They’re bad and I wish places would stop being so aggressive about them (I’m looking at you Amazon and PayPal)

They exist for sole purpose companies can just shoot the "we have been hacked, but worry not your 'passwords' have not been leaked" email.

It's entirely one sided solution.

Passkeys have a marketing problem where no one is able to describe simply what it is without having to use technical jargon. There's also the problem where each OS tries too hard in pushing this to the face of end-user

It's a key, what else do non-technical people need to know?

Ironically on macOS we used to have an app called Keychain which unfortunately was effectively renamed to Passwords for non-technical users.

It's a digital key.

Unlike physical objects they may reside in a TPM, a software vault, an export/backup, or any combination thereof. You may or may not be able to recover or migrate them, depending on where/how they were made.

Therefore you may need multiple per service, or maybe not. Services which only allow one may end up locking you out with no recourse. You get to find out.

None of this is obvious or self explanatory to normies.

Probably because these caveats and weird behaviours are platform-dependent, not really the passkey’s fault.

Passkeys really are not any more difficult to explain than 2-factor authentication. Anyone who’s currently been able to actually create an Apple or Google account and successfully navigate their devices up to a passkey screen will be able to grok how it works.

People around here really ought to stop thinking users are complete idiots. Hell, you don’t even to scroll that far to read people calling users “normies” for crying out loud. What is this? High school?

Do you know how many Google and Apple accounts my boomer parents have?

Roughly one per smart-phone that they've ever used. They don't know the passwords or even the email address of any of them, not even the latest.

Tell me how passkeys makes this any worse. If one's digital life is a mess, there's no magic solution to it.

That's false. It's a digital key and it doesn't matter where it's stored. My key is on iCloud and it can be unlocked with my many recovery methods and contacts https://support.apple.com/en-us/102641

As for normies, passkeys or passwords it doesn't make a difference. Either you have people who use love1969 everywhere or those who constantly lose their passwords.

All passkeys accounts for normies require an email or phone number, which is what you can use to recover a password or passkey exactly the same way.

The keychain and passwords app are separate and keychain still exists

I always operated under the assumption that the passwords app was just a more casual view into the keychain

Maybe that's a bad assumption

Passkeys are passwords your second device makes/types for you, without you ever seeing it.

My bigger problem with passkeys is how there's no universal way to register more than one device (in case the first one is lost).

Proton Pass. I moved to it and love it.

This burden is on the site using passkeys. There should be some equivalent of “My Account > Security > Passkeys > Add Passkey.” There often isn’t, which is an incomplete implementation. And yes it’s frustrating.

Imagine a password, but it a) types itself for you and b) detects when it's being sent to an impostor site and blocks them from seeing itself, so it can't be phished.

Tada, passkeys.

Cool, where are they stored? (I know the answer: 'it depends', and that's the big problem with their usability: most users haven't a clue what the answer is and most tech support can't answer that question straightforwardly because it depends on some decisions the user probably didn't even realise they made).

In a secure vault on your phone

So if I drop my phone to the toilet, I will forever lose access to everything? Since the vault is on my phone.

A majority have more than one phone. Or at least they can get a new SIM card and sign into the iCloud account. Then all passkeys are synced from cloud.

Yes, if you are edward snowden then not for you. For rest of us - it is useful

A majority have more than one phone?

Idk how much money you must be having, but all of my bubbles only ever go with one device

This is crazy. I have one phone and zero iCloud. I don't think I'm that unusual.

You are exaggerating. If the loss or lockdown is so bad then many would have stopped using any of icloud or google equivalent. People are able to depend on it. People are able to repair and use phones even when it falls into abyss.

How do I use it on my desktop or laptop then? What if I switch browsers on my phone? What if I get a new phone? What if I change from android to iOS or visa versa? What if I need to log into the site on my Wii U's browser?

How do I use it on my desktop or laptop then

What if I switch browsers on my phone

What if I get a new phone

You can let Apple sync your passkeys between devices using iCloud Keychain. Then you can create a passkey on one device and have it available on all of your devices. Google also syncs passkeys to the cloud and lets you use them on Windows (with Chrome)

What if I change from android to iOS or visa versa

I resolve this by storing most of my passkeys in my password manager. I still store the "important" ones (like online banking) in my phone so a password manager breach doesn't make me lose my money.

What if I need to log into the site on my Wii U's browser?

Passkeys were designed to let you have more than one, so if you have a device that doesn't let you use your password manager, then just set up another passkey.

Apple can sync to my wii u?

Nothing wrong with your answer itself, but having to be Apple or Google is a PITA. These account are ultra critical already and you will want maximum security to access them.

This means if you go on a trip somewhere you absolutely need two devices. If you kill your phone and want to buy another one ASAP, you wont be able to do anything with the new device until you can convince the platform it's you. With passkeys you're just SOL. Imagining if you needed a phone to get back from your trip - e.g. etickets, auth needed etc. - it becomes a nightmare scenario.

A third party manager makes it easier, but it's a lot less usable that the first party ones.

Reasonable people make different life choice, having to constantly think about backup strategies whenever I'm away from home would be so stress inducing to me.

On my keychain in a USB hardware token. With a couple of backup tokens in fire safes.

If you're using a USB hardware token your knowledge of it is at least an order of magnitude better than the median user's. I know where my passkeys are stored, I don't know where my family member's passkeys are stored and neither do they. The same is true for most of my otherwise fairly technical co-workers.

There needs to be industry and government leadership on this to gradually require hardware token usage, for at least critical financial and government applications. Right now everyone is putting their energy behind passkeys, but those are much harder to understand than a physical token. I don’t know any non-technical people who understand how passkeys are normally tied to the device (or the manufacturer-provided cloud account in some cases), how to set them up on a second device, why you might want to do that, etc. And many technical people still don’t get it either!

Then that family member does not worry like you do worry. The main point is assuming one can have a proper security for Google account - everything else becomes easy.

The fearmongering of losing google account should stop. Yes, some people lose it. There are a larger proportion losing/getting pwned by repeat use. For the majority - just pressing the fingerprint to access an account (like amazon/eBay) via passkey is great.

Fairly technical co-workers - I used to suggest them to buy USB security key few years ago. Now that same fairly technical some how has at least 2 devices with them - so they just skipped the USB security key need - and just use Google (in Android) or iPhone in Apple ecosystem. Everything just works.

Yes, there will be a poor soul that may lost everything with only one device.

People keep their entire lives in cloud accounts these days. Their passwords, financial history, copies of important documents, baby photos, etc. Losing access to it is incredibly disruptive and may result in unrecoverable losses.

It shouldn’t be this way, but it is.

Then that family member does not worry like you do worry.

Until they lose access to that account and then it becomes my problem to solve.

This is a different issue. Not everyone has a data engineer - know it all as a family member.

And you need to accept it works for millions.

The biggest issue with passkeys is that since most USB tokens that support them don't allow syncing the private key to a backup device you have to enroll ALL of them to every site that supports passkeys. This is annoying but it makes storing backups in secure offsite locations impractical.

This is a fair criticism and needs work, I have some short thoughts on it here: https://news.ycombinator.com/item?id=49755217

It's beyond annoying. It's creating needless toil that no "normies" will ever actually do.

I'd love a hardware sold in multi-packs and "born" at the factory with identical internal device key encryption keys (DKEK). I'd love, even more, if a token just allowed you to "commission" new ones w/ a user-specified DKEK on first use.

I'd use one token as a daily driver and store the other(s) in safe location(s), empty of my personal key material. (Or, if I can just commission a new token w/ my DKEK, store a printed copy of my DKEK in a safe location.)

Give the token a mechanism to "type" a backup of its internal state, encrypted with the DKEK, as a USB HID keyboard. That gives me an easy way to backup the token each time I enroll a new website.

If I lose my daily-driver token I just pull a spare from storage, import my last backup, and I'm up and running.

That would kick ass. No "You just need to buy two tokens and enroll them in every website" bullshit.

Maybe each token also needs a second key, with the DKEK used for authentication and the second used only for revocation. The main reason not to reuse the DKEK is so a lost key can be easily decommissioned.

You would need some out of band way to collect and save your key IDs and publish revocations.

I’m not sure if this would work from a security theoretic perspective, need to think about how the request is signed and transmitted so someone can’t fake a key being “alive” when it’s really “dead”.

I do agree this would be incredibly useful if it can be made to work.

I haven't used a FIDO2 token other than playing around with it on a Yubikey. There, at least, I have to have the PIN to unlock the Yubikey before I can use the FIDO2 credentials (if I'm remembering correctly).

Are there hardware token implementations where mere possession of the token is all that's necessary to use the passkeys stored on it? That's incredibly stupid, and should have been disallowed by the standard, if that's the case.

But how do I type it into my new phone?

It depends.

Are you part of the 99.99999% users of one of iOS+Apple or Androidlike+Google/Tencent or HarmonyOS+Huawei? If that's the case, you don't need to as the key is automagically saved by your OS' platform and synced with your new device.

Otherwise, you're such an extreme outlier that you probably either know what you're doing or can find out by yourself, right?

That's the main thing I wish was done better. There was barely any actual lead up from the perspective of an average person. Just a new unfamiliar flow on half of the login screens that they use.

Sure, its explained. But not in a satisfactory way that would reach all users at their level.

This is a bit of an exaggeration and out of proportion, but I think my ideal would be one of the big tech companies should have bought out something like a super bowl ad. Something that actually conveys the idea "hey, we know you've used passwords since you were able to type on a keyboard, but here's new technology that's better and here's why" in plain language that the average person can understand.

Unfortunately, XKCD 2501 continues to be relevant. [1]

[1] https://xkcd.com/2501/

The average person? I have a Master's and PhD in CS, code regularly, and have followed and used all the cool technologies from the days of gopher, telnet and Mosaic to crypto, and lately LLMs. And I still don't have a clear enough picture of passkeys to know really basic things like "what if we have a family computer but each wants to access their private accounts and keep the others from accessing?", "what do I need do to login from an airport computer?" or "what should I do if my phone is stolen?"

If it's that unclear to me, I can't imagine how it can be to the average user.

The way they explain them is atrociously unclear, borderline negligent for services that nag people to activate it for accounts where they may hold valuable data for their personal lives. And while I don't want to spend much time finding out the details as long as I have the option to decline them, I suppose if they can't explain it and convince people of its advantages, it's because it's just bad tech.

Surely it's a pretty easy pitch to average Joe: Using a passkey takes the place of typing in a code they sent by text or email.

That's a pain point in everyone's day that should make the benefit easy to understand.

ok cool so when somebody logs into a site on their phone and sets up a passkey, then goes to their laptop and tried to log into the same account, how do you easily explain how to deal with this situation?

I tell people a website is like a payment terminal. Your device is like your debit card. A password is like a PIN on the card. A Passkey is like a chip on the card.

Logging into a site with your device is like putting your card into the terminal. The site can ask for a password the way the terminal asks for a PIN, but if your device supports Passkeys, that’s like your card having a chip, and it’ll use that instead.

So think of Passkeys like using a chip card.

I dunno how well this analogy works down to the last detail but it has gotten it across to all the parents I’ve used it with

Is there a reason why passkeys couldn't be used in "expire-periodically" mode?

Then how do you log in? Not all sites let you keep password logins after.

Then passkeys are a guarantee of account loss, if there is no reasonable way of recovery.

What benefit does that give you? Passkeys cannot be moved, by design. So for the website, recieving the same one means you're talking to the same device, always.

The purpose of rotating passwords is to cycle out potentially compromised ones, due to phishing attacks, keyloggers, shoulder snoops, etc. But those cannot exist with a passkey.

Doesn’t this mean that a compromised device with passkeys on it is worse than a compromised password since the passkeys can’t be rotated? I feel like the answer is obvious so there must be another angle I’m missing

They really are bad. Passkeys have turned out to be just another password that you cannot even memorize.

just another password that you cannot even memorize

there's some issues with passkeys, but not being able to memorize them is a feature

So where do I keep my pass keys is the problem. They are in my password manager just like another password. So what's the point of having them because effectively, the passwords in the password manager and the passkey in the password manager offer the same UX to me? Except that at least I can memorize a password by heart just in case.

They are in my password manager just like another password. So what's the point of having them because effectively, the passwords in the password manager and the passkey in the password manager offer the same UX to me?

same ux, different security properties.

Except that at least I can memorize a password by heart just in case.

"just in case" should be a thought out recovery flow, rather than hoping that you remember the password of the account you need to access.

The password is the recovery flow. What do you propose instead that isnt just a variation of having a password and a passkey?

a memorized password is not part of a well thought out recovery flow.

double triple emphasis on "memorized"

Ok, I write my password down. Now what?

While the technology itself may be great (I don't really know since I don't use them) it has been co-opted by the tech conglomerates as another form of isolating and walling off users into their ecosystems.

And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".

It’s a bit ironic that Apple is the one that lets you export them.

They're also not supporting device attestation which would allow websites to insist on particular implementations of passkeys.

And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny.

The reason is the ever increasing number of hijacks of social media presences and code hosting portals, with the latter being a serious financial threat. Done right, passkeys stay in the Secure Enclave, at least for anything Apple and most of the Android sphere. There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).

There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).

Click "I lost my device", enter contact, get a reset link via email/sms

Email and SMS are not reasonable and both have an extraordinary number of flaws.

So use the recovery codes. Or scan the QR code and auth from another device

I’d buy that there are too many different confusing ways to recover from this situation, but not that it’s impossible

Exactly. That's why I'll never use passkeys: they're just another way to force us into a commercial walled garden.

Passwords with 2FA are simply better and more freedom friendly.

I just bought a passkey... It's a USB device, completely separate from any big conglomerates.

But then you need to phisically carry it along with you everywhere you go, if you want to log into a service :/

And hope you don't lose it, or leave it in a pocket when you do the laundry, or plug it into a faulty USB port that zaps it, etc.

My yubikeys have survived dips in the ocean, spilled beers, run over by cars, dropped in pans of used motor oil, left out in thunderstorms, and multiple trips through the washer and dryer. They're still fine even after a decade.

Yes, it’s like a key. :)

Though realistically I use a passkey for services I care about and a password manager for the rest.

Keys can be copied very easily. It’s one of their primary features. Can you easily copy your USB key?

Yubikeys are Secure Enclaves designed to not be copyable

Physical keys can easily be copied, and physical locks can easily be picked. That might be fine for your house or storage unit, but for your bank account or your car (newer cars no longer have simple physical keys/locks), we've moved beyond that tech.

That any and all physical security measures can be defeated is a feature, not a bug. Almost no human beings actually need that level of security, and the tradeoffs are absolutely not worth it for those of us without Mossad as a threat.

How often do people lock themselves out of their own house? Don't you know anyone with ADHD? Imagine any time that happens it is mathematically verifiably permanent as a fact of reality itself. It doesn't matter that the state still views you as the legal owner, you are never allowed in ever again.

How do you see passkeys as a walled garden but not 2FA? You presumably store your 2FA seed in a password manager.

I store my passkeys in KeePassXC and I have absolutely no feeling of being walled into any garden, personally.

Wait until websites start demanding device-bound/attested passkeys. Big tech just needs to get enough adoption to make this change.

but what do passkeys offer in terms of security, when stored in password managers, compared to having a (password manager) generated password and a totp?

I believe that by allowing password managers to store passkeys, the whole purpose of "device based security" got lost..

Yes, thank you. Maybe I am getting old but password+yubikey/webauthn was really top UX.

What prevents passkey being used alongside password (+ email 2fa)?

Email 2fa otoh is the worst UX I have experienced. I curse every time Claude sends me a magic link. Absolutely hate them.

You don't like not having to worry that they don't store your creds so they can't lose it?

The creds they store hold no value. These creds only give access to their system anyway. They store the email address either way so the situation is no better but less convenient.

They hold no value precisely because they don't store them and send you a magic link! If they stored a recycled password or its hash, then it would be valuable.

Passkeys remind me of ipv6 in that they are a "solution" coming from the supply-side, without (apparently) having done any research in what motivates actual users (and what would motivate them to switch).

<<ducks>>

They make sense as a technology for businesses & their users. In that scenario, the owner of the account is not the user, but the business. It makes sense for the business to be able to place strong restrictions on how & where the user may log in, it fixes a lot of real problems businesses may have thanks to sloppy user behavior, and the business is also motivated to provide a way to fix broken logins. It's a good solution for that scenario.

But for regular end users where services are primarily motivated to take money from those users and lock them into their ecosystems, they are a usability disaster and yet another exploitation vector.

It's one solution for two very different usecases, and it just does not work. There is an approach that could work for end users who own their own accounts, but they need to go back to the drawing board and rewrite the protocol with the assumption that the keystore is hostile to the user's interests. That means strong guarantees on key portability so users can migrate away from hostile keystores, and absolutely no ability for services to restrict the user's choice in passkey provider software.

I think passkeys were made to work in mind with complete idiots (here's a pop-up, tap it, now you have access to website without password, don't think about where it was saved or that it exists at all). I can understand parts of IPv6 like Router Advertisement being like that but there is so much customizability for the user that I can't really see them being similar that way.

Except they never considered that "complete idiots" could lose access to their phone's passkeys.

They did, that's why they sync

Right... just let me pull out my non-existent spare phone when mine breaks or gets lost.

YES. This exactly. I work across multiple devices, some of which are nonstandard/uncommon (Linux, Xiaomi China ROM, ...) and I've NEVER had passkeys work properly - yet everything constantly prompts me to add one. Even if they did work, I'd have to carry around hardware keys or register each computer separately. And the lack of backups if a device is lost/broken is definitely a larger concern for me than being phished of my TOTP keys.

My wife clicked through a Google dialog and suddenly was using a passkey. It absolutely happens, though IMO more to the non technical users. I know what those login dialogs and pop ups mean, and decline them.

(At least til I get around to setting up my new usb c yubikeys!)

I'm convinced that most Passkey adoption is accidental.

lack of backups if a device is lost/broken

Same as traditional physical keys, you don't have a single key, you have multiple ones precisely so that if you lose/break one, you are not stuck and can go to the local locksmith and get another one in minutes.

In fact it's even nicer since you can just re-use the backup key with no security loss by revoking the other one, and buying another key.

For physical keys I don't need to ask permission to be able to make a second or third copy.

Same as traditional physical keys, you don't have a single key, you have multiple ones [...]

I have multiple identical ones.

[...] and can go to the local locksmith and get another one in minutes.

Can I go to the digital equivalent of a locksmith (like a backup software) and duplicate my passkey? Can I do that with only my passkey in hand (without having to do anything to the corresponding lock, or having to contact its issuer), like I recently did with a physical key?

Heh, in the security world, this shows how your traditional metal key is "something you know" (like a password) because it can be copied and many people can know it at once!

So if we are enforcing MFA requirements and allow this kind of clonable key, then we should really require some other factor that is not clonable.

That's the core silliness of this whole passkey mess, IMHO. So many turns of rhetoric and weird compromises, we have cargo cult security and no real understanding of what security level is in place.

Instead of the best of worlds, we can accidentally have the worst of worlds without realizing until it is too late and we're painted into one of those ugly corners.

As someone who uses a single password manager on my computer and phone, I don't see the problem with passkeys. I use Safari on both and I never even had to "set up" anything.

I can see why they would be problematic for people who otherwise live life with a single love2025 password though.

Imagine you lose your computer and phone. How do you recover your digital accounts? This happens every day to someone. The most common scenario being a house fire or robbery.

The same way you recover your account when you lose a password.

Passkeys do marginally improve security against MITM and phishing attacks, but they are primarily for protecting the lowest common denominator from themselves: people who re-use passwords and/or don't use a password manager.

If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.

The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).

how do I log in on a device that I don't own?

Sad reality is that such usecase is less and less common, thus, no one cares about it. I think majority of my friends would not be able to access their email, or facebook or alike, if they were forced to use my computer in emergency.

Which is a trade-off that makes sense for a lot of people. If you have multiple devices, many of which are portable and one you have on you all the time, the need for that is just way lower, so being more secure against commonplace automated widespread attacks is worth it to them.

Many people are moving to only a single portable device that’s easily lost, broken, or stolen, without any understanding of backups or fallbacks for their accounts.

And many are moving to virtual wallets like Cashapp rather than banks with a physical presence where you can take out money without a phone.

It’s a bad situation.

Isn't there a workflow where you scan a QR code to confirm the pass key on your phone?

I've definitely done this, but not sure if the workflow was at the OS or browser level.

I'm honestly confused by all the negativity in the comments. Passkeys are great for convenience. Just leave your password login enabled as a backup. That defeats any security benefit, but oh well.

Isn't there a workflow where you scan a QR code to confirm the pass key on your phone?

For people in this position, if they had their phone, they probably wouldn't be logging in on a computer anyway.

There are a lot of reasons why I might want to login on a computer I don't own to do something, rather than to use my phone. Having a keyboard is a major usability benefit for many types of work. Larger screen, printer. Software that is on the machine that can't run on my phone.

I agree with you; those are all reasons I only use my phone for on-the-go messaging or navigation. I'm against the idea that you should have to have a secure (against the owner) connected phone on your person at all times in order to sign in to a web service.

And that sounds fine, until you're traveling and your devices get stolen or lost. How, exactly, are you going to get into your email then, once passkeys become the only means of login? Because that moment is when you really do need to access your email, stat.

What services implement it like this? Don't services usually implement passkeys as a more secure alternative to a password, but password login is still available?

Some sites allow passkeys as an option for MFA, so that could be an issue if the passkey is your only MFA option and MFA is required. But I imagine email would pretty much always be a fallback.

Nothing but a memorized password works in this scenario, right?

The offer a strong protection against phishing attacks that would still get plenty of password manager users: fake websites. A passkey is strongly linked to a domain, so a fake site can't get that credential.

Some password managers will only fill if a domain matches, but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in. I've also seen lots of them do stuff like happily autofill on any prefix of the domain, so your credential for `something.example.com` will autofill into `fake-something.example.com`.

How did fake-something get injected as a subdomain?

Loads of hosting sites do this, username.domain.tld is the most common one.

Some password managers will only fill if a domain matches, but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in. I've also seen lots of them do stuff like happily autofill on any prefix of the domain, so your credential for `something.example.com` will autofill into `fake-something.example.com`.

Why would you trust the very same password managers that don't handle passwords properly to handle passkeys properly?

You don't. The browser handles the passkey matching to the domain which is obviously a better place to do it. There could obviously still be bugs as with all things, but it's much more intentionally integrated into the flow which makes it much harder to bypass.

The browser handles the passkey matching to the domain which is obviously a better place to do it.

I'm not sure why you're making a distinction. In many cases the browser is the password manager.

Right, I haven't seen that particular flaw in baked-into-the-browser ones (probably because they already having secure domain matching code ready to use), but the distinction is that doing the domain check is a part of the spec and standard, so e.g: sites aren't going to break it by changing the log-in subdomain routinely, as has been common historically.

Password managers have had to be permissive enough to work with most websites, and there is no standard for it. There have been sites that blocked the autofilling of passwords and so on as well.

My point wasn't this one particular flaw in some password managers is the reason to use passkeys (the copy/paste point is the much bigger issue anyway), just that it's an example of how relatively brittle the password manager process is. Having it a core part of the spec gives stronger guarantees.

“There have been sites that blocked the autofilling of passwords and so on as well.”

Sites that do this irritate me so much. Ones that try to block pasting and stuff… like somebody intentionally baked that into the site. Who? And what was their rationale? Are they really so arrogant to think people are going to carefully type in some elaborate password not once but twice?

That and blocking paste in fields like bank account numbers and stuff.

Surely somebody here has been asked to implement these mis-features. Please explain what went through the heads of the people responsible for it?

but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in.

I've seen people do this AFK as well, and I'm always helpfully suggesting them the correct way of solving this: verifying the URL again, and if correct, add it to the password manager so it remembers in the future, and never copy-paste passwords on the web. Basically 50/50 if they take the advice or come back after a week asking if it's safe to copy-paste the password into the website, and I try to inform again.

Shockingly, I saw one developer peer copy-pasting a password into a website, but I guess for these people there is no hope.

It should be a big red flag for sure, but the reality is most users aren't going to understand that. They got told to use a password manager by someone or find it convenient, but they don't understand the security flow enough to catch that it's a potential attack, or how to resolve it safely.

Historically I've seen lots of sites do a subdomain shuffle for login pages every now and then which routinely breaks domain matching, introducing false positives that users have to deal with, making them numb to the threat too. Passkeys baking in the domain check with no workaround means that sites can't do that, which is a benefit.

"Oh, usually my bank just logs me in, that's strange. Let me just go grab my username and password and type it into this site that looks like my bank."

Same thing is going to happen with passkeys for non-technical users for exactly the same reason you stated. People will think the integration is busted and manually copy/paste the non-passkey credentials in. In that way, I would argue that passkey is not stronger protection against phishing attacks unless its the only way to login. It is, at best, a convenience for users.

The pitch is that passwords will supposedly be phased out entirely as an option.

how do I log in on a device that I don't own?

This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport). iOS and Android support this, and it’s generally not a locked-down thing if other devices wanted to do it too.

The only use case left is in “how do I login if all my devices are stolen/fall into a body of water” in which there really isn’t an answer beyond “get (a|your) device back, sign back into your password manager, use that to get back into critical accounts”.

What if the computer you want to log in on doesn't have Bluetooth? Probably most public computers (like ones in libraries) don't have it.

The website should display a qr code you can scan with your phone that allows you to then login, unfortunately a lot of sites don't implement this, and some don't implement backup codes. This isn't the fault of passkeys per se, but of poor implementations.

How does scanning the barcode with your phone log you into the computer? Does your phone need network access for that?

If you're not happy connecting your phone to the network, then how likely is it that you would you be willing to enter your login details on a machine you don't control?

Poor people exist.

The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription.

The number of people sharing GP's concerns for reasons of poverty rather than because of their personal security posture will be vanishingly small.

What if you just can't have internet on your phone? Like if the computer is connected via Ethernet and there's no wifi network you can connect to? What if you're abroad and have no roaming? And the ultimate question about a person that the modern world can barely conceptualize - what if you have a dumbphone? Or what if your smartphone is lost or stolen or dead and you need to access some account? That last one has happened to me, and I sure am glad I know the key passwords that I need for survival.

These may seem like nitpicks, but there's probably a thousand rare scenarios like these that exist. You inevitably have to consider them when you're moving from punching in letters and numbers that you remember in the normal, low-tech way to a complex networked two-device workflow.

If my phone is lost or damaged, I would buy a new, cheap Android phone and sync my passkeys to it. But I am curious why one would need to login to a website in order to survive? If one did have say a severe medical condition that somehow required a website in order to manage, I guess I would concede that maybe passkeys aren't the best way to secure such a life-sustaining website.

Passkeys can exist on devices other than phones, so your entire premise is moot.

willing to enter your login details on a machine you don't control?

Are you talking about your phone here?

Steam does this. If I want to login, it shows a barcode I can scan with the app and it logs me in without needing to enter my login information. Phone needs internet access, doesn't need to be on the same network as the device I'm logging in on.

I assume the QR code contains a token for the device, which is used by the app to authorize the login and the server automatically logs in the client on the device with the matching token.

Seems a lot safer to me than using my login credentials on a potentially unsafe device.

what good is a phone if it isn't on a network?

There's a whole set of fallbacks built in to the standard, including Bluetooth, local network connections, and going via a relay server. All of them eventually end up with your device signing something and handing that back to the browser on the other device to complete the authentication flow.

I cannot speak to how accurate your description is, but this description sounds like there are multiple weak points and multiple attack vectors that open this up to increased risk of compromise, undermining the very security stance it's supposed to provide.

AFAIK, the "scan this QR code" method of signing in with a passkey on a phone on a device w/o the passkey requires Bluetooth. There's some type of handshaking that goes on in order for you to prove you're in physical proximity of the device you are logging in on, to prevent phishing attacks.

Is this why I keep getting notifications that such-and-such a website wants access to devices on my local network? I've been denying those left and right lately and didn't understand what on earth they needed access to that for.

The fact that nearly every passkey implementation is lacking in a variety of very impactful ways... is a very good reason to _not_ use passkeys.

When every passkey interaction is a different variety of user interaction nightmare, it's not very convincing that it's a good idea in the first place

The website should display a qr code you can scan with your phone that allows you to then login...

A malicious website can display a QR code too. I think this "feature" could cause some of the security issues that passkesys were intended to solve.

I use Keepass and the free tier of Dropbox, to keep my passwords strong and available across multiple devices. (Dropbox not required, you can store the database on a thumb drive.) Backups are no problem.

Keepass (or KeepassXC) stores other data as well, including the correct URLs for sites. So my workflow is simply to click the URL from within Keepass, copy the username and password, and paste them into the login screen. So easy even an adult can do it! (Humor attempt)

For convenience, Keepass database can be unlocked with either a password or biometrics (your fingerprint).

(Not affiliated with Keepass, just a happy longtime user.)

Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms.

> What if the computer you want to log in on doesn't have Bluetooth?

Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms.

What if the computer you want to log in on doesn't have a WiFi chip?

It doesn't have to be an old computer; for instance, the desktop computer I built last year uses a wired gigabit Ethernet connection to the router right next to it, and doesn't have (or need) any WiFi or Bluetooth chip.

Passkey on NFC/USB hardware token (x2)

They're cheap enough if you lose one it's not the end of the world. Goes on your keyring. Doesn't require esim management. Use NFC swipe/usb-plug-in + pin to use.

The problem isn't the cost of replacing it, the problem is - how do you log in when all your passkey-bearing devices just got flushed down the toilet?

How is that different from accidentally deleting your keepass database? Or forgetting your password? I think it’d be easier for me to forget than find myself trying to flush all my hw tokens…

I can back up my keepass database, and I can write down my passwords.

Its going to be hard to flush my desktop and my laptop down the toilet.

Enrolling two devices stored in different locations for every sign up is extremely annoying.

I suspect that most people that ostensibly do this actually only enroll one for non-critical accounts and then depend on some fallback mechanism.

This is a legitimate problem, and one of the few cases where a third party login provider makes sense, at least for non-critical “apps”. If both tokens can be authorized to that provider, then you don’t need to enroll any more tokens for apps using that provider. The difficulty is creating a trustworthy provider system without weakening security (the provider shouldn’t be able to login without you) that doesn’t collect information about you and which can’t lock you out from all your accounts.

I’m not sure what work has been done on this since Mozilla Persona. I certainly wouldn’t want Google and Apple, or governments, to be the sole gatekeepers.

Why would you choose that over a synchronizing passkey manager?

A third party OAuth provider puts you at the mercy of the service provider, the other can work fully on your client side even if the app provider were to disappear tomorrow.

The only advantage I can think of is that you have a centralized place to revoke credentials in case your password manager does get compromised.

"A third party OAuth provider puts you at the mercy of the service provider" This is they key issue with trusting a third party to manage my passkeys, they can also BLOCK them and lock me out. An exception is if the passkeys are synced to all your devices and cannot be remotely wiped. I think this is how Apple works.

I didn’t think of this in the moment, but you’re right, this is an even bigger risk than compromise. There’s regularly a thread here about someone getting locked out of their cloud accounts, and now we’re going to gate everything behind those same accounts? Horrible idea.

The problem with hardware tokens is that they 1) Only store a limited number of logins, 2) It is very difficult to keep them in sync- every time you need to add a passkey, you have to get them both out, which makes it difficult to keep one a in a secure safe to keep it safe from damage/loss

This two fatal flaws are what limits their usefulness to enterprise SSO and perhaps some other limited uses where the organization has the ability to replace tokens. (Even in a distributed enterprise, enterprise SSO may not be a good fit for hardware tokens, if they can't get replacements out to employees fast enough).

the problem with hardware tokens is that they 1) Only store a limited number of logins,

1) It's one passkey used over and over, so it only takes 1 slot.

2) It is very difficult to keep them in sync- every time you need to add a passkey, you have to get them both out, which makes it difficult to keep one a in a secure safe to keep it safe from damage/loss

2) With SSO used across enterprise exactly like you're talking about, works fine without having to reregister over and over. Been using this and have implemented it myself for years.

3) much cheaper than a phone with a much cheaper recovery path

4) no path is a free lunch, you're always going to be making compromises somewhere, it's the nature of security - it is adversarial

This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport).

Ok but how do I share my Netflix or Spotify accounts for example with those?

In general you shouldn’t - Netflix[0] really should get proper invite-based family sharing, and Spotify’s subscriber agreement has a section that defines Premium as a “Single-user Paid Subscription” and thus can’t be used by multiple people, legally (and you might be at risk of getting banned if they detect it)

However, passkeys can and are available to be shared via password managers. They’re not locked to the secure chip on the device where they live usually. iOS’ Passwords app has a share button and 1Password lets you share passkey-containing items.

In fact, the QR code login feature makes it even easier to do a one-time sign in to your account for a friend, if you don’t want them to be able to login to your account indefinitely.

0: Netflix doesn’t support passkeys because their main audience is people signing in via smart TVs and whatnot, which largely don’t support CTAP or Webauthn in general)

In general you shouldn’

Me to said companies: I will do what I want.

Said companies to you: sounds like what you want is to get booted from our service.

Me: Invents more new ways of being problematic for the company spreading the ideas to millions of others decreasing their profitability to almost nothing.

Me to company: Damn, guess you shouldn't have been an asshole about it, kind of backfired on you.

2FA is lowkey designed to reduce paid account sharing. It's always those services that are so eager to get people 2FA'd. Microsoft Minecraft account is the hardest thing to log into, and they even perma locked tons of people out.

Can't you just share the TOTP secret key?

Sign in with a QR code is dangerous though because at that point theres very little stopping QR phishing and forwarding the bluetooth request to your browser. See the most common Discord scam.

What if my phone is dead? Stolen?

In the same vein as 2fa, going up to a fresh computer and trying to log into anything is now a nightmare. Every service has a 2fa that somehow loops into another provider that also has 2fa.

And some 2fa, if not many, make accounts weaker. Apple's solution to get around 2fa is to put in SOMEBODY ELSES phone number that I trust, as a backdoor. It's an insane solution. And its normalized, and nobody questions it.

While we're at it, the insanity of those "recovery questions", made even worse when many companies demand the same ones.

but you can type anything in the recovery box.

its just three additional passwords.

should you type the same brother name in each time? should you even answer with a name?

don't get me wrong, they were insane, but they can be repurposed.

Good luck remembering what you put there when asked 10 years later.

My MIL setup a passkey accidentally on her Google account and now has no idea where it is. Removing it now requires her password which she’s also forgotten. But now for some reason on Google I can’t initiate any type of forgot your password flow because of how Google sets up things and I have zero clue where she stored the passkey.

Doesn't the passkey have to be on her phone or computer?

It should be but haven’t checked her apple vault. I checked Google password manager and her windows password manager and there nothing in either. She might have used her phone and it’s in her iOS vault which I’ll check next. But this is what makes this entire passkey thing a mess. She’s 75, she didn’t do this on purpose and the ecosystem is just a mess

Even the concept of "where on the PC" has been totally annihilated by OS vendors and app developers. Is it on the filesystem? Is it on The Cloud? Is it vaguely "In An App"? Is it in some "Secure Enclave"? Who the fuck knows anymore? And the apps are no help--they insist on blurring the lines between local and cloud, hiding full paths, and generally just saying "Don't worry about where your data actually is. We pinky swear to be able to find it for you!"

Windows prompting her about Bluetooth for the pass key threw me too. I thought for sure she had clicked the wrong thing before I realized that somehow her widows pass key requires communicating to some device? Maybe her phone? No idea

Everything about it is.

Also in the process of helping my dad with his phone, 76 and my grandmother 99. Maybe this works better with Apple, but the biggest problem on Android is, that it feels like every update shuffles everything around. Allmost no point in explaining, that they can solve some things on their own.

And all the time new things on the screen, new features they don't understand, need nor asked for.

Im young and I dont even bother learning how to use my Android phone's new features since it feels like everything moves or changes all the time. there's no point trying to get familiar with most of the features.

if any android pms or execs read this comment, it should be like a slap in the face. a scathing indictment of the state of their product.

just hang their heads in shame and walk into the sea

Apple does seem to have one of the best and most secure passkey implementations.

They seem unnecessarily opaque about it all.

I just made one for PayPal using my MacBook which seems to have ended up in Bitwarden rather than the mac thing. But there's nothing in Bitwarden to say list all passkeys. Not sure how I check elsewhere. Maybe they should email you "you have created a paypal passkey in Tim's Bitwarden" or something. Then at least you could search the email for "passkey"?

I wonder if I can use Bitwarden on another device with that? I honestly don't know.

Ran into the same issue with my dad the other day. Has a passkey set up on his Google account. Bear in mind that he doesn’t know what a passkey is, so Google obviously sent him through a pattern at one point to get him to create one.

He didn’t have access to it the other day and we needed access to his account. He didn’t remember his password, and we were unable to reset it because you need the passkey! No other options to authenticate for a reset were available.

Add in the fact that I was trying to help him with this by long distance call and you can imagine the frustration.

As someone with elderly parents, the Googles and the Microsofts of the world really don't seem to give a shit about the elderly anymore, if they ever did. Random UI updates and workflow changes with no announcements, thinking they're "intuitive."

One of these days the product managers who push these things thinking "oh, it's easy, you just . . ." are either going to be explaining it to confused Mom or Dad, or they're going to be elderly and irritated themselves. Until then I hope they stub their toe or step on random Legos regularly.

I'm not even elderly but I would really like an e-mail client with a stable UI. I used to like Apple Mail but it's been a buggy mess since Catalina. It doesn't even sort or search mail reliably any more. It's basically a trope at this point but a robot-rewrite-in-Rust seems inevitable at this point.

A while ago I helped an elderly relative migrate off off a copy of Eudora that they'd been using for many years. (To Thunderbird.)

Originally it was about difficulty migrating to a new laptop with a different version of Windows, but I was quite firm about it because when I realized it wasn't able to do secure connections for some reason, so the instant they took their laptop to public Wi-Fi...

I set my father (late 70s) up with a physical passkey (yubikey), and a backup key. He uses it for the important accounts (google, apple, bank, etc).

It’s been fine.

Yep, I've never had Google, PayPal, or Amazon ask me about a passkey with a yubikey.

how do I log in on a device that I don't own?

You scan the qr code from your phone and it logs you in on that device. The experience is pretty amazing, honestly.

Passkeys do marginally improve security against MITM and phishing attacks ...

The tragedy of passkeys is that they're a step back from the security offered by the likes of Yubikeys.

But because passkeys are pushed by both Google, Microsoft and Apple: there is is simply no fighting these three. It is impossible.

Passkeys won not because they're better (they're not and the entire concept of "secret behind a hardware security module" that can be transferred to another system defeats the whole point of a HSM in the first place) but because the powers-that-be decided that passkeys are to be used.

It's still a win: the commoners are better served with passkeys.

But a secret in control of Google/Apple/Microsoft that can be backed up is not a secret I control: it's a complete step back from yubikeys.

Passkeys won and we better get used to them (and, yup, there are usability issues as you mentioned).

The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for.

My irritation is that I know what it is, and I've said no thanks many times, but I'm still asked regularly by the likes of Amazon, and they usually pick a time when I'm trying to order something quick¹. It is one of the growing number of things in life that simply have no “no” option, it is always “yes or later” - I wouldn't mind so much if “later” meant “I know the option exists, I'll ask for it if I change my mind, don't bother me again otherwise”. Call me cynical, but if companies are trying to nag me into something I very much doubt the main benefit is mine. I'm sure there are many people out there who go along with it simply because they are sick of being asked repeatedly.

I also don't see the real benefit with the way things are often implemented anyway. When the credential recovery process is sending a magic email or text, making SMTP or SMS the weak link of the chain just as it often is for passwords so I'd be giving up my preferred workflows for no better security.

----

[1] A short while ago I actually ordered from somewhere else because of this, bitter twit that I am. “I wonder if I can get this almost certainly drop-shipped item on next day delivery via Prime?”, [goes to Amazon to check], [get passkey prompt], “sod it, I'll go back to the original place”.

I dropped Amazon entirely a couple years ago because they didn't provide any way at all to separate my credit card from my kid's Fire tablet and I didn't want to be on the hook for thousands in charges because he pushed the wrong button. It's remarkably easy! It has made basically no change to my life except that I'm a little smug about not using Amazon.

What do you use instead? My main reason for using Amazon is the shipping which no one else can come close to

Same or next day shipping on most things I order is wild, when something goes beyond a 2-3 days on Amazon it even feels odd

And the “do you actually need the item/s that fast” isn’t the response I am looking for

Target/Walmart/BestBuy. They both have fast shipping options as well as store pickup. Sometimes (if you live somewhere more rural) they have _faster_ shipping times than Amazon.

Home Depot/Lowes often have faster delivery than Amazon (like literally delivered in a few hours or next day morning).

Could you create a separate account for the tablet without that credit card? Just curious.

but then how do you pay for things if/when you want to buy the little one something?

you either add the card then remove it, get a separate card, or find a way to use credits somehow -- but in the case of the latter two, Junior could still slam a few buttons and eat up all available funds on that card -- just without the impact of your regular card.

Just use a bank with a decent service (like Revolut), create a separate card number for your kid (10s within the bank app), where you put more money when needed and can easily put the number on hold or activate it whenever you please.

My irritation is that I know what it is, and I've said no thanks many times, but I'm still asked regularly by the likes of Amazon

The people responsible show a distinct lack of understanding when it comes to consent.