Hacker News Reader

Comment by secabeen | Hacker News Reader

The "Vendors Can Lock You Out" part is what makes passkeys entirely a non-starter for me. Especially the additional risk when someone passes away and the heirs are trying to get access to the deceased's accounts. Vendors are well known for saying "we had an agreement with Samantha, and with her death, that agreement has terminated, and no one can be given access that was not pre-designated."

View on HN

That linked story is pretty horrifying too: https://hey.paris/posts/appleid/

If he can't get his account back in any reasonable amount of time what chance do I have?

(I see I missed a big HN discussion on this: https://news.ycombinator.com/item?id=46252114 - 1038 comments)

> "we had an agreement with Samantha, and with her death, that agreement has terminated, and no one can be given access that was not pre-designated."

It would be nice if you could use some legal apparatus to ratchet these agreements into a trust. Corps would hate it though, so it will probably be illegal to do.

It’s “illegal” in the sense that you could write whatever you want in your will but it wouldn’t be binding. You cannot force a party into a legal obligation they do not agree to.

The government can, though. I’m not sure if there’s any existing laws pertaining to transfer of or access to general accounts after death (as opposed to bank accounts which I’m pretty sure there are laws about).

My will says that my executor can access my accounts which alleviates Apple from legal risk if they do grant access but I’m pretty sure they are not obligated to do so.

This reminds me of some past political debates around same-sex marriage, where I encountered some folks claiming government-involvement wasn't really necessary because Free Contract could take care of everything. (This was some years back before the US Libertarian party imploded.)

It was rather frustrating to watch: "You're a huge fan of X but don't know how X works?"

For example, two people can't make a contract between them that gives one the right to visit the other in a hospital, nor the right to make medical-care/power-of-attorney decisions. You also can't contract-away the guardianship (or ownership) of children, etc.

I thought the Libertarian claim was that lawsuits would fix everything. Because after your house burns down and kills you due to no electrical codes being enforced, your family can sue the electrician (who might also be dead due to unrelated reasons) and convince a jury that they didn’t follow undefined best practices and be awarded millions of dollars that the electrician probably never had and certainly won’t pay and that’s better than having you alive anyway. Hooray for the free market.

In the United Stages, RUFADAA provides this legal framework and I think it's quite reasonable.

I wrote about it here: https://digitalseams.com/blog/what-happens-to-your-online-ac...

Some password managers provide an offline root of trust which family members can use in this scenario. For example, 1Password tells users to print off an "Emergency Kit" which is a physical piece of paper with secret recovery codes printed on it, which they store in one or more safe places. [1]

If someone passes away, their family members can use the Emergency Kit to gain access to and use all their credentials - including their passkeys.

(The Emergency Kit also allows you to recover your data in the event that you forget your master passphrase or lose all your devices.)

[1] https://support.1password.com/emergency-kit/

There's nothing different about using a password vs. a passkey that makes it easier or harder for vendors to lock you out. I am not sure where this misconception comes from.

Whatever process a vendor requires someone to go through in order to gain access to someone's account when they pass away remains the same whether the user previously used a password or a passkey to login.

Are you aware of any vendor that actually does have differing policies based on the account's login credential type? I'm not aware of any.

Without passkeys:

The only one who can lock me out of my relationship with e.g. HN is HN.

With passkeys:

Now I can be locked out by HN or by the passkey provider.

Sure I could use a local passkey provider, but the protocol provides a way for the site to enforce a whitelist of passkey providers, so it's not clear that would be an option. Particularly for businesses like banks which tend to adopt an approach of "if a security restriction is possible, it should be applied". Or even just the typical tech PM perspective of "we want to include logos for the log in with X, and I think more than 5 logos is ugly so let's just whitelist Lastpass, 1password, Google, Microsoft and apple and be done with it"

If I want to move a password, I either already have it memorized or I find it in my manager and write it down.

If I want to move a passkey out of my Apple keychain, last I heard the answer is to just make a new passkey. The important part of the secret is 100% under their control. It makes me very squeamish

I hate passkeys because when I've encountered them it's always an interstitial between what I just signed in to and where I'm trying to go, it's always a "register a passkey now" with an obfuscated dark pattern bypass, and it's always on a corporate account that I don't need a fucking passkey for.

I don't want a passkey on my logins but there is no way to disable this prompt on the 3 websites that constantly annoy me for them.

Drives me batty. The company I work for is already paying you for the service I'm using. We use SSO for EVERYTHING, I've already 2FA Authenticated the login, and even if I set up a passkey I will still have to 2FA the login.

I don't use these sites in any personal capacity, and I would never use a site that harasses me in any way if I was not absolutely required to in order to earn a paycheck.

You're not going to get any money out of me, why are you torturing me?

Reply on news.ycombinator.com