brokerage, crypto, password manager, etc.

But that argument doesn't address how passkeys somehow make that worse.

Sure, if you don't want your valuable stuff stolen, don't put it on your phone. But that's a problem whether you use passkeys or passwords or passwordless links sent to your email or SMS.

The point is that the phone with a crappy 4 digit pin can be used to authenticate everything on every device the user owns that uses passkeys. It's a one stop shop of failure.

Phones are already that way. They have text messages and email which is enough to log into almost any service.

Yes, that's also bad. They're both bad. Passkeys are worse.

The argument is that without your phone, you likely have no recourse to stop the attack. Since your passkey on the phone is what controls your access, now.

The argument for passkeys is they make it better. Not not worse.

Reply on news.ycombinator.com