Hacker News Reader

Comment by DougN7 | Hacker News Reader

It sounds good, unless granny needs to visit Google or Microsoft to get a new password after losing her phone. Then what??

View on HN

The scary part is not about losing her phone. It's about having to keep the old, no-longer-secure Android phone alive just for passkeys after getting a shiny (and secure) new iPhone.

You can add the new phone as an additional passkey. I don't see how this would be scary.

I have 531 logins for varied websites and services. Would you enjoy having to change 531 passkey devices? Me neither. But default login flows in all these sites prompt you to use your current device as passkey by default, so people who don't know better (i.e. a general "everybody") are being gently pushed to do so.

No, which is why there is the cross platform standard CXF which allows for cross platform sharing of passkeys. Apple has announced that support for this is shipping later this year with iOS 26. Google hasn't announced when they are shipping it yet.

So until then you have to do what parent said? Change each one individually when you switch devices? Thanks but no.

I keep all my Passkeys in Bitwarden, it works fine across different devices and I use all major platforms regularly (iOS, Android, Windows, MacOS, ChromeOS). As a backup I've also added some extra duplicate Passkeys in the Chrome and iCloud password manager for the most important accounts in case I lose access to Bitwarden somehow.

Would’ve been nice if the basic UX would have been figured out before passkeys were shoved down everyone’s throats

It just wasn't an important consideration, unlike the attestation anti-feature.

AFAIK, there is no requirement for websites to support multiple passkeys nor, if they do, to support them in a sensible way. Some sites do this well, most don't.

The problem here is really with Google and Microsoft than anything else. It's not like this problem doesn't occur already for other reasons.

She follows same reset flow as before. Passkeys are identical in this respect to the passwords of yore.

Then that's worse, it's now two authentication flows to remember. It's only made the situation more complicated.

If granny forgets her password, she looks it up on the last page of her notebook where it is written down. Granny cannot write down her passkey.

To avoid getting locked out you could add 2-3 passkeys from different providers to each account. And/or use a passkey provider that allows backups, and back up your keys. But I doubt many people will have the discipline to do either of that.

Honest question: isn't that introducing some weaknesses, allowing the attacker to either reactivate password auth or add it's own passkey eh by tricking the user in accepting that change after receiving a mail with a link to accept that change? That would make the passkey unbreakable, but leave other easier to exploit weaknesses.

No. You always need that flow.

The problem with passkeys is they’re very unfamiliar and it’s easier therefore for less experienced users to get confused or tricked.

Passkeys are more like 2FA, and many services disable password resets without 2FA if it's enabled.

Do you have any examples of such services? How do they handle the lost phone case? Tell people to go pound stand?

Reply on news.ycombinator.com