Hacker News Reader

Comment by ranger207 | Hacker News Reader

The website for my HSA required me to set up a passkey last time I logged in. I set it up on my work laptop and my work password manager, which means I can now no longer access my account from my personal computer. This is fantastic, just what I wanted

View on HN

And then you call them up, and they allow you in after asking some identity questions, and you learn there's no real security.

This is exactly a scenario that worries me. Proponents of passkeys imply you can setup a bunch of passkeys. Evidently that's not always the case.

"But that's just a bad implementation, many other sites do it right!"

And many sites block paste from password managers. Passkeys have so many ways to do them wrong that we're going to see all kinds of new and exciting failure modes that lock you out of your account in the future.

Are you also using HealthEquity for your HSA? I'm the same boat, they're forcing passkeys on me. I can still login using my employer's SSO but I've been putting off setting up the passkey until I have to.

yep

I've refused to set up an account. I just call them on the phone if I need something special from them, have them send paper statements, and eat the should-be-totally-illegal-because-of-how-obscenely-large-it-is "mail you a paper statement" fee.

Click the "lost password" button. Passkeys aren't magic, they're just a funky password.

If the website didn't implement a "lost password" button then that says a lot more about the website than it says about passkeys.

I think the irony here is missed.

Reply on news.ycombinator.com