Hacker News Reader

Comment by eykanal | Hacker News Reader

So, IIUC, passkeys are a form of public key authentication. You register a public key with a service and then prove you have the private key. It sounds like this article is blaming "big tech" for not creating a universal, seamless, transparent private key sharing mechanism. That seems... silly?

As a user, sure, I'd like to share my private keys around, and maybe one day we'll get there. However, exporting keys manually—which is what it sounds like proton is doing—sounds pretty sucky as well from a user experience standpoint. Now instead of having a password, I have a bunch of private keys that I have to manage and do... something... with on different services.

This article would do well to acknowledge that this is a very hard problem rather than just ring the "big tech suxxorz" bell again.

View on HN

Passkeys on supported websites provide a simpler/streamlined experience vs passwords as they are automatically generated and strong/unique by default without requiring the user to manage the strength of each and every password that they create.

They are also phishing-resistant, which means if a user mistypes a website and lands on a phishing website, the passkey will not work, where a password would expose private credentials.

Passkeys are also exported/reimported in Proton Pass just like regular passwords without any additional work, and as soon as an industry standard for backups is finalized, we'll support that too. They can also be included in shared vaults.

This is content marketing. Rule number one is to find some kind of angle that can generate viral engagement no matter how thin the actual content is. Outrage tends to be a good hook. Acknowledging something as a hard problem, not so much.

Nope. Non-resident keys work differently. You register the public key with the service, then you encrypt the private key (via wrapping but that’s beyond the point here) with private key stored on your hardware token and send the encrypted blob to the service, too.

When you need to authenticate, service sends you the encrypted blob, you decrypt it using the key on hardware token and obtain the private key. Than you do (more or less traditional) public key authentication.

So, you don’t need to manage your private keys. Services do it for you.

The point is many players are trying to find ways for your private key to be portable, too? Yes, it is a basic public key share to the services you are authenticating with, but it is how to maintain convenience at the user's side that is posing difficulties.

Indeed, the first real criticism in the post is "For example, if you create a passkey on your iPhone, it easily syncs to Mac devices but is incredibly difficult to use on a Windows device." It is the private key that they are syncing to all of your devices. And they do that for you because they control all of the places that they sync.

I think you can make the case that they should not sync this off device for you, but then you are in the "what happens when my device is lost/broken/stolen?"

You could also argue that they should let you export the key. But then you are back into the "credentials are easily stolen."

Proton Pass allows you to export and reimport passkeys. An industry-wide standard for exports is not yet finalized, but as soon as it is, we'll support that too.

Regarding passkey implementation, it's up to individual websites whether they use passkey or passkey + 2FA, etc..

Reply on news.ycombinator.com