Hacker News Reader

Comment by msgodel | Hacker News Reader

>I think people on HN overestimate the security literacy of the average computer user in a personal/corporate setting.

Sure. Provide an escape hatch for the technically literate and let us use our ssh-agent then.

Here's your escape hatch: https://bitwarden.com/help/export-your-data/

Bitwarden even now supports passkeys on mobile browsers and apps. As a happy user for over 5 years it's been great being able to configure something less theatrical than push/codes without needing to plug in my YubiKey every time.

Sadly, right now, bitwarden is the only provider that will dump your passkeys into a JSON. No one else offers it, and there is no functionality from any provider to import and adopt the JSON that bitwarden exports.

Passwords have their faults, but they do have a zero-technology backup option that your heirs can execute. (A printed dump of the password vault in a locked fire safe.)

I'm surprised that especially financial service providers don't have a very clear "in the event of death/emergency" flow. I know you can sometimes label an account payable-on-death/joint-ownership/trust/other weird tax-dodge shaped things, but that doesn't solve the technical problem of "how do I log in and initiate my claim when Grandpa kicks the bucket."

I prepared the fire-safe paper, but I can imagine my family getting stuck at the institutions who demand 2FA and probably won't have access to my phone or email at the time.

The whole point is that you aren't supposed to be able to login and continue business as usual. You need to call or write to the financial institution and provide proper legal documentation (death certificate) before you can assume control of the account.

This is a GOOD thing.

That's fine for financial accounts, but people have hundreds of accounts, and you don't know which ones are the ones that matter beforehand. Is it your family member's AO3 stories that you want? Or maybe the login to the web forum that was their primary social outlet in old age? This assumes that those non-financial sites even have a process to let you in.

KeepassXC also has the option to export passkeys

Happy user of Bitwarden and use their passkey support when I can. But generally I've been underwhelmed with the passkey UX, likely no fault of Bitwarden or similar. With extensions installed, Android configured to use Bitwarden for passkeys, etc, it feels like a 10% chance or so Bitwarden will be checked for a passkey and otherwise it's randomly either the browser or phone. Without being able to reliably read a passkey, I always need to set up password + OTP as a backup. While there's some benefit to passkeys when available, having to set up multiple auths anyways just makes it feel like too much of a hassle...

And how long until the attestation feature is used to ban their implementation? The threats have already been made to keepass.

Reply on news.ycombinator.com