Top
Best
New

Posted by todsacerdoti 7 days ago

Yep, Passkeys Still Have Problems(fy.blackhats.net.au)
192 points | 213 commentspage 2
Mindwipe 7 days ago|
Really great article.

I also think there's still an enormous ignorance from passkey devs that lots of people want to occasionally log into personal services from locked down corporate machines, and the flow to deal this is at best terrible but more often non-existent, and developers with typically enhanced privileges just aren't able to conceive how difficult this is.

tzs 6 days ago||
Logging in to a personal service from your locked down corporate machine with a passkey works like this:

1. Start to login to the site.

2. When it gets to the point that you would choose to use a passkey if you were logging in at home, there should be some option that lets you say you want to use a passkey on another device. You can use that to tell it you want to use a passkey that is on your phone.

3. It gives you a QR code to scan with the phone, and then you complete the login using the passkey manager on the phone.

timmyc123 7 days ago|||
This is one of the core use cases for why FIDO Cross-Device Authentication was created. To be able to use a passkey to sign in on a shared device, a device you don't control, or a device where you just need temporary access to something.
crazygringo 7 days ago||
On the one hand, that seems really important and I'm happy to know it exists.

On the other hand, I thought I had fully researched how passkeys work and literally never came across it.

So it kind of just continues to support my concern that passkeys are just too complicated to understand. If I'm at another device I need to log into, I would have just assumed I couldn't.

There needs to be a simple mental model for users. I'm not saying passkeys can't underlie that, but I think the UX still just hasn't been fully figured out yet.

timmyc123 6 days ago||
I used the technical name for the capability, but you've likely run into it before.

If there is no passkey on the local device, a QR code will appear which you can scan with your phone or tablet, and use the passkey for the account from that device. It just kind of happens, typically without the user having to do anything special.

I will say though, corporate devices can be a bit of a wildcard as they are usually configured and locked down for a specific purpose. But the cross-device flow is generally not blocked by organizations.

crazygringo 6 days ago||
I don't use passkeys, so I haven't run into it. It seems like that screen would be gated behind entering an e-mail address or username that is already registered with a passkey on another device.

What I'm saying is, I thought I had the right mental model of how passkeys work, after researching them, and that mental model told me you wouldn't be able to log in on a different device without going through a whole procedure to set up a new passkey, which you wouldn't want to do for something temporary.

The mental complexity is just too much for me to trust that if I adopt them, they'll work when I need them. The fact that I got this thing wrong means there's probably other things I'm still getting wrong.

I understand passwords and password managers and even 2FA. I feel like I can plan how to use them right so it all works and I don't need to worry about not being able to access my accounts. I just don't have that confidence with passkeys.

nine_k 7 days ago|||
> log into personal services from locked down corporate machines

This is usually a bad idea, and is sometimes expressly forbidden.

But. more generally, there must be a flow for accessing your account when the passkey is not available, and possibly cannot be recovered.

AndrewDucker 6 days ago||
I'm limited in what applications I can install at work. I am not limited in what websites I can access on my lunch break (within reason).
timmyc123 6 days ago||
This is one of the core use cases for why FIDO Cross-Device Authentication was created. To be able to use a passkey to sign in on a shared device, a device you don't control, or a device where you just need temporary access to something.
AndrewDucker 6 days ago||
Just tried that.

Logged into Passkeys.io on my phone, and created a passkey.

Then tried to log in to it on my Windows desktop, using the "With my phone" option. First time around it failed to connect to my phone. Future times it connected, but told me that the phone had no appropriate passkeys on it. At which point I gave up.

Edit: I then tried on GitHub, and it worked perfectly! Okay, that's pretty awesome.

oasisbob 7 days ago||
As someone who has enhanced privileges, I'm having problems thinking of what all the the issues here are.

Corporate installs disable all USB functionality, and remove the ability to sync profiles? Something like that?

spencerflem 7 days ago||
If you’re not using bitwarden or equivalent they can’t be moved off a device you own at all, and even with it you’d need to download bitwarden which might be impossible
eddyg 7 days ago||
Passkeys are fantastic for the vast majority of the population. They solve oodles of problems. No more teaching ${FAMILY_MEMBER} about good passwords, password re-use, trying to explain how to use a password manager, etc. Instead: create passkey, done. Then it's seamless login whether they're on their computer, phone or tablet.

As a tech-savvy user fully aware of the underlying machinations involved with passkeys, I greatly prefer their simple, fast login experience over: username submit password submit TOTP submit, and especially over the much-worse "we've emailed you a code" login slog.

201984 7 days ago||
It's great until they break their phone, or spill coffee on it, or just lose it, and now they are locked out of EVERYTHING with no good way to get back in.

Passwords on a piece of paper for better or worse do not have that problem.

eddyg 7 days ago|||
Only if they're not backing up their phone, which seems insane in this day and age.

And even if they're not, if they have a computer or tablet, the passkey will still be available there assuming they share an account.

You can also recover your iCloud Keychain via a designated/trusted Recovery Contact (e.g. spouse, who presumably hasn't destroyed their phone at the exact same time), or via iCloud Keychain escrow.

https://support.apple.com/guide/iphone/passwords-devices-iph...

jesseendahl 6 days ago||||
Both of the major smartphone companies (Google and Apple) have pretty robust account recovery processes. Are you familiar with all the options they have? Your comment gives me the impression that you are making assumptions about what would happen, instead of doing research on how it actually works.

I experienced Google's recently and it was very robust.

Even before passkeys, the average user would have major problems if Apple and Google didn't have good account recovery processes.

Barrin92 7 days ago||||
>with no good way to get back in.

which is why at the very least your email provider gives you a recovery kit to print out (the equivalent of the notebook) and if you can get back into that account you'll likely be able to get into whatever else you signed up for.

There's no difference here between passkeys and any other central storage be it a password manager or a physical notebook. If you lose that access, well you're screwed. But it always beats having hotdog123 as your password for 70 different sites.

201984 6 days ago||
Password managers can be backed up onto USB drives pretty easily, and copies can be made of paper.

It's much more difficult to make comparable backups of passkeys due to all the "anti phishing" / vendor lock-in rules most platforms have.

eli 7 days ago||||
Android syncs them to your Google account and iPhone to your iCloud account by default. Which isn't a perfect solution but, again, is pretty good for most people.
201984 6 days ago|||
And I just found out recently that you can't log into Google on a desktop without responding to a prompt on your Android phone. Which, if you broke said phone, you can't do.

This is without 2fa enabled on my Google account.

Groxx 6 days ago|||
There are a few alternate options like email or sms (I've used them several times, you have no option if you erase your only actively-used phone occasionally), but yeah. Google effectively forces 2FA whether you like it or not.
eli 6 days ago|||
I don't think this is correct
ubertaco 6 days ago||||
And that's great, as long as you're totally cool with access to _any_ of your accounts _anywhere_ being completely controlled by either Apple or Google.
eli 6 days ago||
I was just correcting the parent post that implied the passkeys were only stored on the device. Personally I do not use that feature.

I'm also pretty sure I don't have any accounts that can ONLY be accessed via passkey.

hshdhdhj4444 6 days ago|||
Have you ever been locked out of your Apple account?

Maybe because your kid was playing with your phone and kept entering the wrong passcode and now you’re locked out for several hours?

Or because Apple detests anyone else touching your phone and you’re traveling internationally and your screen cracked and you took it to a local repair shop which in the process of replacing the screen triggered something Apple didn’t like and you’re locked out for a decade.

eli 7 days ago|||
You omitted my favorite feature: virtually immune to phishing. You can't accidentally submit a passkey to a lookalike domain.

For phishing protection, passkey as a single factor is better than memorized password + TOTP/SMS two factor.

noAnswer 7 days ago|||
How does the secret jump from the PC to their phone? How do they know each other? ...does the answer involve going all-in on Apple forever?
timmyc123 7 days ago|||
Your credential manager provides this sync and backup capability. There are dozens of credential managers available that work on all platforms. You don't have to use the default one on any given platform.

Bitwarden is my personal choice.

spencerflem 6 days ago||
I still don’t like that I can’t use them on a computer that I can’t download bitwarden on. Library computer, etc.

Passwords I can see myself and make the informed decision to use temporarily somewhere else.

Too 3 days ago||
When was the last time you used a library computer, let alone logged onto a private service with it? This was a bad idea even 20 years ago. In today’s security climate, aw hell no.
spencerflem 3 days ago||
Or my sisters laptop. & Fairly recently actually, to print something. Most accounts I don’t care that much about & two factor should be enough to save me I hope.
eddyg 7 days ago|||
iCloud Keychain (or whatever the Google equivalent is). And as I said, it's a fantastic solution for the vast majority of the population (which, coincidentally, are also not Hacker News readers).
noAnswer 7 days ago||
Can you keep access if they decide to shut you down?

https://news.ycombinator.com/item?id=46252114 https://news.ycombinator.com/item?id=42350245

They closed my PayPal account for TOS violation after donating to The OpenBSD Foundation. I wouldn't trust them as far as I could throw them.

lazide 7 days ago||
Huh? I’ve seen zero implementations that work seamlessly across computer, phone, tablet - unless they are all single platform, which I have yet to see anyone actually pull off.
eddyg 7 days ago|||
It's a beautifully simple experience for Apple users across all their devices.

I can't speak for other platforms; I stopped helping ${EXTENDED_FAMILY} with non-Apple questions because the crap I had to diagnose, debug and deal with for Windows and Android was worse than ${DAY_JOB}.

happyopossum 7 days ago||||
There are nearly countless ones - 1password for example works everywhere, as does Roboform, bitwarden, keepass, LastPass, nordpass, and many others.

All sync seamlessly and support the major (and often minor) browsers.

timmyc123 7 days ago|||
Google Password Manager, Bitwarden, 1Password among many others.
0x457 7 days ago||
Everyone pretends that you're force to only have 1 passkey. I use 3 "passkey managers": Passwords.app, Bitwarden, YubiKey hardware key. I usually add all 3 or just two (skipping YubiKey).

On Apple devices I get neat experience out of the box, on Linux (+Firefox) I forced to use Bitwarden because Mozilla is being Mozilla.

Never had any issues ever with passkeys.

XorNot 7 days ago||
3 technological devices which I can't validate by checking if the physical piece of paper is still legible in a safe.
stouset 7 days ago||
Yep. I use Apple’s direct support which works out of the box. I also create a second passkey in 1Password. And for truly important accounts (1Password itself, Apple, Google), I have a third copy on a YubiKey stored in a safe deposit box.
fusslo 7 days ago||
I feel like a boomer.

I dont want to use google/apple/microsoft for any credential manager because: google is evil; apple has locked me out of my apple id (and lost things like the recordings of conversations with my father during his hospice); microsoft keeps getting worse and more annoying to use.

So ok, I need some credential manager. I used keepass previously... but how do I vet other credential managers? I dont want an online backup. I want my credentials to only be on my computers. So now I gotta learn about which apps are ok, don't have cloud synching, can export files, and be compatible with MacOS.

And I have to learn what is FIDO? Like FICO? why do I need to synch with FIDO? what is it? will it give my credential store to others?

How is this easier or more convenient than a user/pass with 2fa?

I feel like I am going to accidentally leak my credentials and have no way of knowing

jmsgwd 6 days ago||
> I dont want an online backup. I want my credentials to only be on my computers. So now I gotta learn about which apps are ok, don't have cloud synching

If an "online" password manager uses end-to-end encryption, then the credentials really are only on your computers. The only thing "in the cloud" is encrypted blobs of data being moved around for the purpose of device sync and backup.

This insistence on using local non-syncing password managers is a masochistic exercise in making life difficult for yourself with no security benefit.

jmsgwd 5 days ago||
That came across more snarky than I intended!

Let me rephrase: for the majority of users, the usability and resilience benefits of synced credentials are enormous, and the security costs are marginal at best. But this rests on a number of assumptions. YMMV.

scblock 7 days ago||
In your case it's literally the same "complexity" as user/pass with 2FA. You need something to manage the passkeys, just like you need something to manage your second factor. Everything else you list as a worry is already in play.

FIDO is a standards body which produces specifications used by these systems.

polalavik 7 days ago||
Passkeys need a marketing campaign and UX overhaul.

I’m a technical guy, but I really don’t understand what the fuck is going on when I use a passkey. All I know is one day it appeared as an option and it let me login to things. I don’t really understand where it lives, what device it’s tied to, how scanning a QR code on Google Chrome on my phone magically logs me in, etc etc.

The user was not educated on this. Hacker News is the top 1% of computer power users. You gotta understand to someone’s grandma or mom or brother who works in real estate none of this makes any sense nor will they educate themselves on what it is.

johanyc 5 days ago||
How do you use your passkeys? Do you have them sync with your apple or google accounts?

I've only experienced using passkeys with 1password and it's smooth as butter. Assuming 1p is unlocked, To login: press login with passkey on website -> press sign in on 1p extension pop-up -> done To create account: click create passkey on the website -> click save on 1p extension pop-up -> done

Tbh i think it's more important to get people to use password managers than passkeys.

timmyc123 7 days ago||
when you create or use a passkey, the UI on all platforms tells you where it is going to be saved or where it is coming from.
crazygringo 7 days ago||
Right now, when I go to the security section of my Amazon account in Chrome, it (unasked) prompts me to add a passkey, and the popup on my Mac says, verbatim:

> Add a passkey? "amazon.com" supports passkeys, a stronger alternative to passwords that cannot be leaked or stolen. A passkey for "xxxxx@xxxxx.com" will be saved in "Passwords". Touch ID to Save Passkey Cancel

I don't have the slightest idea what "Passwords" is as the destination. My iCloud keychain? My Google account? My 1Password?

timmyc123 7 days ago|||
Passwords is the name of the app on your Mac.
crazygringo 7 days ago||
OK, on the one hand TIL -- thank you! That's a super-meaningful piece of information.

On the other hand, you can understand why that is not remotely clear from the message. It's a generic term in quotes. If it said it would be saved "in the Passwords application (and synced to iCloud)", then I'd actually understand it.

So Apple is either being intentionally obtuse or incompetently confusing here, and I don't know which is worse. And it's UX crap like this which is why I still won't use passkeys, because I don't know where anything is going.

timmyc123 7 days ago||
I can certainly see the confusion. Thanks for highlighting it!
polalavik 7 days ago|||
Exactly passkeys are confusing to the laymen (and not Laymen) because it’s is an orchestration across multiple services and devices.

If I’m using a passkey to login to my Gmail via chrome browser but used my phone what just happened - did it save in chrome? My Google account? My iPhone?

timmyc123 6 days ago||
The dialog provided by the browser or OS usually tells you where the passkey is saved.
kouru225 6 days ago||
One thing I genuinely hate about modern tech is that it punishes you for planning ahead. I purposely spent time getting a password manager and implementing 2fa protocols that would both speed up my time and keep me safe. Then suddenly every company decided it was time to go passwordless or do passkeys and all my work (researching different products, setting each one up, making sure hey work on all my devices, etc etc) suddenly goes down the drain
1970-01-01 7 days ago||
Totally agree with this. Passkeys are a solution but not the sole solution. There is absolutely a misconception for seeing them as newest and therefore the best choice.
pabs3 5 days ago||
Hmm, does not mention that you can't use Passkeys if you don't have JavaScript enabled.
quantummagic 7 days ago||
It's not really passkeys that are the problem, it's trusting your passkey to a third-party. But this is still a minor part of the market today, a much bigger problem to warn people about is the "log in with your google/facebook/etc account". Where you're handing everything over to a third-party as well, because it's so easy and convenient.

Passkeys, stored in Bitwarden, give a lot of the same convenience, but without the vendor lock-in. We shouldn't be scaring people away from passkeys, when commonly used alternatives are much worse.

XorNot 7 days ago|
It's the fact that there's no physical artifact that's the problem - there's no file.

You can't back up your passkeys and wind up with something you put in a safe on a USB key or something and vendors have been aggressively trying to make that harder.

quantummagic 6 days ago||
You can export them from Bitwarden and back them up.
commandersaki 7 days ago|
Passkey is a great avenue for hackers because they represent an optional authentication mechanism that users overloook.
More comments...