Hacker News Reader

Comment by Liftyee | Hacker News Reader

YES. This exactly. I work across multiple devices, some of which are nonstandard/uncommon (Linux, Xiaomi China ROM, ...) and I've NEVER had passkeys work properly - yet everything constantly prompts me to add one. Even if they did work, I'd have to carry around hardware keys or register each computer separately. And the lack of backups if a device is lost/broken is definitely a larger concern for me than being phished of my TOTP keys.

View on HN

My wife clicked through a Google dialog and suddenly was using a passkey. It absolutely happens, though IMO more to the non technical users. I know what those login dialogs and pop ups mean, and decline them.

(At least til I get around to setting up my new usb c yubikeys!)

I'm convinced that most Passkey adoption is accidental.

I'm convinced it's over 80%.

> lack of backups if a device is lost/broken

Same as traditional physical keys, you don't have a single key, you have multiple ones precisely so that if you lose/break one, you are not stuck and can go to the local locksmith and get another one in minutes.

In fact it's even nicer since you can just re-use the backup key with no security loss by revoking the other one, and buying another key.

For physical keys I don't need to ask permission to be able to make a second or third copy.

You don't need to ask permission to buy another key then register it to your self-hosted service.

In fact if you have the technical skills to make your own physical key and respect standards, e.g U2F, you don't even need to buy one and it will work with existing devices and services. I can recommend the Precursor for an interesting exploration of that from a verifiable software/hardware perspective.

It's not like physical keys at all. You can get copies made of those. Passkeys deliberately are not copyable.

You don't copy the keys themselves, instead you make multiple relationships with different keys. You can get as many or as little keys as you want. The point is the keys themselves are not important.

The keys are vital, and if you lose them you're SoL. A major hurtle is that you cannot create multiple relationships with different keys. Each key can only be used once.

> Same as traditional physical keys, you don't have a single key, you have multiple ones [...]

I have multiple identical ones.

> [...] and can go to the local locksmith and get another one in minutes.

Can I go to the digital equivalent of a locksmith (like a backup software) and duplicate my passkey? Can I do that with only my passkey in hand (without having to do anything to the corresponding lock, or having to contact its issuer), like I recently did with a physical key?

Heh, in the security world, this shows how your traditional metal key is "something you know" (like a password) because it can be copied and many people can know it at once!

So if we are enforcing MFA requirements and allow this kind of clonable key, then we should really require some other factor that is not clonable.

That's the core silliness of this whole passkey mess, IMHO. So many turns of rhetoric and weird compromises, we have cargo cult security and no real understanding of what security level is in place.

Instead of the best of worlds, we can accidentally have the worst of worlds without realizing until it is too late and we're painted into one of those ugly corners.

> Heh, in the security world, this shows how your traditional metal key is "something you know" (like a password) because it can be copied and many people can know it at once!

If you have a photo of a traditional metal key, you can duplicate it. AFAIK, there's also a numeric representation of the height of each position on the key; if you know that number, you can duplicate the key. A traditional metal key is more like a password than most people think.

> lack of backups if a device is lost/broken

That's not accurate. Bitwarden syncs passkeys across all my devices including both mobile/desktop (iOS/Android/MacOS/Windows/Fedora) using Chrome/Edge/Safari (I haven't tried Firefox).

KeepassXC is an open source alternative for cross-device synced passkeys. Marginally less secure than device bound passkeys but it's seamless and I save so much time now being able to login with one-click everywhere instead of wasting it on arbitrary "let's make sure you're you" MFA nonsense.

Reply on news.ycombinator.com