Hacker News Reader

Comment by rcxdude | Hacker News Reader

Cool, where are they stored? (I know the answer: 'it depends', and that's the big problem with their usability: most users haven't a clue what the answer is and most tech support can't answer that question straightforwardly because it depends on some decisions the user probably didn't even realise they made).

View on HN

On my keychain in a USB hardware token. With a couple of backup tokens in fire safes.

If you're using a USB hardware token your knowledge of it is at least an order of magnitude better than the median user's. I know where my passkeys are stored, I don't know where my family member's passkeys are stored and neither do they. The same is true for most of my otherwise fairly technical co-workers.

There needs to be industry and government leadership on this to gradually require hardware token usage, for at least critical financial and government applications. Right now everyone is putting their energy behind passkeys, but those are much harder to understand than a physical token. I don’t know any non-technical people who understand how passkeys are normally tied to the device (or the manufacturer-provided cloud account in some cases), how to set them up on a second device, why you might want to do that, etc. And many technical people still don’t get it either!

Absolutely not. If that is required, I will do my damndest to only use implementations that deliberately lie about the hardware status. Your line of reasoning is dangerous.

Then that family member does not worry like you do worry. The main point is assuming one can have a proper security for Google account - everything else becomes easy.

The fearmongering of losing google account should stop. Yes, some people lose it. There are a larger proportion losing/getting pwned by repeat use. For the majority - just pressing the fingerprint to access an account (like amazon/eBay) via passkey is great.

Fairly technical co-workers - I used to suggest them to buy USB security key few years ago. Now that same fairly technical some how has at least 2 devices with them - so they just skipped the USB security key need - and just use Google (in Android) or iPhone in Apple ecosystem. Everything just works.

Yes, there will be a poor soul that may lost everything with only one device.

People keep their entire lives in cloud accounts these days. Their passwords, financial history, copies of important documents, baby photos, etc. Losing access to it is incredibly disruptive and may result in unrecoverable losses.

It shouldn’t be this way, but it is.

At the same time, I know so many people believing DIY raspberrypi based NAS and losing lots of data (thankfully they had cloud backups).

Not everyone has access to server grade hardware.

>Then that family member does not worry like you do worry.

Until they lose access to that account and then it becomes my problem to solve.

This is a different issue. Not everyone has a data engineer - know it all as a family member.

And you need to accept it works for millions.

Working for millions doesn't imply a good hit rate. Google could release a feature that worked 1% of the time and manage that, as well as barely noticing if it wipes out 10% of their users. My actual experience is that almost all the people I know who are using passkeys are using them by mistake and it's only not a big problem because they aren't currently being used up to their promise of preventing the vulnerable authentication methods.

My actual experience is people with passkey are fine. No more account take over. Mote over they like frictionless login.

Yes there are few that used bitwarden and lost everything as their sync using syncthing failed.

The biggest issue with passkeys is that since most USB tokens that support them don't allow syncing the private key to a backup device you have to enroll ALL of them to every site that supports passkeys. This is annoying but it makes storing backups in secure offsite locations impractical.

This is a fair criticism and needs work, I have some short thoughts on it here: https://news.ycombinator.com/item?id=49755217

The entire problem with passkeys is that zero of the issues should have been a surprise, because it should have been part of the design discussion from the start, so the fact that it's not properly implemented before being forced on users says that either it's been done horrifically incompetently and nobody should trust it, or they internally found these concerns and ignored them which means this system is not at all meant to help us, so why is it being forced on us?

It's beyond annoying. It's creating needless toil that no "normies" will ever actually do.

I'd love a hardware sold in multi-packs and "born" at the factory with identical internal device key encryption keys (DKEK). I'd love, even more, if a token just allowed you to "commission" new ones w/ a user-specified DKEK on first use.

I'd use one token as a daily driver and store the other(s) in safe location(s), empty of my personal key material. (Or, if I can just commission a new token w/ my DKEK, store a printed copy of my DKEK in a safe location.)

Give the token a mechanism to "type" a backup of its internal state, encrypted with the DKEK, as a USB HID keyboard. That gives me an easy way to backup the token each time I enroll a new website.

If I lose my daily-driver token I just pull a spare from storage, import my last backup, and I'm up and running.

That would kick ass. No "You just need to buy two tokens and enroll them in every website" bullshit.

Maybe each token also needs a second key, with the DKEK used for authentication and the second used only for revocation. The main reason not to reuse the DKEK is so a lost key can be easily decommissioned.

You would need some out of band way to collect and save your key IDs and publish revocations.

I’m not sure if this would work from a security theoretic perspective, need to think about how the request is signed and transmitted so someone can’t fake a key being “alive” when it’s really “dead”.

I do agree this would be incredibly useful if it can be made to work.

I haven't used a FIDO2 token other than playing around with it on a Yubikey. There, at least, I have to have the PIN to unlock the Yubikey before I can use the FIDO2 credentials (if I'm remembering correctly).

Are there hardware token implementations where mere possession of the token is all that's necessary to use the passkeys stored on it? That's incredibly stupid, and should have been disallowed by the standard, if that's the case.

Yes, the PIN is optional even on Yubikeys, although I think individual providers can require it. Ideally a strong PIN should be used but people may just reuse their ATM PIN, birthday, etc.

I didn't realize PIN was optional.

See my other comment re: the IT industry being fools.

That is how almost all standard FIDO2 tokens work. You just have to press the capacitive sensor when prompted. You can get fancier biometric tokens that require a fingerprint.

That's the stupidest thing ever.

All this hullabaloo taking away user freedom to export keys and backup tokens but physical possession is all that's necessary to use it by default.

We are a ship of fools, the IT industry.

In a secure vault on your phone

Not always. And which vault? There can be multiple on a given device. This isn't some hypothetical 'mollify the user's worries' question, this is an important practical question of what do they need to worry about losing access to. Trust me when I say that most users I have talked to have absolutely no idea about this, and usually only find out when they've already lost them.

So if I drop my phone to the toilet, I will forever lose access to everything? Since the vault is on my phone.

A majority have more than one phone. Or at least they can get a new SIM card and sign into the iCloud account. Then all passkeys are synced from cloud.

Yes, if you are edward snowden then not for you. For rest of us - it is useful

A majority have more than one phone?

Or they have a laptop or tablet - even the cheapest one that has logged into Google or Apple. That way they can recover.

Idk how much money you must be having, but all of my bubbles only ever go with one device

this is ridiculous. I don't even have a bubble device. Run lineageos in a decent 2020 device moto G32 for €100.

Yes, you can afford to host everything locally. Not everyone can.

This is crazy. I have one phone and zero iCloud. I don't think I'm that unusual.

You are exaggerating. If the loss or lockdown is so bad then many would have stopped using any of icloud or google equivalent. People are able to depend on it. People are able to repair and use phones even when it falls into abyss.

Well, I mean yes. People for whom it works. Others never started.

How do I use it on my desktop or laptop then? What if I switch browsers on my phone? What if I get a new phone? What if I change from android to iOS or visa versa? What if I need to log into the site on my Wii U's browser?

as long as you have one working device all will be OK. Either you scan the QR code shown by the website. or if you did login to Chrome with google account then desktop or laptop will just sign you -friction less. Same with iCloud account.

If you browser vendor has implemented passkey then all good.

Most things are built for the majority users. Most don't change. Most don't debate browser wars in hn. Life is like that.

For Wii etc. You just scan the QR code shown in the TV interface. all just works.

Yes, if you want 100% privacy and will do only your own dovecot server then it is not for you.

>How do I use it on my desktop or laptop then

>What if I switch browsers on my phone

>What if I get a new phone

You can let Apple sync your passkeys between devices using iCloud Keychain. Then you can create a passkey on one device and have it available on all of your devices. Google also syncs passkeys to the cloud and lets you use them on Windows (with Chrome)

>What if I change from android to iOS or visa versa

I resolve this by storing most of my passkeys in my password manager. I still store the "important" ones (like online banking) in my phone so a password manager breach doesn't make me lose my money.

>What if I need to log into the site on my Wii U's browser?

Passkeys were designed to let you have more than one, so if you have a device that doesn't let you use your password manager, then just set up another passkey.

Apple can sync to my wii u?

I updated my reply to be more complete.

Nothing wrong with your answer itself, but having to be Apple or Google is a PITA. These account are ultra critical already and you will want maximum security to access them.

This means if you go on a trip somewhere you absolutely need two devices. If you kill your phone and want to buy another one ASAP, you wont be able to do anything with the new device until you can convince the platform it's you. With passkeys you're just SOL. Imagining if you needed a phone to get back from your trip - e.g. etickets, auth needed etc. - it becomes a nightmare scenario.

A third party manager makes it easier, but it's a lot less usable that the first party ones.

Reasonable people make different life choice, having to constantly think about backup strategies whenever I'm away from home would be so stress inducing to me.

>This means if you go on a trip somewhere you absolutely need two devices

If you want multi-device redundancy, you have to carry a second device of some type, it's hard to get around that. I almost always travel with an iPad in addition to my phone, so I have a second device.

In addition, my wife (who travels with me so if my iPhone is stolen, hers might be too) is one of my Apple account recovery contacts, plus I've set my sister as an addtional recovery contact, so even if I'm out of the country and I have to activate a new iPhone, I can call her to help with the recovery. So all I have to do is find an Apple store and buy a new phone.

I also carry a USB key tucked into my luggage with the recovery kit (encrypted) for 1Password so I can activate 1Password on any new device and have access to my passwords and whatever passkeys I don't have in iCloud.

  > With passkeys you're just SOL.

No more so than if you lose access to the device that's required for Google/Apple MFA prompts, neither of which use SMS and depend on a proprietary approval flow.

If you lose your phone in 2026 while on a trip to Italy and try to enter your Gmail user/pass from your wallet, there's about a 100.00% chance you'll hit a "let's verify you're you" gate, that's been the case for 5+ years.

With passkeys I'm not stuck clicking Yes in the Gmail app or typing in the numbers on Apple hardware, I can skip the Apple/Google specific MFA nonsense and keep the passkeys in Bitwarden where they sync seamlessly between devices.

It feels truly liberating being able to skip MFA everywhere and login with 1 click, like a throwback to the golden age of using a password manager in 2010. Before passkeys it started to feel like I was spending 5% of my waking hours every day copying 6 digit codes from phone/email/TOTP after twiddling my thumbs for 15-30 seconds.

I just don't use Google or Apple accounts for everything. I don't want my whole life in the hands of some big tech deciding how I should prove to them that I'm me.

I did use Microsoft 365 (business version) for my email but they also decided I should use their MFA app so I left. I did have my yubikey as second factor but they keep pushing their stupid authenticator app.

Great, what happens if I lose my phone?

in 1password

Reply on news.ycombinator.com