Magic Links Have Rough Edges, but Passkeys Can Smooth Them Over

> On this blog I speak only for myself as someone experienced in usable security and website authentication.

This caveat near the top speaks to my point, if you're a developer and you understand what an SSH key is, you'll take to Passkeys no problem. But if you aren't, there are many foot guns abound and vendor lock-in you won't notice until it bites you.

I work for an auth company, I use a Yubikey and Passkeys all the time, in a business context where there is an IT admin to go to when there is a problem, I think Passkeys will do great. They'll really improve the average security posture of an organization.

But I would dread having to try and recover a Passkey with Google, who would I even talk to? I just had to explain what a VPN was to my parents, I would not be excited to try and explain to them how Passkeys work.

And b) I don't understand them. If I don't understand them what chance does the average non-nerd have? I probably could understand them, if I bothered to look into the details of how they work, but I really don't want to have to do that and normal people won't either. Nobody needs to do research to understand passwords or email login links (at least at a basic level).

I predict they will be abandoned in 10 years.

I wonder if a better solution is just to accept email-is-authority and make the magic link flow more seamless. Imagine if you could link your email client and your web browser closely together so that every site that offered a magic link "just worked". You click a button, it emails you, your email client silently notifies the web browser and deletes the email, and then you get logged in.

Google could easily do that automatically with Gmail and Chrome. The only downside I can see is that email is still a bit slower than password authentication.

Another company I wanted to give lots of money too was fal.ai, but you can only login through github, which I didn't want to do. I even emailed them asking about alternatives but they couldn't even bother to reply. So my money was spent else where.

I don't have my email login on my computer so for every tragic link I get that means I would either have to find a way to get the link from my phone to the computer or login to my email from the computer just to click that stupid link.

You know what faster, more efficient and better in every way? Using an user and password.

I should not have to suffer because some nitwits can't remember their passwords, we should not subsidize mediocrity because we will get more mediocrity.

Thank you for reading my rant.

Now that Passkeys are a thing they are much more viable as a primary authentication method since you can lose your phone or switch PCs and still have access to them. But as long as you're allowing pass(word|key) reset using email anyway, it certainly doesn't hurt to have magic links as an option.

First off, nearly two full years into this “standard” existing only around 1/5 to 1/4 of my accounts support it. And the support is a crap shoot. I am finding some accounts only allowing you to have a single passkey and others such as Amazon expect a certain format making Keepass unusable. I save the key but I guess the response is wrong as Amazon thinks it failed.

ssh keys are great. Amazing. Having those instead of passwords would be a huge upgrade. Most people need a simple key management ui and portable keys then they would be set. But it’s like Password managers and sites that don’t allow copy and paste all over again.

That's the biggest mistake that passkey advocates make: assuming that if you've used passkeys, you know what passkeys are. Or that you can watch a short video explanation describing the benefits of passkeys, and then you "know what a passkey is."

Here's what a passkey is:

Passkeys are randomly generated passwords that are required to be managed by a password manager. All the major password managers support them, including Apple, Google, Microsoft, Mozilla, and 1Password.

Passkeys can be public/private keypairs, or they can just be secret passwords. Webauthn is designed by committee, so there's always more than one way to do it.

By requiring the passkey to be managed by a password manager, you get some anti-phishing protection. A passkey includes metadata, including the website domain that created it, and the password managers simply won't provide the passkey to the wrong domain. They provide no way for you to copy and paste the passkey into a website, as you can with a password; there's no social-engineering technique someone can use to get you to copy and paste your passkey to an enemy.

A passkey manager is morally required to do an extra factor of authentication (e.g. fingerprint, Face ID, hardware keys, etc.) when you login to a website, but the website has no way of knowing/proving whether that happened; they just get the password.

You reset your passkey the same way you reset your password, because passkeys are just passwords that have to be managed with a password manager. Some sites make it easy to reset your password, some make it hard. You know the drill; there's nothing new or different there.

If your site/app is comfortable with magic links, or a simple "forgot my password" email, then it would also make sense to let users add a passkey by clicking a link in an email.

If your site/app doesn't have a "forgot my password" flow, you don't need one for passkeys, either. (But, surely you have something in place…? Even Yubikeys/SSH/PGP private keys can be lost.)

If you're happy with your password manager, there's no real need to switch, but even very "sophisticated" password users have been known to fall prey to social-engineered phishing attacks.

Are you sure you're never going to copy-and-paste your password into the wrong hands? I don't trust myself that much.

Passkeys make it harder to switch password managers because the password managers are designed not to let you copy-and-paste a passkey, including from Google's Password Manager to Apple's Password Manager. I think all the password managers kinda like that lock in, and there's something good and bad about it.

Instead, password managers recommend that sites/apps allow each user to have multiple passkeys. Sites/apps may or may not actually allow that, but that's the only way to be sure a given user can login with both Google's password manager and Apple's password manager: give each password manager its own passkey for each site.

I think Ricky is completely right in this case that if you're a site like 404 Media using magic links today, passkeys are just better. As a user, if your passkey doesn't work or gets lost, you can just click "forgot my passkey" and get another magic link, and set up a new passkey.

I only use them on sites or services I do not take seriously or would never rely on for anything.

Not wanting a password doesn't absolve the software of securing user data, or users being informed of them effecting relaxing the need for security around their data.

For so many reasons that become apparent until years later, creating accounts with email+password is the best, on your own domain that can be moved between hosts, especially since there is little recourse with any identity providers.

But almost all B2B services are high value

So why try and provide one size fits all. Because B2C behemoths want to climb the pole

Look, provide everyone with a HSM, and every web requests made gets signed with said HSM. And if you lose HSM walk into the office and get a new one.

If your service is not worth that effort, really I think we can work with passwords and OTP.

There is no way that older people will ever understand passkeys. Corporations should immediately stop this foolish push to passkeys where often absolutely no explanation is made to the user of what they are or why anyone should care. My parents are sticking with unique 20-character passwords per site.

Don't even get me started on trying to explain mobile app 2FA to them...

* Prompt for username & password in such a way that the browser's username&password-saving doesn't recognize. (I suspect the site is usually leaning on separate form field autocomplete to get an email address or other username.)

* Enter username in one DOM, submit, wait, and then they load a new page or change the DOM, to prompt for password.

* Burying/obscuring the username&password option, in favor of an array of buttons to log in from various big tech companies own authentication (or misused authorization), log in via email or SMS link, etc.

* Mandatory email/SMS 2FA, even for innocuous sites.

* Slow 2FA. Sit around waiting for it, pressing the mail-check button repeatedly, like I'm a type-A person (trying to close the elevator door before someone across the lobby gets close enough we have to wait).

* Then the 2FA email often has a bunch of worthless filler around it, so that I can't just glance at it in the small tiled window in the corner of my screen, but have to switch to the email program in a large tile, memorize or copy&paste it, and then switch back to the browser window. Which then often upsets the form field validation, or even loses the keyboard input focus it had before, just for that extra little negative UX touch.

* I kid you not, one company's gratuitous mandatory 2FA emails the other day consistently had some invisible unicode character next to the number, which invisible character was picked up in the double-click copy&paste, sent through the form submission, and then they rejected the string as invalid 2FA.

* The credit card company that insists on SMS 2FA (when I'm on desktop), and then sends an 8-digit code to my rather than a 6-digit like most other companies. Just in SMS, which is at a font size for text chats, not for perfectly transcribing numbers that are 8 digits without even separators like everyone else has used for most purposes forever.

* All the companies that have recently started emailing me every time I "sign in on a new computer", from the same IP address and browser fingerprint as usual. This is starting to become the norm, and it's not only annoying, but it also presumably desensitizes a lot of people to legitimate emails about security. (If anyone ever logs into one of my accounts, I'd probably never know, amidst the the piles of irresponsible false alarm alerts about this.) (This is another bad practice by people seemingly trying to 'do security' like the one where banks would email you from address domains other than their own, at the same time that they're emailing you to watch out for phishing, like it's your moral failing.)

* Some organizations are doing password expiration, on newly-developed sites.

* Somewhat hiding the login button/link for existing accounts, but there's a big bright button for creating a new account. (Actually, this is a long-time practice by a number of sites, not recent, but some sites still doing it.)

In most cases, I don't think it's dark patterns, to discourage people from logging out or clearing cookies, nor to make the more receptive to coming passkeys or to whatever side incentives (besides some users' preferences) the company might have for doing log-in-with-other-company.

I think it's probably a bunch of developers just integrating off-the-shelf frameworks, sometimes spending a lot of effort to try to understand the off-the-shelf thing's particular proprietary bureaucracy, with little time left for the UX, security, or anything else. And maybe mix in some enthusiastic sprint tasks to add in other ways of logging in, incidentally making the original way worse, since the original way is not within scope of the task. And, in some cases, it might be a bad compliance checklist, or bad interpretation of one.