Hacker News Reader

Comment by 66fm472tjy7 | Hacker News Reader

It seems to me like those who like passkeys/consider them simple are those who entrust all their credentials to proprietary cloud software vendors that sync them to all their devices.

Those of us who are not comfortable with that and want to keep our credentials offline and sync/backup them ourselves have questions about how the registration/backup/sharing flows work exactly.

I see this as part of a trend together with remote attestation, age verification, CSAM scanning, restricting sideloading, etc that will lead to most interactions over the internet only being allowed if big tech and/or government can verify the participants, the contents, and the hardware and software used.

Even among techies, many support these developments, so it is just a matter of time before we have no choice but to join the former group.

View on HN

I do love the cloud version of passkeys, but I also have a backup YubiKey. I could do two backup YubiKeys, drop the cloud, and keep one YubiKey in a safe deposit box and one elsewhere, but I haven't had much reason to yet.

A passkey doesn't give up anything compared to a password, and is in fact much much easier to handle, IMHO. I have kept all of my private SSH keys in secure hardware for a decade, so perhaps I'm more used to carrying a physical key than others, but IMHO it's all better, all around.

We should eliminate passwords, and that has nothing to do with remote attestation, age verification, or anything like that.

For 20 years, I've only known two to three passwords at any time, and those are login passwords for separate boxes or corporate/home accounts. Beyond that, hardware access should solve everything, and I shouldn't have to type any passwords anywhere. Every account needs granular credentials, not shared credentials, but no user should have to memorize passwords beyond one per work domain.

> I do love the cloud version of passkeys, but I also have a backup YubiKey

How does this work, exactly? Does you cloud password/key manager allow syncing to the YubiKey?

Or do you register a second passkey that you store on the YubiKey whenever you create a passkey?

If it is the latter, do all services that allow passkey authentication also allow registering multiple passkeys? How many?

> could do two backup YubiKeys [...] keep one YubiKey in a safe deposit box

If you register a new passkey on the primary, do you then have to take the backup YubiKey out of the safe deposit box to put it on it as well?

I haven't seen this kind of question answered when sites prompt me to use passkeys instead of passwords.

I create multiple passkeys for the account: an iCloud passkey and a Yubikey passkey.

Both passkeys are independent of each other and know nothing about each other, only the website knows that both are mapped to the same account.

It's like setting up multiple API keys for a service. Passwords are usually restricted to just one, but passkeys are (generally) allowed to have multiple backups.

When I go to login to Google, for example, it will prompt for a passkey. Currently, in Safari, it will prompt for biometrics on my iCloud passkey. I can either give it my fingerprint/face, or hit the "More options" button, which in the current list allows either 1) insertion of a USB security key, or 2) presenting a QR code that a phone device can scan, allowing use of the passkeys on the phone.

(All very good questions, BTW!)

You can use passkeys with any password manager, including selfhosted ones like keepass.

Reply on news.ycombinator.com