Hacker News Reader

Comment by gonzalohm | Hacker News Reader

I think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account)

View on HN

Yes, you can. Either you can physically own the key on the physical device (i.e. Yubikey/Google Titan/HSM) or you can use software (KeepassXC, Bitwarden).

Most operating systems and browsers come with a sync mechanism that many people default to, but it's no more than that: the default.

As for account recovery, most websites have a way to recover your account when you lose your password, there's no reason why that wouldn't work for passkeys. Every website with passkey access I've used so far makes passkeys optional and forces you to set a password already. If they switch their default to passkeys and add a password as an optional step, nothing would change.

There are even open source hardware passkeys (NitroKey) so you can have security with freedom.

> Most operating systems and browsers come with a sync mechanism that many people default to, but it's no more than that: the default.

Assuming the FIDO Consortium approves. Otherwise you might be like KeePass, being unceremoniously threatened with revocation of attestation, for offering to do what the big players are able to do.

My passkey is synched with iCloud which has all hardened settings set to on, so if I switch devices (I have) its seamlessly. You can also export Passkeys is my understanding but I have not tried it.

When I'm on non-Apple I can scan a QR code on my phone and it will validate it the same way, using bluetooth to send enough info to the target computer to get me logged on.

Bluetooth is actually only used to establish proximity. Both your phone and the browser connect to an internet relay, which lets the phone essentially pretend to be a USB security key connected to the computer.

> think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account)

It is not true. You can move passkeys between OSs if you have a password manager or an OS that has this ability. For example, I store my Passkeys in iCloud Keychain and I have them synced on all my Apple devices.

There are cases though, where the website can force the requirement of a device bound passkey, but that is something it is not very likely you will encounter.

I have considered making a website that specifically enforces the use of a hardware passkey such as a yubikey since you can verify that it it is a real device signed by yubico meaning that if you want a bunch of users to come discuss a subject they are verified by means of having to purchase a physical key. Obviously, there is nothing stopping someone from buying a bunch of yubikeys but you can then ban said users with those yubikeys

But you don't own your passkey. That's the biggest red flag. It's yet another wall by apple to prevent you from leaving their ecosystem

I think the OS is needed to sign the challenge, but the private key can be taken wherever. And passkeys are multiplatform. Not Apple-only, by a long shot.

And I suspect that most geeks, hereabouts, could set up their own signing system.

My passkeys are in my self-hosted Vaultwarden. If I can't put them there, I don't use them.

It's not all sunshine and roses, though. Despite having Bitwarden set as the only passkey provider in my Android setup, the phone persistently only offers me Google. Which is empty, because as I said, I won't use one tied to things I can't control. Works great on desktops, though.

Passkeys can theoretically require you to be on hardware, I haven't found anything yet that requires that.

This sounds like a Bitwarden specific issue, because I don't have that problem with Proton.

More poking around suggests it is an Android 14 issue.

I think you can do passkeys wile having private key. When os has the private key its just more convenient way of doing passkey.

I think you can but it has to be supported by the website that you are using

I don´t think I've ever come across a service that only used passkeys. Username/email + password + 2FA is usually the primary form of verification. There's usually a way to recover your account through email.

Doesn't that defeat the purpose? I thought the objective was to get rid of passwords

I use passkeys only, for the backend admin app for my app.

They work fairly well. I use a login ID/PW to set up the passkey, then the passkey, for everything else.

Passkeys work well, but I feel as if they are still a bit too “fiddly” for your average mensch.

I’m pretty sure the private key is transferable, but Apple keeps them in the Keychain, so they seem locked into the OS. On my machine, I can also keep passkeys in 1Password.

A while back, I wrote up a series on implementing passkeys in iOS/MacOS: https://littlegreenviper.com/series/passkeys/

You can, with for example KeePassXC. But following passkey development it does seem that in time they will want Google or Apple to own your private key and for you to use it through them.

Reply on news.ycombinator.com