Hacker News Reader

Comment by freetonik | Hacker News Reader

In some parallel universe, each computing device manufacturer is required by law to provide a storage so that the user can plug in their single, universal, transferrable set of security credentials (like passkeys). Instead of "many cooks" mentioned in the article, there is one standard.

I cannot bring myself to agree to any "switch to passkey" prompt from any device because I have no idea (and too tired to figure out) how and where that key will be stored, how do I deal with different devices, etc. I already have a universal solution for credentials: 1password, which is cross-platform. With Apple's keychain, and I suspect other companies' solutions, passkeys are connected to your account and at best synced between devices from the same manufacturer. But even with Apple, I can't sync stuff between my personal and work computer because they use different Apple IDs, even though the underlying true identity (me) is the same.

Like with many other solutions, the current approach with passkeys is designed for an imaginary "user in vacuum" model each company dreams about, where people are 100% into one ecosystem, forever.

View on HN

> With Apple's keychain, and I suspect other companies' solutions, passkeys are connected to your account

And from this account you may be locked out for various reasons anytime, as it happened to countless persons previously, violating exotic or even understandable rules, or just been in the crossfire of some galactic corporate incompetence (some f'd up), but this way you'd be locking yourself out of everything especially if you were that user in the vacuum, exposing yourself to the mercy of a single organization with changing managemenet and incentives as the wind turns in a city's dense downtown.

>exposing yourself to the mercy of a single organization

The nice thing about passkey is that unlike password, you can have multiple per account.

So you can register a passkey from 1password to website A, and also register a passkey from Apple keychain to website A, and also register a passkey from Google account to website A, and also register a passkey from yubikey to website A, so even if you are locked out from one of your accounts, you still have several other ways to log into your account at website A.

And _if_ your, say, Apple keychain is compromised, you can just revoke the passkeys from your Apple keychain from all the websites (yes it's tedious, but it's doable).

Having to have multiple passkeys per site to circumvent vendor identity lock-in is one of the main problems with passkeys.

I'd be so easy if this proposal were implemented: https://www.yubico.com/blog/yubico-proposes-webauthn-protoco... one could always register one or more additional keys without having access to them.

A door can be kicked in, a safe can be drilled, a password can be reset. But these keys (whether a phone or a Yubikey) to your digital life are irreplaceable if they're all lost. We've never been in this situation before.

The problem with any solution relying on a couple of physical devices as the sole access to your digital life is that the management and protection of those objects becomes one of the most important things in your life. These keys are supposed to give perfect security so by design making "software" copies brings that security to the level of passwords. But losing them kills your digital life.

You have two keys in the house and you have a fire or severe natural disaster? There's no reset for them and you just piled a tragedy on top of another. You want to restore them from a backup? You probably need the keys to begin with. People need one on them at all times, one at home, one or two in some other safe far away location but to still trust that they won't be misused there.

That's all people hear when they look into passkeys. "One more key" is not enough for most people, tech savvy or not.

Even if it's possible technically, I don't think it's very practical, as UX is very heavily directed towards a single passkey provider. I can imagine doing this for one or two most important websites, but not for each of dozens (hundreds?) websites users have registeration on.

It's not actually all that bad. I went through today and added passkeys for all the sites I use that support them, and for most it went like this.

1. I login to the site using my password, supplied by my password manager (1Password).

2. I go to the site's security settings and find their passkey settings. I invoke their "add a passkey" function.

3. If I'm on my Mac, using Chrome, Firefox, or Safari, I get a dialog showing me the site and the user name and asking if I want to save a passkey in my 1Password.

There is a security key icon on the dialog that I can click if I want to save the passkey elsewhere. That replaces the 1Password dialog with one offering to save a passkey in my iCloud keychain for use on all my Apple devices.

That dialog has an "other options" link which brings up another dialog that adds options to use an external security key or to save a passkey on an iPhone, iPad, or Android device with a camera. The latter option will show a QR code that can be scanned on that other device.

I save the passkey in either 1Password or my iCloud keychain.

If I'm on my iPad using Safari it is similar, except the first dialog shows both 1Password and iCloud as storage destinations, with radio buttons to pick between them.

4. Repeat step #3 once, storing a passkey in whichever of 1Password and iCloud keychain that I didn't pick the first time through.

Some sites let you give the passkeys names to make them easier to remember so there might be typing a name in there somewhere.

All in all, it is only a few seconds to add a passkey after pressing the "add a passkey" button on a site, so adding two is no big deal.

I currently have over 700 credentials in 1Password. Consider me not interested for anything that takes any decent amount of time.

I really like the idea of passkeys but I think most people forgot that security and convenience are not working well together, and passkeys attempt to solve this problem.

Passwords have their own issues but they are so easy to transport to multiple stores, meaning loosing access is going to be hard(er).

And as long as there's going to be a single-point-of-failure (being it Apple, Google, 1Password or whoever stores your passkeys) without any _easy_ way to retrieve your passkeys again I'm advising against it.

With passwords, I don't care loosing access to my iCloud/1Password/whatever. A somewhat recent list of all passwords are stored in a safe place, printed out on paper. AFAIK this isn't easily doable with passkeys.

You can still benefit from adding passkeys to some sites. It will often be a little faster and/or fewer clicks than using a password, especially at sites where you have to enter a TOTP code.

For example at Github signing in with a passkey from the sign in page is two clicks. Click on "Sign in with a passkey", a dialog pops up from the browser showing the passkey it will use by default, and I click "Sign in".

With a password it is a click to have 1Password fill my email and password, a click to submit (which could be eliminated if I had autosubmit enabled in 1Password), and then it asks for a TOTP code. After the code is entered it is a click to complete the sign in.

Github's TOTP entry form is well coded, so if 1Password has the TOTP key it will automatically fill it. If you don't keep TOTP keys in 1Password you'll have to open your authenticator app and copy the code.

Considering that it only takes a few seconds to add a passkey for Github to 1Password, you'll make up the time that takes after just a few logins.

I'm not sure what UX you are talking about, the majority of the websites supporting u2f/passkey have UX to manage your u2f keys/passkeys. (the only exception I can think of is early Twitter when it first implemented u2f, and at that point it only allow you to add a single u2f key, but even Twitter fixed that later and supports multiple keys now).

And (this is probably not emphasized enough) you really should never only use a single u2f key/passkey for a website, that's the recipe to get you locked out when you can't find your u2f key/get locked out of the provider of your passkey. I have at least 2 yubikeys on my keychain all the time (one for usb-a and one for usb-c), plus one for each of my computers, and passkeys from 1password, google, etc.. And whenever I add u2f keys/passkeys to a website I add all/most of them.

...and you just described why this is not ready for prime time. Managing a number of physical devices tied to completely opaque secrets stored by unclear providers in places you never see, with hidden agendas promoting their locked-in solution over all others and complicating everything out of one ecosystem.

Most standard users will either mess up royally or run away scared. Damn, I've been on this field for 30 years, I've been using 4 OSs, 5 different browsers and devices from every ecosystem, and I still find this whole thing too much of a hassle.

And yes, I do have a backup passkey. Even though I had to convince my skip-level that it made sense. I just find it all too complex to adopt it broadly.

if I am reading right, any time you set up passkeys on a web site, you add half-a-dozen passkeys from various services? Yeah, this sounds totally impractical to me.

Have you considered stopping using passkeys and using strong passwords stored in password manager instead? You will have approximately same level of security:

- Either way, if one site is compromised other sites are not affected (because password managers have site-per-password)

- Either way, you will be phishing-protected (because password managers autofill based on host name, and you are smart enough not to override it)

- Either way, it'll be game over if you get a malware on your computer (because it will steal your passkey out of 1password)

... but your UX for new website would be dramatically simpler.

It's not much of a hassle. I'll add at least two when I want to start using a passkeys for a site. So maybe add a passkeys to the phone and to my keychain device. Then, next time I use the service on my laptop, I'll sign in with either my phone or keyring (whatever happens to be closer) and make one there. Then next time I want to use the service on my desktop I'll sign in with whatever I've got nearby and add my desktop and the token in my desk drawer. And maybe my password manager also has a passkeys, added somewhere in there.

It's not like every time I sign up for a new site I have to drop everything right at that instant and go add a passkey to every single device I own.

Those websites are unimportant enough to just use normal passwords.

> And _if_ your, say, Apple keychain is compromised, you can just revoke the passkeys from your Apple keychain from all the websites (yes it's tedious, but it's doable).

without the key?

Without a standard automatable way of doing this, it doesn't happen in practice, even assuming people implement it competently enough to allow multiple passcodes (TOTP codes, for example, are often only one per account, which is similarly annoying for maintaining a revocable backup)

> The nice thing about passkey is that unlike password, you can have multiple per account.

I would charitably estimate that of the sites currently supporting Passkey, the ones that support multiple passkeys are in the single digit percentage. So, practically, you can't.

As someone who actually uses them in a lot of places, the number of sites I know that only allows a single passkey is one: PayPal. What other sites do you know only allow a single one?

PayPal allows multiple passkeys. I just added passkeys there today and had no trouble making two.

I have a vague recollection of running into some trouble when I tried to add passkeys to an account in their sandbox (sandbox.paypal.com) but don't remember what it was. I realized I don't need any of my sandbox accounts any more and deleted them all from my password manager rather than try to solve the problems. :-)

They do now? That's good to hear. It's been probably close to a year since the last time I checked. Thanks for the update on that.

So then that really makes me wonder what all those other sites these people are using which do only allow a single passkey.

I haven't run across any single key sites.

PayPal's handling of multiple passkeys is kind of annoying. I didn't see any way to change the default labels it gives them, which appear to be simply the OS and browser names. So both of my passkeys are labeled "macOS Chrome".

Clicking on them tells when they were created but the resolution is only to the day.

If somehow my private key for one of the them leaked and I wanted to delete the public key I wouldn't know which to delete.

Some sites label the passkeys "1Password" and something like "Apple iCloud" which works a lot better.

I too first experimented with passkeys about a year ago, and then largely ignored them until this discussion prompted me to have another go.

A year ago I found them almost unusable. I had trouble getting browsers to recognize a passkey was available for a site, and I had trouble getting browsers on my Mac to use passkeys from the Apple keychain on my Mac. They would often put up a QR code for me to scan on my phone to use the passkey from the phone--and that was also not very reliable.

Now I'm hitting almost no problems.

There are still some settings annoyance with some sites. At PayPal for instance it asks for my TOTP code even when logging in with a passkey. There is no option to turn off TOTP for passkeys but leave it on for passwords.

Yeah, sites should ideally ask for a label at passkey creation with a decent autogenerated one.

Ha, tell that to Apple. Last time I logged in to their App Connect it said that passkey can only be used from iOS or MacOS device.

At one point, a streamer on Youtube asked his audience something like "Spam F's in chat [to signal that you like this thing I just did]"

Hundreds of users got banned by Youtube for spamming.

But they didn't get banned from "Youtube". They got banned from "Google". They lost access to their Gmail, and to their Android login, and every other Google service, meaning they lost their phone text verification system for every other login, and quite possibly their password manager.

Hundreds of identities were stolen and set on fire by an overly aggressive approach to spam management.

I try to remember this failure mode in planning (or being unable to plan) the security of my online presence.

Then I incorporate Elon Musk's recent behavior and recognize that while the profit motive _generally_ constrains the behavior of these firms, it's by no means assured.

For basic social welfare, either this identity stuff needs to be heavily regulated or all of these big companies need to be broken up.

I couldn't find any other source for that anecdote, but did find plenty of other reports:

Terraria on Stadia cancelled after developer's Google account gets locked https://news.ycombinator.com/item?id=26061935

Google users locked out after 15 years' use https://news.ycombinator.com/item?id=24965432

I got locked out of my Google account for a month https://news.ycombinator.com/item?id=15989146

Tell HN: Need help, locked out of Google account with 10 years of personal data https://news.ycombinator.com/item?id=42350245

Android user locked out of Google after moving cities https://news.ycombinator.com/item?id=13004369

Ask HN: I'm a small business and Google locked me out https://news.ycombinator.com/item?id=22705122

Ask HN: Locked out of Google services with no recourse or explanation https://news.ycombinator.com/item?id=17428707

ASK HN: Google account disabled. Oh what to do? https://news.ycombinator.com/item?id=350968

Ask HN: Google just kicked me out of my account, no option to verify https://news.ycombinator.com/item?id=24709282

Man locked out of Google Drive and loses 9 year old photos after SIM Swap attack https://news.ycombinator.com/item?id=41915523

Ask HN: Locked out of Google Aps email with no recourse - advice? https://news.ycombinator.com/item?id=9768593

When you get locked out of your Google account, what do you do? https://news.ycombinator.com/item?id=31070914

Going from memory, the GP comment is from a Markiplier video where he created a "game" in which you choose what path to take.

On the release stream he was asking people to "vote" which path to take, and IIRC it was by writting blue ball emoji or red ball emoji.

People were banned and he took it personally. Contacted his internal youtube contacts and all. There should be videos about him talking of it.

Yes, I think that was the incident in question, thanks.

Thanks for taking the time to create this list up, will be linking this when passkeys are brought up.

This is the exact scenario that led me to register my own domain name and email address on it.

Just remember if you ever give up your domain, whoever purchases it will now have your email as root-of-trust to EVERY site you ever created an account with.

Also, it can be pricey. If you have a .com/.org it is cheap, but I have a .io and the price keeps doubling every few years.

Also, it can be risky: and there is a very real risk that .io will be (rightly) reclaimed by the country that owns it and either seize the domains are really jack up the prices even more.

I use a .net domain that is automatically renewed via AWS and costs like $7/year.

Yeah I would suggest against using a ccTLD unless you have a strong connection to that country. Don't buy .io or .ai because they're trendy. Buy .com or .net or .dev or something else generic, or buy .co.uk if you live in the UK etc.

I have a .net which I register for 10 years at a time; and renew every 5-8 years in.

Don't you end up paying twice that way?

No? Your expiry just extends the number of years you add to the renewal.

That makes sense.

Even without malice or incompetence you will have false positives and false negatives. Then when you attempt to correct the mistake you will have false positives and false negatives again.

Should a false positive from the YouTube anti-spam algorithm accidentally temp-ban someone from commenting on YouTube for a week, or should it permanently and irrevocably destroy their online presence, possibly preventing them from logging into anything online: email, banking, government services, paying their mortgage? Because the whole problem is that we're in the universe where the latter happens.

I see now how it sounds that way but I'm not making excuses. It was to describe the puzzle without all the emotional luggage. You need a system that gets it wrong, corrects it self then gets the correction wrong with infinite recursion.

Instant judgement shooting from the hip without dialog or appeal is the dumbest way of doing things. Google isn't even trying.

> Hundreds of users got banned by Youtube for spamming.

is there a source for this? googling just brought me back here

https://9to5google.com/2019/11/09/google-account-bans-youtub...

This article provides a good summary of events.

The short of it, is that a YouTuber was Livestreaming.

He asks viewers to spam certain emojis to select what path the streamer should take.

Google's automated system detected the spam, and banned google accounts.

I’ve heard this story quite a few times but it’s always hearsay without anything concrete enough to even begin to verify. Given that one account of mine got perma-banned on YouTube (for violating the “impersonation rule” with a bunch of screen recordings set to private…) and it didn’t affect the rest of the account, I have to assume the story is fake.

https://9to5google.com/2019/11/09/google-account-bans-youtub...

It definitely was not fake. I saw plenty of uproar on the day it happened.

I remember a number of tech channels also started to post videos on how to de-google right after that.

Oh okay.

This legitimately terrifies me because it feels like a realistic eventual outcome — whether it’s via a careless automated system with no recourse or simply enshittification of an existing product due to leadership change.

I’m so entrenched in various platform ecosystems I’m not even sure how to claw my way out of it.

I solve this by creating two passkeys for each account, for iOS and Chrome. This covers all the devices I might use to log in and there’s no single point of failure.

The fact that the problem is solvable by technically savvy people doesn’t stop it from being a problem for the general user.

To add an insanely unsatisfactory solution as well.

Even passwords are better. Seriously.

Many passkey-supporting sites only support a single passkey per account.

This feels like the biggest misstep that may impede the success of passkeys to me. It's not that surprising, though, since it's pretty rare to find genuine support for multiple authentication factors of the same type already. You can usually only register one number for SMS, and/or one TOTP authenticator, etc. It seems like a lot of sites never really understood (or cared about) the benefits of MFA to the user and so can't be bothered to really understand passkeys either.

I keep hearing this but then the only example I'm given is PayPal and that AWS used to be this way. What big sites do you experience only allow a single passkey?

Yes, this definitely needs to be fixed!

Besides passkeys, some websites have alternative backup authentication, though, such as backup codes. However you do it, there should be an independent way to log in.

I use a passkey on every site that supports it (say two dozen at this point). I have never encountered this.

Which is a serious flaw in the standard.

Which?

Paypal is one I've encountered.

Paypal, as far as I can tell, doesn't even (intentionally) support passkeys. They refer to all WebAuthN credentials as "security keys" and remind me to "plug it in and touch it now" etc.

I'm honestly already glad that they didn't make their annoying browser fingerprinting rigorous enough to also block authentications and aren't requiring attestation.

Even google account's MFA allows back up codes, at least in the Enterprise accounts.

I get that this this is a way to do it in practical terms, but isn't that just like having to have two passwords for each site (outside the fact that passkeys are a bit more secure than passwords)? I thought one of the main points of passkeys was to reduce admin.

If you can do that, you also have enough tech savyness to use passwords securely.

The security of passwords doesn't just depend on users though.

https://haveibeenpwned.com/PwnedWebsites

2FA does not protect against a website getting hacked.

The problem that passkeys solve is not that of their user. It is that of the website that authenticates its users. With mere passwords, there is no way they can be sure that the user follows the required password hygiene. With passkeys, there is no way a user could set up something insecure.

Are we taling savvy users or regular users?

Regular users would not set up double passkeys, and would suffer vendor lock. They would be better off with password manager instead.

Savvy users know how to follow password hygiene, and have no need to have it enforced on them. So they don't need passkeys either, they would be better of with good password manager.

Exactly what I am saying. Users don't need passkeys. Auditors and other guys from the checkbox compliance department on the opposite side do, for "security posture".

That doesn't solve anything. You just have twice as many problems now.

What are you talking about? Redundancy is how you avoid getting locked out. Each passkey serves as a backup for the other one.

More generally, you should have two keys for any lock, so you can still get in if you lose one of them.

Setting up both Apple and Google passkeys solves:

* Lost access to your Google account, but still have access to your Apple account (or vice-versa)

* Apple device doesn't support Google passkeys, or vice-versa

But it multiplies the following downsides:

* Apple/Google account gets hacked, hacker gets all your 2FA credentials

* Snooping on your activity. Particularly Google, but Apple also have an advertising business.

* Setting up accounts on new sites is twice the hassle.

* Too complicated for the kind of folks who need the phishing protection passkeys provide.

> I solve this by creating two passkeys for each account, for iOS and Chrome. This covers all the devices I might use to log in and there’s no single point of failure.

This just seems to mean that, instead of being the whim of one corporation from being locked out of all your accounts, you're the whim of two corporations away. That's better, but I'd hardly call it solved.

“Google says no” is a threat model I’m concerned about, but it doesn’t seem particularly likely, so I’ll pick another passkey manager if it happens.

(If it ever happened, Gmail and Google Photos would be a bigger loss.)

Does that mean you're locked into iOS and Chrome?

congrats. your problem is solved in the two or three places that actually allows or even implements any logic from N passkeys. on most places that will just give you a new account or wipe the first key.

Really? Which place allows passkey login and only allows one key per account?

Using 1Password as your passkey backend seems like it would solve all the problems you're describing, except that passkeys are (for the time being, at least) locked in to 1Password [1]. It works on multiple OSes (as a native passkey backend on iOS, via browser extensions providing WebAuthN on all major OSes) and isn't tied to your Apple ID.

If you care a lot about exportable passkeys, Bitwarden (and Vaultwarden) can export them. Not sure if any other implementation can import them at the moment, but the data looks portable enough (i.e. it contains the ECDSA private key and all other client properties required).

[1] https://support.1password.com/save-use-passkeys/ mentions that "Passkeys saved in 1Password can’t be exported at this time."

1P will support it in a standards-compliant way soon: https://blog.1password.com/fido-alliance-import-export-passk...

KeePassXC also supports export but not yet using the aforementioned standard: https://github.com/keepassxreboot/keepassxc/issues/11363

> 1P will support it in a standards-compliant way soon: https://blog.1password.com/fido-alliance-import-export-passk...

See then believe, in the current environment saying "soon" based on 1password submitting a draft is much too optimistic, given the big interests Google and Apple have in neutering this possibility.

I’m not saying I’m against 1pass adding the ability to export passkeys from 1Pass, however, doesn’t this increase the possibility of your computer is compromised (say remote control) and now your passkey is exported / moved to a new device and hacker auths in via that new device? (versus with a hardware passkey which cant be exported electronically)

Same, I use bitwarden and it keeps all my passkeys in it and is available on all my devices.

>In some parallel universe, each computing device manufacturer is required by law to provide a storage so that the user can plug in their single, universal, transferrable set of security credentials (like passkeys). Instead of "many cooks" mentioned in the article, there is one standard.

Ignoring site support, this exists. It's called USB and yubikey.

Having a big dongle sticking out of your iPhones lighning port is completely impractical, compared to using the integrated TPM backed storage, unlocked by face-id. Yes there are smaller dongles but only for usb-c and i still don't want to fiddle with it when charging.

It's only a matter of time before desktops gain the same secure key storage as our phones do, add a hardware key to prove physical presence and then yubikeys are obsolete. The only future for yubikeys is for temporary transfer of keys under wrap between devices, where you don't want to use a cloud service for doing so.

While an open api with replaceable internals is a nice idea and one that enabled yubikeys in the first place, once this is integrated in the SoC and the OS, there will be little need for alternative storage backends. What's more pressing now is pluggable synchronization of secrets, for those who don't want their choice of cloud provider to be bound to their choice of OS, or for those who rather synchronize entirely offline through a yubikey.

Was called a SIM card before that.

Both are smartcards. Yubikeys also happen to support the USB HID CTAP protocol, which is something unprivileged applications can usually talk to directly on most operating systems. Most other CTAP transports are just smartcard transports (APDUs over PC/SC or NFC). Yubikeys also have a PIV applet, which isn't used for your typical enterprise X.509 PKI, and an OpenPGP applet, which typically isn't used.

PIV, GnuPG, or PKCS#15 are probably better comparisons. SIM cards use symmetric cryptography, which means you can only authenticate yourself to a single entity.

> this exists. It's called USB and yubikey

An extra physical device is a non-starter for mass adoption.

”But even with Apple, I can't sync stuff between my personal and work computer because they use different Apple IDs, even though the underlying true identity (me) is the same.”

Apple has recently addressed this. You can now create shared groups, and selectively assign passwords and passkeys to the groups. You could easily create a group with your two identities and move the credentials to that group.

https://support.apple.com/guide/iphone/share-passwords-iphe6...

Beware of the hidden catch here. The account that adds the credential to the group “owns” it. So if that account goes away for any reason so does the credential.

>But even with Apple, I can't sync stuff between my personal and work computer because they use different Apple IDs

You can't save your personal passkeys on your work phone and vice versa, but when logging in to a service on one device, you should be able use a passkey from the other device via Bluetooth by scanning a QR code.

An added challenge: Yubikey NFC doesn't work on iPad, only iPhone. USB operation also seems fraught. This has been so for 7+ years now. If Apple cannot get this to work with a closed ecosystem and the leading vendor, I think the technology is just not ready for mainstream.

Apple is actually doing a lot of work (largely) in the background with every OS update.

I was recently pleasantly surprised to be able to use my smartcard form factor FIDO authenticator on macOS using a CCID USB smartcard reader. Not exactly ergonomic on a laptop, but totally viable on a desktop or docking station setup with a permanently plugged in reader. Sometimes I really do miss that contactless card reader option that some Thinkpads offered...

Yubikeys work on iPad and iPhone via USB perfectly fine now. I do it quite often.

Woah, you are correct. My YubiKey 5C now works with my iPad M4! When did they fix that??

Edit: Looks like it was iPadOS 18.2 released on December 11th.

I think they added better hardware key support at an OS level a little over two years ago. They needed all the web authn stuff for passkeys anyways, so I bet it was a necessity prerequisite.

I just got the new M4 iPad like two months ago, and my YubiKeys absolutely did not work, no matter what I tried. There are articles on apple.com and yubikey.com that explain that USB-C YubiKeys will not work with USB-C iPads because Apple's USB-C implementation isn't sending the timing info (or something like that) that the YubiKey needs to function. People were buying Lightening YubiKey and connecting them to Apple's Lightening to USB-C "camera adapter" to work around this.

I decided to double-check my YubiKeys before I responded to your post and (!!!) they work now! This is huge!

Good to know, thanks! But I might not have the other device on me at all times.

FIDO keys are tiny e.g. yubikey 5c

If anything, this achieves the opposite of making sure I always have mine on me.

Dedicated, external hardware authenticators are great for logging in to very high value accounts or password managers, but arguably they're not really viable for 99% of users and use cases on a day-to-day basis.

I don't agree at all. It's on my keychain, next to my keys, a nice symmetry. When I need to login I hold it to the back of my phone for half a second. It's incredibly easy and would be even easier if it weren't for the UX presented by iOS, Android, and Windows where they try to be the provider. Android has gotten a bit better. Windows is the worst about it afaict.

Different people, different preferences.

I don't like having to fetch my keys when I'm at home at all, which is where I do most of my authentications. I'd have to get up, walk to where I usually keep them, walk to my computer with them to authenticate, and then either walk back or forget the keys somewhere in the house and have to search for them when leaving (or detach the authenticator from the keychain and then not have it on me when I'm leaving).

That's why I don't like using USB authenticators on a regular basis.

It’s recommended to have at least two anyway, to still have access to your accounts in case one is lost. That means you can keep one key at your desktop and you’d only need to go up to get your keys when adding them to an account.

Having two in the same house is a pretty bad compromise. Ideally you'll want one of them to be physically somewhat distant (in case of a fire etc.), which makes things even less ergonomic.

I think that we should consider passing a law that a vendor may non disable “log in with” and supporting functionality like password recovery, for a user account for some lengthy period of time after involuntary termination of the user.

But I think that the bigger issue is that I don’t think that large corporations should be allowed to disassociate with their users except in the case where criminal activity against that company is involved. This is especially important now that all the vendors want ecosystem lock-in AND have ToS that allow them to cancel pretty much arbitrarily.

Agreed, and some kind of appeals process/ external arbitrator, if your account is terminated due to terms of service or automation.

Pretty sure 1password can store and use passkeys.

It does, but 1password forces you to use the browser extension in order to manage passkeys.

I still don't trust browser extensions. I'm probably being irrational, but it is hard to find good sec info on how "safe" extensions really are.

If you're copy-pasting passwords from 1password into your browser you're making yourself vulnerable to phishing. The browser extension's autofill will at least check the domain name and prevent that.

Somewhat. Lots of sites log you in via a different domain.

That’s the domain you’d have saved, then. You can also save multiple domains on a credential.

I know about the issue and still experience it. Sometimes these things also change over time. Of course, it still helps to use the browser extension!

That does get me every now and then. “Why has this stopped autofilling…”

It certainly can.

until the time comes that it's used for spammers and everyone requires providers from a list that only included apple and Google.

y'all trying very hard to not see where this will go.

This would be possible via attestation, but both Apple and Google removed that feature when they replaced their respective device-bound authenticator implementations with cloud-synchronizing ones. (Google technically still allows creating device-bound ones and supports attestation in that case, but that's arguably a niche use case and not what people are talking about when they say "passkeys".)

> I already have a universal solution for credentials: 1password, which is cross-platform.

You can store passkeys in 1password so they work everywhere.

The article is 80% about friction and confusion in trying that solution - from confusing prompts and endless questions designed to wrestle control over to local ecosystem, to use cases that just don't work with external vendor as opposed to native platform owner :-(

Which use cases don't work with external implementations, but do with the first-party one? I have yet to encounter one on iOS and macOS.

https://github.com/keepassxreboot/keepassxc/issues/10374 Passkeys not working on certain sites

I suspect 1password also has at least a few sites that need special handling

But 1password forces you to install the browser extension to do this.

Honest question, this isn't supposed to be a burn in any sense. But isn't it contradictory to want to know how and where your credentials are stored and use any credential management solution that isn't opensource and selfhosteable?

Fair enough, but I believe there is a spectrum between "I don't want to know things, let them just work" and "self-host and manage an application for storing the most sensitive type of information".

1Password is neither opensource nor self-hostable, and it stores data in the proprietary cloud (at least exports are easy). But I understand that and accept it.

If I get a Macbook, an Android phone, and a Windows PC (a very popular combination of devices, btw), I honestly don't have energy to investigate how to inter-operate their passkey solutions. From the get go, I assume it's gonna be either impossible, or very hacky and fragile. Maybe I'm wrong, but last time I checked I simply walked away thinking "nope, no passkeys for me".

1Password itself has native passkey support. I don't have experience with it on mobile, but on desktop browsers their extension overrides the build-in passkey support to use/store passkeys from/in 1Password (with a button to fall back to the built-in implementation for its storage, hardware tokens, QR code to use/store a passkey from/on a smartphone, etc).

Looks like on iOS it integrates with the native passkey support (so is usable anywhere native passkeys are supported). 1Password on Android looks to have similar integration, but only for apps at this stage (not websites, due to an Android limitation). So still a little while to go yet for "it just works" across all platforms.

> With Apple's keychain, and I suspect other companies' solutions, passkeys are connected to your account and at best synced between devices from the same manufacturer.

iCloud Keychain/Passwords works on macOS and Windows, and there are extensions for Chrome and Edge. I don't know whether it works with passkeys though.

> But even with Apple, I can't sync stuff between my personal and work computer because they use different Apple IDs, even though the underlying true identity (me) is the same.

As I understand it, Apple's BYOD support allows you to have a managed/corporate Apple ID and a personal Apple ID on the same device. You can also add a managed Apple ID to a personal device like an iPhone; on iOS (and possibly macOS?) it isolates the data between them so that corporate apps can't access personal data and vice-versa.

I believe it's possible to have multiple accounts with separate Apple IDs, and I think it is possible to add "secondary" Apple IDs to a single account, but I don't have experience with this.

I don’t know about 1password, but proton pass supports passkeys, on both iOS, Safari & Chrome (and probably others).

I use proton pass and have the same issues as the author. Whenever macos/ios is in the mood it lets me use it to store passkeys, else it is an endless maze of bugs and confusion. Proton pass supports passkeys but the OS does not always let it communicate with the website.

Any chance that this is actually due to websites requesting weird WebAuthN credential parameters (e.g. enforcing attestation, which software implementations by definition will not be able to support) or using the legacy U2F API? In my experience that's usually the culprit.

No idea. I do not have the technical knowledge neither the time to check sth like that. I am totally clueless even as to where and how exactly passkeys are stored in my computer. For me they just work until they don’t. It does not really help in trusting them as password replacement.

I moved away from 1P some time ago due to their move to a subscription model. After trying other solutions and having high hopes for Apple finally shipping a passwords app I finally decided to move back this year.

It's costly but excellent. I have several accounts shared with my wife and was getting caught up in the passkey problems you mentioned. Even though 1P handling OTP is not really 2FA it's very convenient and still more secure than no OTP. I also don't always want to have to have my phone on me.

On top of that I like knowing that if I change my mind at some point I can export my credentials. Moving my iCloud keychain creds was an eye-opener: it felt purposefully painful. You can do it but much of the metadata is missing or lost in the process, with the titles being the URLs. Yuck.

Switching from 1p to icloud makes sense, but there's a decent chunk that isnt in the apple ecosystem. I'm keeping 1p for now, I'd even argue that the price is pretty good, especially for families.

To be clear I never used iCloud/keychain exclusively, but my wife did and I performed the migration from that to 1P.

I prefer to pay for something as important as a password manager. It's like some people get excited about all-you-can-eat sushi: sorry, but raw fish isn't something I want to go super-cheap with.

Have you tried bitwarden?

Yep that's mainly what I used. I trust it and it has a good feature set but the UX is just not up to snuff imo. I could get by with it but no way was I going to roll it out to my less techy family members.

1P is just much easier to use and more polished.

I've heard others say similar things.

Bitwarden was a big UX upgrade for me coming from keepass.

I haven't tried 1P. What do you prefer about?

> I cannot bring myself to agree to any "switch to passkey" prompt from any device because I have no idea (and too tired to figure out) how and where that key will be stored, how do I deal with different devices, etc.

There is a draft standard in the works for export/import:

* https://fidoalliance.org/specifications-credential-exchange-...

> But even with Apple, I can't sync stuff between my personal and work computer because they use different Apple IDs, even though the underlying true identity (me) is the same.

By design. This is what caused the ZenDesk, Atlassian, Disney and Sony hacks.

> their single, universal, transferrable set of security credentials (like passkeys)

That's an awful idea. Normal people already have a nightmare of a time with getting locked out of accounts, and now you want their entire lives to depend on a single hardware fob that can get lost?

Passkeys are the ideal identity management solution for spherical users in a vacuum

That was called "U2F", but we made it "better" with PassKeys!

> is required by law to provide a storage so that the user can plug in their single, universal, transferrable set of security credentials (like passkeys)

Wow, that will immediately become a prime target for hackers / phishers.

So?

Then we're getting to a point where the proposed law weakens passkeys to the point where they are much ado about nothing.

Like this

https://www.congress.gov/bill/118th-congress/senate-bill/884...

each computing device manufacturer is required by law to provide a storage so that the user can plug in their single, universal, transferrable set of security credentials (like passkeys)

Indeed and that law would provide overrides for the state. And which state, you might ask? All of them? The state where the device is manufactured? Hmm...

Reply on news.ycombinator.com