Hacker News Reader

Comment by FuriouslyAdrift | Hacker News Reader

A fingerprint locked NFC Yubikey seems to be the preferred with all ages at work. Everyone likes it as long as it is once per login to the computer (which basically means we have to use Edge for everything which is fine).

Everyone universally hates passkeys because they never work right.

View on HN

It sounds like you're talking about passkeys though? (FIDO2) Or are you using PIV on all of those keys?

Fido2

Except for those whose fingerprints don't work (climbing wears away fingerprints). I have even heard of people struggling to renew their passports because of difficulties getting their fingerprints read.

Many manual jobs wear away fingerprints. I renewed my ID card after renovating my home and the fingerprint reader could not read anything meaningful. They told me that sometimes the state accepts those messy fingerprints anyway and yes, the request got approved. There is some jumbled fingerprint on my record now.

I would much prefer to have a pin on the yubikey itself with little keys or something but since that isn’t an option, fingerprint it is.

You can set a yubikey to require a pin entered on the host.

It’s a shitty user experience though, as loads of websites turn into “username+password+yubikey+pin+key button press”

Yep... which is why we use the biometrics one. End users refused to use the app as it was a pain.

> Everyone universally hates passkeys because they never work right.

I’m considering a passkey deployment. What sort of issues did you encounter?

Tied to the browser and did not travel with the user across devices and apps. It's that way by design.

An authenticator device is agnostic, transportable and can be backed up (or a secondary added)... sometimes. Implementations can suck (looking at you, my bank that only allows one key)

whisper that Yubikey is holding the passkey data ;)

I still don't know what a passkey is, but since Microsoft pushes for it, I assume I'll probably hate it

Everybody is pushing for it, Microsoft is just being dragged along.

I’m referring to the browser based ‘passkey’ everyone is pushing right now

Reply on news.ycombinator.com