Hacker News Reader

Comment by growse | Hacker News Reader

> I don't think it's the responsibility of the author to make any constructive input to the passkey problem.

Oh, it's not their responsibility, sure. But moaning about the UX without considering the trade-offs and decisions that got us to this point isn't very useful. Passkeys are badly implemented on some sites. So let's fix that.

> This makes passkeys essentially the same as passwords.

Passkeys in a password manager are fundamentally different to passwords. Try copying the passkey private key into your clipboard from your password manager.

> Passkeys as encouraged by the big companies are all about vendor lock-in than security.

The fact they prevent phishing is just a useful side-effect? This is veering into conspiracy theory territory.

View on HN

It's not just some sites, the article goes into more detail than this, for example the biggest sticking point to me mentioned in the article is vendor and device lock-in. This is a recipe for getting locked out of your accounts and is far from a conspiracy theory. The only answer to this is create multiple passkeys on multiple devices/services OR use a password manager.

This is hardly the frictionless experience promised by passkeys. And it's perfectly valid to point this out. I don't care about the decisions and trade offs that got us to this point and not should I have to. If you want me to use a shitshow you designed the onus is on you to fix it, not me as the person you're attempting to force it onto.

> Passkeys are badly implemented on some sites. So let's fix that.

It's not the obligation of the Ars writer to fix that. It is their obligation to give the system a solid try and report honestly about what did and did not work.

> Try copying the passkey private key into your clipboard from your password manager.

Yeah, something that's roughly equivalent to that is coming. Used to be that you were not permitted to export key material. Now you can. This will erode further as real-world use continues.

Oh, wait. It looks like secured-only-by-a-password access to passkey private key material is already possible, today:

"Q: Are stored passkeys included in Bitwarden imports and exports?"

"A: Passkeys are included in .json exports from Bitwarden. The ability to transfer your passkeys to or from another passkey provider is planned for a future release."

Quotes are via the "Passkey Management FAQ" section of this page: <https://bitwarden.com/help/storing-passkeys/>

Reply on news.ycombinator.com