Hacker News Reader

Comment by christina97 | Hacker News Reader

It’s quite the opposite. Passkeys are phenomenal for a lot of consumers. Based on this thread, it’s the engineers who understand authentication in the first place and have their own system (eg password manager) that are confused.

Consider a user in the Apple ecosystem: you are already conditioned to just do Touch ID or Face ID when asked. I was on Amazon the other day, it prompted randomly for “want to set up a passkey to sign in easier”? I set it up and now I can easily sign in to Amazon on my mac or iphone with zero friction.

For the normal consumer this is not a replacement for “dig out my password manager and copy-paste/autofill my password”, it’s a replacement for “oh it’s prompting for my password again” -> proceed to type your shared password for all sites.

View on HN

A password manager let's me use my service specific credential from any device, securely and decentralized.

Passkeys lock into a specific device and seem easy until you need to use another device.

But instead of being a credential you own and control, across what could even be a local password manager, it's one password to everything. Maybe it is more secure than a regular password in some cases but it largely seems like a worse fix than existing tools for a problem that has better solutions.

Passkeys do *not* do that. I use 1Password to manage my passkeys and they are all synced across all my authenticated devices where I installed 1Password.

You can choose either if your password manager supporte Passkeys

Of course. I was just pointing out that their claim about the lack of portability across devices was untrue.

Perhaps they should’ve said platforms. Because if you wanted to migrate those passkeys off your password manager and into a different platform like Apple Pass or Google how is that accomplished?

https://mobileidworld.com/apple-introduces-cross-platform-pa...

https://support.google.com/chrome/answer/13068232?hl=en&co=G...

https://1password.com/blog/import-autofill-organize-whats-ne...

There's a protocol, FIDO Credential Exchange Protocol (CXP) which is currently at proposed standard status. It is supported by Apple and Google and some third party password managers (1Password, Bitwarden, and Dashlane). (1Password is kind of annoying though as its CXP export only supports exporting everything. There is no way as far as I can tell to export just a single item yet).

Once 1Password supports proper single export when I make a new passkey I'll store it there and later export it to Apple.

Meanwhile I simply make two passkeys. I've only run into I think two sites that supported passkeys but would not let me make two.

On most sites making a second passkey is as simply as going to your security settings, finding the passkey settings there, hitting the "add another passkey" link, and pointing your phone at the QR code it shows, and then on those phone choosing the password manager that you did not use for the first passkey.

On my PC I don't have a manager set up. The browser has the passkey saved, if I accidentally set one up by mistake, but it's not accessible on my other devices.

How do I log in to my account if I don't have the specific device the account exists on?

How do you move your passkey from Apple's keychain into the password manager?

in the ios password app you can tap on the button to export data to other app. it will show you the list of installed apps that can import them. works with passwords and passkeys.

I moved all of them from my iphone to a selfhosted bitwarden in two minutes.

Ok, good to know that.

I'm surprised selfhosted services would be allowed in that list. Isn't there the "risk" that you can then extract the raw key from your selfhosted instance?

I put my passkeys in my password manager and it works fine.

I keep all my passkeys in 1 password. So magical

1password and KeypassXC both support passkey syncing across devices and operating systems.

Until service providers ban them for being insecure — "if you can send your passkey to any other device, you can also send it to a phisher."

Passkeys have preventive measures for phishing.

https://bitwarden.com/resources/passkeys-are-phishing-resist...

    it's one password to everything

You are entirely mistaken. Passkeys involve a third party storing a public key on their infrastructure, while you hold the private half of the key, somewhere.

Passkeys are never reused. Even for the same person, they are always unique across websites, and across devices.

and to unlock that passkey on my PC uses... my user account password. So now every passkey on my device has a single password.

and I can't use this on any other device by default. My passkey is locked within the browser used to set it up.

You're arguing against a straw man.

All password managers support passkeys.

Both apple and google allow exporting your existing passkeys to third party password managers too.

Also each website gets it's own unique public key with passkeys. It isn't a single credential

You're literally arguing a strawman

I don't have a password manager. All the passkeys I've been asked to set up are locked within this one browser on this one device.

By single credential, all the passkeys on this browser use my windows user password which is effectively a single key.

The moment my mom needs my help to login to something because she clicked the button but now it's expired / she got a new phone / raison du jur, I will be totally unable to assist her. It's a horrible concept being foisted on unsuspecting victims.

>"Consider a user in the Apple ecosystem"

Already you're off-base. Of course it works when your devices are homogenized, but very little folks work that way. Some people have a Windows computer using Brave, an iPhone using Safari, an Android device using Chrome, and a work computer with its own hardware/software limitations and partitions.

Of course it works when your ecosystems are not diversified. Problem is, most people are.

Even using passwords instead of passkeys is going to be a worse experience when using different platforms like you mentioned - I have a massive number of passwords from recent decades.

A cross-platform password manager like Bitwarden handles passkeys (and passwords) across multiple operating systems, browsers, etc.

> Passkeys are phenomenal for a lot of consumers.

It already falls apart for regular interactions like "Can you send me the Netflix password?"

At least on Apple devices you can share passkeys with contacts

> I can easily sign in to Amazon on my mac or iphone with zero friction.

And Windows, you need Bluetooth enabled on both devices, on Linux you need Chrome (and presumably bluetooth enabled). It makes you scan a QR code.

I've found passkeys generally simple and easy to use on MacOS and Android.

On Windows, I hate them. They always push me towards using a PIN instead of my Yubikey or password.

Until you want to log in on a non-Apple device.

This is not true. There's a specced QR code and Bluetooth workflow for using a passkey on one device to sign into an account on another. It works cross-platform.

If the service implements it.

I refuse to be part of an "ecosystem".

KeepassXC is free, open source, and supports passkeys. You can locally store your encrypted password vault wherever you like, and transport it between devices using physical media if you like (or self host your own personal storage synchronization server and sync your passkeys between devices like that).

No need to be a part of an 'ecosystem' to use a password manager or passkeys.

You can sync your vault between devices, but what's the point if the clients on those devices don't support passkeys? As far as I know, no KeePass app on Android has mature passkey support. That's not even mentioning more niche cases, like what if I want to log into a website in a browser on my TV? The cool thing about passwords is that they work on any device.

Also, remember when one of the maintainers of the passkey standard warned that KeePassXC users would get blocked by relying parties [0]? Would you allow tech companies to determine what password manager you are allowed to use?

0: https://news.ycombinator.com/item?id=39698502

KeepassDX has pretty good passkey support I think. At least, it works for me.

I'll give it another go, I found it buggy last time I checked, but that was a while ago.

> KeepassXC is free, open source, and supports passkeys.

KeepassXC was threatened to be blocked.[1]

[1] https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

I love KeepassXC, I use it for all my passwords.

However, I won't give it things which are meant to represent devices.

People who designed the 2FA model designed with the intention that a password is something you know and a device is something you have.

By putting storing both together you're breaking the assumptions of the people who design these systems.

So I store all my passwords on KeepassXC, everything else has to be elsewhere.

Too late, you're using web standards, you're part of an ecosystem.

Reply on news.ycombinator.com