I don't like passkeys

Passkeys do marginally improve security against MITM and phishing attacks, but they are primarily for protecting the lowest common denominator from themselves: people who re-use passwords and/or don't use a password manager.

If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.

The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).

The point about poor support for 3rd party managers is so frustrating. Because this is correct, that is the obvious solution for the normal user, but passkey implementations somehow do not know how to deal with it.

Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.

And the confusing mechanism hurts there too: I'm always a little bit afraid that i'm somehow more in danger because I keep them in a vault that's shared on all my devices rather than a TPM, because whenever the protocol is explained the "it can't leave your device" part is highlighted as the main source of the security, except.... mine obviously do leave my device, with the vault, so.....

My only issue is the ... unclarity... with them.

The option pops up in the middle of a normal log-in flow. I'm guessing most non-techies don't know how it's implemented.

Oddly, some login flows display a normal user/pwd form, but you get the in-browser "use a passkey?" option/popup which further confuses matters.

Thankfully, me, wife, and all our parents are tech-savvy enough to use password managers, so the fallout from lost passkeys hasn't be an issue. But I certainly see how it would be an issue for anybody entering passwords from memory or similar.

While the technology itself may be great (I don't really know since I don't use them) it has been co-opted by the tech conglomerates as another form of isolating and walling off users into their ecosystems.

And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".

I respectfully disagree with the author!

Passkeys have been a massive quality-of-life improvement. Yes, there's the minimal risk of lockout if you lose access to the passkey (though almost every site I've used that implements pk's lays it on top of their traditional user/pass auth flow), but generally speaking most people use iCloud or their Google account to store their passkeys, and because those sync everywhere, this isn't a real risk.

I love not needing to deal with 1Password's autofill being flakey and having to CMD-C/CMD-V passwords/passphrases/OTPs on these sites.

I like Yubikeys as well but they are super inconvenient by comparison when dealing with multiple devices. Setting them up is also very user-unfriendly in general; doubly so compared to passkeys.

Now, what I'd REALLY F'IN LOVE to see go away is the passwordless/magic link auth flow wherein you authenticate by clicking a magic link that gets sent to your email or text message inbox.

"Emails are super easy to hack and we're still not sure whether text messages are safe to send on US carriers, so let's have everyone click on a link sent by email or text so that they don't have to deal with those pesky passwords that iOS or Android will automatically suggest for them." Like, what?

> To an individual, the greatest risks are instead permanent account lockout, automated account bans, and device loss. By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts.

I'm glad to see this view becoming more mainstream. Passkeys are grotesquely insecure.

The only possible way to consider them more secure is if phishing attacks were more common and more damaging than lockout, which is so implausible that I reject the idea that someone could take that position in good faith.

I continue to avoid passkeys but it's becoming an incredibly dense minefield. Certain sites try to trick me into adding one each time I log in and I have to be careful to dismiss the 1Password prompt, then dismiss the chrome prompt, then dismiss the OS-level prompt (all back-to-back). It's so incredibly user-hostile.

YES. This exactly. I work across multiple devices, some of which are nonstandard/uncommon (Linux, Xiaomi China ROM, ...) and I've NEVER had passkeys work properly - yet everything constantly prompts me to add one. Even if they did work, I'd have to carry around hardware keys or register each computer separately. And the lack of backups if a device is lost/broken is definitely a larger concern for me than being phished of my TOTP keys.

Passkeys remind me of ipv6 in that they are a "solution" coming from the supply-side, without (apparently) having done any research in what motivates actual users (and what would motivate them to switch).

<<ducks>>

password managers that allow to export OUR passkeys: Bitwarden, Enpass

it's all backwards, I agree, even worse that we trust "sync to the cloud" but don't allow users to own their credentials.

Passkeys have a marketing problem where no one is able to describe simply what it is without having to use technical jargon. There's also the problem where each OS tries too hard in pushing this to the face of end-user

I try to boycott passkeys due to built-in attestation feature in the standard. Not active now, but given how Google+Apple already use the passkey feature to lock you into their ecosystems, it is just a matter of time until their service will require that the passkey is attested from a non-rooted Google or Apple device. I think this will especially be true for Google to prevent AI scraping bots. Turning this on does not require anything, once passkeys are widely used, Apple, Google and Co. simply can flip a switch.

> When you have to handle a colleague’s computer, it gets much more inconvenient.

Let's add to that: What if you're on holiday and your phone gets stolen or is suddenly 20 meters under water because it fell off the boat?

What if you are a normal person who only has a phone and it simply dies for one reason or another?

You get a new phone then hire the boat again, go above where your phone fell in and hope it syncs your passkeys?

My situation at work is absolutely untenable. Constant redirects, logins that used to have passwords but now have passkeys, but you don't find out until you enter the password. Chrome hijacks the passkey dialog and wants me to use my yubikey, but I have to fumble around and bypass that to then get it to prompt me for a passkey in Apple Passwords. (as long as 1Password isn't trying to intercept my passkey requests today!)

Then on top of that there's a whole 2nd factor layer which _also_ typically involves a touchid press but for a totally different reason (as the 2nd factor, not to unlock the password safe storing my passkey.

It's just an ugly inconsistent dance, dozens of times a day.

I know these gripes are mostly about implementation, and partially about user-facing software, and partially about user choices, but it doesn't make it any less ugly for the user.

> Since they are bound to the site they are created for, they cannot be phished by a hacker’s fake login screen.

With the app you use to store those keys (a password/key manager) it's the same - you simply wouldn't have an autofill working. Sure, people can and will circumvent this for the benefits of the scammers, just like they can circumvent passkeys using non-passkey login option, indeed:

> weakest recovery method: SMS

> If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details.

Similarly, don't other modern password storage methods have the same property?

> lacks the decades of UX polish towards password autofill.

A lot of years in those "decades" have been wasted polish-wise: you still can't log in with a single button, e.g., many popular sites only fill a username first, then require an extra dealy and action before accepting a password

They're a solution to a problem that were created by people who are completely out of touch with normal users and how they use computers.

Sure they work fine on a technical level, but they're frustrating and confusing for the vast majority of people I know.

I am conflicted with passkeys.

I actually prefer non-resident U2F in some ways. You don't have to store anything on your key, you are just signing requests. This is relevant where U2F/FIDO keys have limited slots for 'resident' keys.

In principle, it's great. You have one good password to remember for the average user, and that's enforced by their device's probably good enough security posture.

They are resistant to being phished and they won't reuse the same one everywhere. They then don't end up going from hunter2 to hunter2! everywhere.

But my experience for users is that they worry they are giving their biometrics to Amazon or whoever and so the UX just confuses them.

The certification aspect was new to me too last time passkeys came up. Sites can require that a given passkey has been certified.

The patchy support for them is also frustrating. MacOS does not support NFC FIDO/U2F. iOS does.

I love passkeys. Really. They completely eliminate the need for a password and OTP in most cases (when actually used as they were intended and not as a second factor only), although I always set up both in case. Although I will never, ever like how Google does it. I set up my first Google account with them and now Google absolutely refuses to allow me to authenticate to it because it wants a passkey I don't have (and of course there's no way of not using said passkey) or it wants me to use an Android phone I (also) don't have (I traded it in a couple years ago). And, of course, it provides absolutely no way around that problem. So eventually I just gave up and created a new one for the (rare) times I do need a Google account for anything.

> A combination of randomly generated passwords stored inside a third-party password manager, paired with an independent TOTP app, gives control to the user without giving up the flexibility of plain text.

No grandma, don’t use the unphishable one-click passkey setup that syncs across all your devices. Instead, install a third-party password manager (no, no, not the one built in to your device or browser), then another TOTP app on your phone. It’s slower and more susceptible to phishing, but uhhh, what if you’re among the one in a million people that has their Google or Apple account wrongly banned?

Do passkeys improve security posture for the average person, reducing the likelihood of them losing their accounts to fraudulent actors? Absolutely.

But they also introduce single points of failure, as the article points out. I can't even remember how many times I've had to help a family member recover their account or get confused when they can't sign in on a new device. It's incredibly frustrating that this flow is promoted as the default for so many services.

1password is the best solution I've found for the average person. It's not perfect (it's definitely more complex than writing down your passwords on a piece of paper or using the same password everywhere) but it's much easier than juggling yubikeys. I know so many non-technical staff members who prefer the OS or browser keys even if it means another account recovery is lurking around the corner.

From TFA: "Both Apple and Google want your identity anchored to their operating systems. The “happy path” on their devices is to use their synced passkey management tied to your Apple or Google account. If their automated systems decide one day to ban your account, you irreversibly lose access to all your passkeys used across all third-party accounts too."

This is, in my opinion, the most serious problem with passkeys. I'd like to adopt them, but this is a blocker.

> Passkeys are a fantastic technology. Since they are bound to the site they are created for, they cannot be phished by a hacker’s fake login screen.

The same is true for passwords with a password manager.

> If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details.

Also not really a problem with randomly generated site-specific passwords in a password manager.

Really all the browser vendors had to do was add an API to make automatically generate a password that is then stored in the user's password manager the low friction option.

Completely agree. I think the root of many of its issues is the inability to add a key that you don't currently hold. This prevents me from storing a backup key in a safe, for example.

I proposed an alternative scheme many years ago: https://www.researchgate.net/publication/343318317_Privacy-a... . By allowing "offline" keys you can also treat them as higher priority, and use them to revoke any lesser keys from attackers if your account is compromised.

It would also be nicer to get rid of usernames, but that's a fight against the data-gathering powers that we're unlikely to win.

The author talks about the problem with using hardware keys, but they neglect to mention that many websites and apps simply do not allow the use of hardware keys! They will insist you use Apple or Google syncable keys. So after you have spent the money to buy 2 or 3 hardware keys, you find that they are not accepted.

I don’t like how tokens have gradually evolved from a secure 2F device that you carry with you (Yubikey etc) to a single factor “passkey” that’s built in to your computer/phone, or worse, a password manager with export capability.

It should always have remained a second factor device. It’s not impossible to teach people to use these, European banking did it for years. There’s just no will to do it.

Passkeys are great in that its turning login support on websites into simple "autheticate your device to seamlessly login". My biggest gripe is that it seems Apple/Google are using this to consolidate control into their own password ecosystems and don't support password managers as a store for passkeys.

Account lockout as the author mentions is the biggest risk on personal accounts.

Passkeys just make it harder/riskier.

They really are bad. Passkeys have turned out to be just another password that you cannot even memorize.

Passkeys match a very unique situation where I don't want to store anyone's email address, don't want them to type anything, generally want to store as little information as possible. Also don't want it to be easy for people to share/steal passwords/accounts, and prefer storing on the local device.

Windows still required entering a local PIN, sometimes 2-3 times. I think the account recovery didn't scale, though haven't really tested/explored with any real users :)

The point about Google or apple or your passkey manager banning your account is a reason I'm still using random passwords in Keepassxc. I don't know if there is an open source passkey manager that syncs across devices that is self hostable.

Anyway, companies should be educating users more on passkeys, how they work and where they get stored.

I love passkeys as a tech enthusiast with a password manager that can hang on to them but I don’t love them as a confusing user experience for the average joe.

I also don’t love how many websites and apps use them in stupid ways like using them alongside other 2FA or login methods when the passkey alone should be sufficient.

I hated them at first, but since I am already dependent on iCloud Keychain to manage my passwords, I just figured there is not really any additional risk. I just make sure I will always have multiple, healthy devices, which are always patched, charged, and sync'ed. And don't put them all in the same physical location at one time.

> When storing passkeys in a password manager like Bitwardenor KeePassXC, you end up fighting the platform

I must say it's pretty amazing how well-integrated is Bitwarden with iOS now, passkeys, password generation, everything. I have disabled Apple passwords manager, and Bitwarden feels like the native solution.

> By design, you cannot create a backup of passkeys on a hardware key

In fact, I think it's technically possible. But it's true, as of today I don't think anybody supports it.

I was experimenting on solokeys with ios, in principle we could backup Passwords (the ios/mac app) into a solo key, space permitting, including passkeys, regular passwords and totp (not wifi passwords). I believe the same is for Android, but haven't tested yet. This is all experiments I've been doing on my own, there's nothing ready to be released.

I agree with all the points this articulates. I understand why for many users they are great. But I would prefer better acceptance and continuance of the simpler, unfishable, u2f simple hardware keys.

Just yesterday I was showing to a friend how I logged in my self-hosted forge with my own hardware key.

0 intermediary yet proper and convenient authentication. If that friend ate the key (which he didn't) I'd just use my backup key, a cheaper non biometric one.

I think it's not more popular because people don't care enough about security to buy actual keys, rely instead of 3rd parties that they don't actually trust, e.g. Microsoft, Google, etc then... complain it's not good enough.

> By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts.

> Phishing through the standard login flow is eliminated by passkeys, but it creates a false sense of security. An account’s security is still dictated by the weakest recovery method: SMS, email links, security questions, and so on.

Passkeys are too strong and may cause account loss.

Passkeys are too weak and can be bypassed by account recovery.

Yes, thank you. Maybe I am getting old but password+yubikey/webauthn was really top UX.

> When storing passkeys in a password manager like Bitwardenor KeePassXC, you end up fighting the platform

Very odd. I use passkeys extensively with BitWarden and I love it to the point where it's my preferred way of securing things at this point.

The fact that the website presents the question to BitWarden in a structured way (what website, what username) means that I never fight with selecting the right account to get the password for (because I commonly have multiple accounts for a single site) and it generally makes the login flow much smoother.

Environment is MacOS with Brave/Firefox + iOS.

I agree 100% i learned that my old school with whom I had linked to my windows computer and finished my degree with one day required passkeys rather than passwords on all devices. This force locked my windows PC back to passkey mode luckily I remember recovery account and got a passkey to work. But it took months to figure out why I had to use it. All the help board were said just click this button which was grayed out. Or set this register key which auto repopulated. It was an awful experience. I like my password as default

I just had a very annoying interaction with the tailscale Android app:

It wanted me to log in for some reason even though it had worked fine for months. Login uses my Google log in.

When I try that, Google asks me for a hardware key to complete the login, even though it's my phone and I'm already logged in.

Eventually I figured out that if you select "log in using another device" and then click cancel when it brings up the qr code, you can select a push notification on "another device", which actually pops up on the same device. Do that once and it fails. Do it a second time and it succeeds.

All to use the tailscale app on my own phone.

They’re bad and I wish places would stop being so aggressive about them (I’m looking at you Amazon and PayPal)

I feel like we're solving one security problem while creating another. Passkeys make phishing much harder, but putting so much trust in Apple, Google or a password manager for account recovery creates a pretty significant single point of failure.

I wouldn't mind it if all the services stop working properly when you use a Passkey but still want to use your other stuff like password and 2fa through app...

GitHub breaks with this, PayPal breaks with this...

It's the stupidity of Service Providers to adopt passkeys in the first place.

As a service provider myself, I've evaluated and said "Nah" to passkeys - because it's simply increased Customer Service contacts I have to invest in, whenever a user changes or loses devices, or any of the hundreds of ways Passkeys are not portable.

And guess what, the Tech companies pushing this have zero liability for user login support or security breaches. It's always me. There is no need for me to work hard and spend CS contacts, to wall off my users to the OS or Browser vendor.

I'll simply do passwordless Email or SMS 2FA / Magic Links and own my users without the overhead of Customer contacts, thank you.

I'm was tempted to come in here and say "you're holding it wrong." But then I quickly realized that I had to spend weeks changing my behaviors and messing around with devices in order to get it to work correctly.

As someone who's OpSec puts swiss cheese to shame Passkey has been a godsend. My passwords are actually much better because of it.

That's why I just implanted my NFC passkeys. I've got one in my left hand and one in my right forearm. If I lose access to them, I have other, much larger problems.

Linux support seems really bad, so not very useful for me

If you have to use passkeys, try KeePassXC and KeePassXC-Browser. I used them to set one up for Amazon a few days ago, as Amazon now forces passkeys as of this month, at least for my account. It was relatively painless.

That said, I don't like passkeys either.

My thinking is that Passkey is an extremely good and, in theory, extremely easy solution to security, authorization, and login issues. The problem is that Google, Apple, and Microsoft have done a just horrendous job, and made it suck as much as possible.

They didn't want to cooperate, and they wanted to make passkeys transferable within you cloud account, while not cooperating with anyone or anything else. The result was that you have no predictable and stable pattern/protocol/interface, or even general description, for how, for instance, a website connects to the passkey or even a hardware key, if you wanted it.

We basically have all the browsers, the operating systems, and the password managers, all fighting over who gets to store and present the passkey. And everybody assumes that they are the only one that exists and actively tries to fight the others is they can.

The basic technology is really good and could work well, but the large asshole tech firms focused on self-interest and walled gardens and made it insufferable.

The future of authentication is....CertFP. Basically the same as passkeys, but a based on certificates that you can backup somewhere.

If the browser supports them and stores them securely you're safe as houses even after a breach.

For me passkeys work wonderfully synced in Bitwarden on Windows, Linux, and Android. I have no idea what this article trying to say, except some negative opinion that should IMO be ignored.

They're great when you don't own a phone - when you can't use random 2FA "Apps".

As many USB-security keys can be used passkeys.

Personally I love passkeys and think it’s not deployed enough. It works great (for me anyways!) and it is SO MUCH better than “login with email” that is everywhere now.

I find it annoying that so many apps and websites push passkeys onto users without informing them the basics of passkeys, including how it's associated with those specific devices/password managers or how to prepare in case a device is lost. Meanwhile as a user who uses a password manager to generate a different password for every site and has autofill enabled everywhere, passkeys barely improve my life if not making things more confusing.

Just a small clarification, attackers can definitely steal a passkey from your key store and use it if your corporate settings are incorrect IE. device attestation is turned off.

My company has already responded to multiple breaches where this has been what quickly follows an initial intrusion.

I didn't like the passkeys that were handled by Google and only worked on my phone. But now that most of them support bitwarden they are really convenient.

I just don’t get how passkeys are supposed to be an improvement.

On any site where I create them the login experience gets worse. Sometimes I get a QR code to scan (terrible, almost never works too). Sometimes I am offered to login with passkey which I have and it doesn’t work. Almost always I need to fallback to password and it just sucks.

I hate passkeys. I wish there was a checkbox somewhere to tell all websites that I never want to use them.

Every time passkeys are brought up on HN it’s nothing but complaining and/or refusing to learn the basics about something new, but I’ve been switching to them on every site I can for months with literally no problems.

1Password everywhere, on iOS, Mac, and Windows. I’ve run into none of the issues elsewhere in the comments. Everything just works, including in-app logins.

Maybe your other password managers are just bad at implementing the right browser/OS hooks?

Passkeys are a great way for attackers to have a secondary login into your account (e.g. Outlook, Gmail, etc.)

Ecosystem is not mature yet for individuals?

Probably hundreds of millions or even billion people have devices that support biometric auth. How is that not mature?

> Both Apple and Google want your identity anchored to their operating systems. The “happy path” on their devices is to use their synced passkey management tied to your Apple or Google account.

<sarcasm>On the plus side, this way passkeys can also be tied to age/identity verification.</sarcasm>

I have said before, I'm personally not interested using "Something I have"/"device bound" as an authentication factor. I'm also not interested in the sync "workarounds" that store keys in the cloud.

People have replied it's possible to extract the private key, but it's not clear to me that that's usable (maybe it is I don't know). It's certainly not in line with what passkey devs want people to do and not do, so I'm not interested in "fighting" against the "flow" so to speak.

I'm happy with TOTP, as I can manage and use the codes where I want, under my control.

To guard against lockout, you need to be able to log in from multiple devices. But you don’t need to copy passkeys around to do that! Instead, generate a new one for each device. This is similar to setting up ssh by copying public keys, not private keys.

(Or since syncing passkeys usually works within ecosystems, you might just need a passkey per OS.)

I like using passkeys in bitwarden from Firefox, I just wish it didn't popup a dialog that's usually behind the browser.

The experience is also junk if you're using a password manager, I have passkeys that I'm not sure if I saved to the OS manager or my password manager... mostly my fault but I enter passwords so many times a day it can be hard to stay on top of which UI I'm clicking yes in to store them.

Password managers are great IMO, I can use some absurdly long password, backup is reliable, I can use them across devices. For extra secure stuff 2FA works the same, I've got an app with codes I can easily back up and use from multiple devices.

Passkeys tend to obscure everything and take away a lot of control.

I take passkeys over the unbearable cargo cult that follows LLM companies, namely companies' newly found obsession to "sign in via email".

Ideally optionally followed by a 2FA (naturally, via text, delivered straight to my Mac, even further diluting the questionable security of the whole exercise) and naturally, to be repeated every 2 days or so, since "stay logged in" is the biggest lie after "I've read and accepted the ToS".

Your phone (which is probably what, 80% of relevant traffic these days?) likely has a perfectly fine password manager built in. This "sign in via email" trend must be every scammer and phishers biggest dream come true...

Great writing and points Ethan!

Is there a reason why passkeys couldn't be used in "expire-periodically" mode?

I hate that there's no accepted definition whether passkeys should be considered MFA or not. As a result, some sites treat it as MFA and you just provide passkey and you're in, which I like. Other sites still ask for a second factor after I provide a passkey which I think is stupid. At that point, it's simply another password I can't remember. I should not be prompted for a second factor after I log in with a passkey.

I had to setup a Passkey recently and wanted to store it in 1Password and the experience was quite absurd.

I don't know who designed this or who thinks these are acceptable affordances, but it seem to be part of the same disingenuous push that's behind passkeys in general.

Related: the UX is currently terrible. Every time I go to a website that has passkey flow, I'm presented with: - MacOS native UI; which I cancel; then I see - Bitwarden UI; which I cancel; then I see - Chrome UI; which I cancel;

Like, seriously?

Surprised to see so much hate towards passkeys. I absolutely love them when I can use them with Bitwarden and my own SSO. Sucks when I am limited to hardware tokens like yubikeys.

This is generally the same experience I've had.

Microsoft is especially poorly prepared for this - Often if you have a passkey, it will CONTINUE To ask you to create a passkey (a new and different one), and it may save it in a different place, which is infuriating.

Strong password + MFA is the way, and I don't see that changing.

Passkeys lock you into a third-party provider ecosystem that you really should be trying hard to avoid getting locked into. They also add a quantum safety risk. Stay away.

Passkeys have made my life very easy. Especially using Proton Vault.

If you think passkeys aren't ready yet, blame the people implementing it on their platforms.

I absolutely hate that so many sites are begging me to use them.

I've not yet encountered a site which has even suggested I use something like a passkey. Under the assumption that you're doing the Right Thing, and avoid using Apple, Alphabet and Microsoft's services - this is a non-issue. In fact, even if you use their non-login-requiring services (e.g. YouTube, Bing, Google search) - again no passkeys in your life.

I've resisted passkeys for some of the reasons listed. I use third-party password managers, they're device/system independent, and I can export the data when I want to. I don't see passkeys as a big advantage, or perhaps I should say the bigger advantage isn't really for the _user_.

Of course, at the rate we see security failures everywhere, I'm not entirely convinced writing your passwords on post-it notes wasn't such a bad idea after all.

Eh. Not worth complaining about.

Passkeys work nicely, and I'll use them, in cases where I want decent security, but I don't consider them the "Philosopher's Stone" of regular end-user security. I think they are still a bit too "fiddly" for your average Joe[line].

They exist for sole purpose companies can just shoot the "we have been hacked, but worry not your 'passwords' have not been leaked" email.

It's entirely one sided solution.

passkeys are excellent for security and horrible for usability. We did a students' project on that and decided to not invest on them, yet.

But, hey, here is the new startup idea for you: make passkeys great!

Well I like them, as an option. I offer using passkeys and email interchangeably; if you lose one you can recover with the other. Passwords, SMS, TOTP are out for me.

am i the only one on HN who really likes passkeys?

so much better than fumbling around with a password managers

I went in expecting yet another screed about how passkeys were not issued by RMS in a FOSS encyclical, and therefore not only were they insecure, but they were also a morally bankrupt abomination. I was pleasantly surprised to read an actual thoughtful critique, albeit one I largely disagree with.

The author's assertion that the greatest risk to an individual is account lockout versus phishing or password harvesting is just not grounded in reality. I get phishing emails and SMSs daily. The criminal ecosystem running these campaigns is extremely active already and set to become even more so with LLMs. These campaigns are by far the biggest threat to normies.

Whereas account lockout happens most often with multiple failed password entries, which passkeys completely eliminate. I just don't know where this risk evaluation comes from.

The author also points out that even with passkeys, if you're able to also log in with e.g. security questions, you still have a much weaker security footprint for that account. This is true, but it's also true of a TOTP second factor. So I'm not sure what the criticism is here.

The exportability argument is a real weakness and something I'd like to see addressed. Passkeys don't have an equivalent for backup TOTP codes that you can just write down somewhere or trivially store yourself. But it probably wasn't in v1 because the people who designed passkeys figured that websites would not go all in on them immediately and would preserve other authentication methods, which is exactly what's happened.

I don't like attestation. That is dangerous to user freedom. I don't mind other parts of this technology.

Attestation already destroyed user freedom in mobile app ecosystem. You can't just implement your version of some mobile banking app or whatever just by using original app's API, because dark overlords of gated app comunities allowed app authors to prevent this on OS level by giving them attestation tools.

using them with 1password has been pretty effortless. 'want to add the passkey' sure why not. 'want to use the passkey?' sure why not. for me it works across devices/os/platform so not sure what the big gripe is tbh.

Passkeys suck because only the wealthiest 5% of the world is all-in on one ecosystem (such as Apple) while the remaining 95% uses a Windows laptop, an Android phone and (for the top 5-35%ish) maybe an iPad. All of these OSes push hard to get you to store your passkeys with THEM so it ends up a shitshow with everything scattered everywhere.

And why do the OSes push for this so hard? Because the goal of the execs is lock-in and control. And their lackeys here on HN who implement this stuff and their families are the 1% who are all-in on one ecosystem so they arrogantly believe "this all works great and the masses are just too stupid to get it".

Two crucial things you can do with a password that you can't do with a passkey:

1. Write it down on a piece of paper and put it in a safe deposit box.

2. Read it on one device (or from a piece of paper!) and enter it manually on another device.

Plain text is the ultimate form of cross-platform portability. Passkeys are the ultimate form of vendor lockdown. The passkey vendors won't even allow you to view the private key, unlike with ssh keys, which you can also write down on a piece of paper. It's vendor cabal to destroy computing freedom in the name of "security", always the excuse. Tech company paternalism at its worst.

I hate them, mostly because I am forced to use them.

They provide crappy usability, they're expensive, they're easy to lose, you can't use the physical keys when doing remote desktop access.

My job requires me to use them. I use only for the job and nothing else. For sites requiring 2FA, I use TOTP (time-based one time passwords) from KeePassXC.

Username and password was a predictable flow. Passkeys are just a small component in the modern obstacle race of logging in. Every few months a new credential or ritual to access your own resources .

I absolutely hate them and avoid them everywhere I can. I'm not bound to a single device or I don't want to get bound to some, and some pages quit your option with a normal password login after setting up a passkey. Absolutely frustrating.

These are the four flaws with Passkeys I've found after implementing them on our website. I actually like them now. But, It made me discover why people dislike them. The vast majority of problems are _the way websites implement them_ and _the way password managers today_ work.

Website problems:

* First big problem: you try to kludge them as an "add-on" to a password or SMS "2fa". Just rip the band aide off and let people go 100% passkey by default. It's actually really easy for users. We do a push at the end of their onboarding flow and have a 95% conversion. Users love it and its seamless.

* Don't make people enter a username. Just have a "login with passkey" button first, and thats it. If the HIPPO in your organizations insists a username-password still be available, make the user navigate to a secondary page first to do so. Make the passkey the first-class citizen.

Password Manager problems:

* Google, Apple, Microsoft are trying to lock people in to proprietary password managers. Microsoft's password manager, plus their "microsoft account" experience is a steaming pile of shit. The key here would be portability. An export format exists for the public key (thats how enrollment works): It's a but of digits in ANSI X9.62 format. Not hard. The private key would be an unbelievably simple export.

Protocol problems, and I'm happy to be wrong here:

* The client does not sign the server issued nonce (aka the 'challenge') during the authentication flow. This is kinda weird IMHO. Technically, yes it is secure, but it relies solely on the TLS channel heuristics. It'd be much better to have the client prove the signature on enrollment as layered security.

To address the author fears on attestation: This is a real threat to users... imagine a website "only accepting passkeys from OUR password manager". Luckily, Apple has done us all a favor and outright killed that part of the protocol by refusing to send this required fields there, protecting all users.

Overall, you should use them. We need one tiny change to the protocol and better password managers.

As someone who uses a single password manager on my computer and phone, I don't see the problem with passkeys. I use Safari on both and I never even had to "set up" anything.

I can see why they would be problematic for people who otherwise live life with a single love2025 password though.

The article asserts with little proof that lockout risk is a big problem. But consumer sites themselves basically 100% of the time have a recovery path that amounts to a SMS code or emailed code.

The only part that is very persuasive is the part about storing your passkeys with Google or Apple integrations, and what happens if they ban your account. But the same argument would apply if you’re only storing your passwords in a Google or Apple password manager.

I use passkeys and I always store them in a password manager I control - but usually I also store another one in the OS on Windows, Apple, and Google. Best of all worlds. Also, I appreciate that idiots aren’t forcing me to “change my passkeys” every 90 months like they STILL do with passwords!