The point about poor support for 3rd party managers is so frustrating. Because this is correct, that is the obvious solution for the normal user, but passkey implementations somehow do not know how to deal with it.
Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.
And the confusing mechanism hurts there too: I'm always a little bit afraid that i'm somehow more in danger because I keep them in a vault that's shared on all my devices rather than a TPM, because whenever the protocol is explained the "it can't leave your device" part is highlighted as the main source of the security, except.... mine obviously do leave my device, with the vault, so.....
Yet, the Apple + Google implementations will sync passkeys between your devices. "Securely", of course. (I've seen first hand how Apple implements this, and it seems.... sound)
Sites can request hardware-bound tokens, which would block any software based password managers. It's an option in the protocol but one not yet widely utilized.
Passkeys do marginally improve security against MITM and phishing attacks, but they are primarily for protecting the lowest common denominator from themselves: people who re-use passwords and/or don't use a password manager.
If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
Sad reality is that such usecase is less and less common, thus, no one cares about it. I think majority of my friends would not be able to access their email, or facebook or alike, if they were forced to use my computer in emergency.
While the technology itself may be great (I don't really know since I don't use them) it has been co-opted by the tech conglomerates as another form of isolating and walling off users into their ecosystems.
And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".
> And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny.
The reason is the ever increasing number of hijacks of social media presences and code hosting portals, with the latter being a serious financial threat. Done right, passkeys stay in the Secure Enclave, at least for anything Apple and most of the Android sphere. There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
Passkeys have a marketing problem where no one is able to describe simply what it is without having to use technical jargon. There's also the problem where each OS tries too hard in pushing this to the face of end-user
Imagine a password, but it a) types itself for you and b) detects when it's being sent to an impostor site and blocks them from seeing itself, so it can't be phished.
Cool, where are they stored? (I know the answer: 'it depends', and that's the big problem with their usability: most users haven't a clue what the answer is and most tech support can't answer that question straightforwardly because it depends on some decisions the user probably didn't even realise they made).
Not always. And which vault? There can be multiple on a given device. This isn't some hypothetical 'mollify the user's worries' question, this is an important practical question of what do they need to worry about losing access to. Trust me when I say that most users I have talked to have absolutely no idea about this, and usually only find out when they've already lost them.
Unlike physical objects they may reside in a TPM, a software vault, an export/backup, or any combination thereof. You may or may not be able to recover or migrate them, depending on where/how they were made.
Therefore you may need multiple per service, or maybe not. Services which only allow one may end up locking you out with no recourse. You get to find out.
None of this is obvious or self explanatory to normies.
Probably because these caveats and weird behaviours are platform-dependent, not really the passkey’s fault.
Passkeys really are not any more difficult to explain than 2-factor authentication. Anyone who’s currently been able to actually create an Apple or Google account and successfully navigate their devices up to a passkey screen will be able to grok how it works.
People around here really ought to stop thinking users are complete idiots. Hell, you don’t even to scroll that far to read people calling users “normies” for crying out loud. What is this? High school?
They're separate stores. I was under the same assumption until I tried to use `security` to get a saved password. It doesn't work, and as far as I know there is no CLI for the Passwords app's store.
That's the main thing I wish was done better. There was barely any actual lead up from the perspective of an average person. Just a new unfamiliar flow on half of the login screens that they use.
Sure, its explained. But not in a satisfactory way that would reach all users at their level.
This is a bit of an exaggeration and out of proportion, but I think my ideal would be one of the big tech companies should have bought out something like a super bowl ad. Something that actually conveys the idea "hey, we know you've used passwords since you were able to type on a keyboard, but here's new technology that's better and here's why" in plain language that the average person can understand.
Unfortunately, XKCD 2501 continues to be relevant. [1]
YES. This exactly. I work across multiple devices, some of which are nonstandard/uncommon (Linux, Xiaomi China ROM, ...) and I've NEVER had passkeys work properly - yet everything constantly prompts me to add one. Even if they did work, I'd have to carry around hardware keys or register each computer separately. And the lack of backups if a device is lost/broken is definitely a larger concern for me than being phished of my TOTP keys.
My wife clicked through a Google dialog and suddenly was using a passkey. It absolutely happens, though IMO more to the non technical users. I know what those login dialogs and pop ups mean, and decline them.
(At least til I get around to setting up my new usb c yubikeys!)
Passkeys remind me of ipv6 in that they are a "solution" coming from the supply-side, without (apparently) having done any research in what motivates actual users (and what would motivate them to switch).
I actually prefer non-resident U2F in some ways. You don't have to store anything on your key, you are just signing requests. This is relevant where U2F/FIDO keys have limited slots for 'resident' keys.
In principle, it's great. You have one good password to remember for the average user, and that's enforced by their device's probably good enough security posture.
They are resistant to being phished and they won't reuse the same one everywhere. They then don't end up going from hunter2 to hunter2! everywhere.
But my experience for users is that they worry they are giving their biometrics to Amazon or whoever and so the UX just confuses them.
The certification aspect was new to me too last time passkeys came up. Sites can require that a given passkey has been certified.
The patchy support for them is also frustrating. MacOS does not support NFC FIDO/U2F. iOS does.
Completely agree. I think the root of many of its issues is the inability to add a key that you don't currently hold. This prevents me from storing a backup key in a safe, for example.
I proposed an alternative scheme many years ago: https://www.researchgate.net/publication/343318317_Privacy-a... . By allowing "offline" keys you can also treat them as higher priority, and use them to revoke any lesser keys from attackers if your account is compromised.
It would also be nicer to get rid of usernames, but that's a fight against the data-gathering powers that we're unlikely to win.
I'm was tempted to come in here and say "you're holding it wrong." But then I quickly realized that I had to spend weeks changing my behaviors and messing around with devices in order to get it to work correctly.
As someone who's OpSec puts swiss cheese to shame Passkey has been a godsend. My passwords are actually much better because of it.
If you have to use passkeys, try KeePassXC and KeePassXC-Browser. I used them to set one up for Amazon a few days ago, as Amazon now forces passkeys as of this month, at least for my account. It was relatively painless.
So where do I keep my pass keys is the problem. They are in my password manager just like another password. So what's the point of having them because effectively, the passwords in the password manager and the passkey in the password manager offer the same UX to me? Except that at least I can memorize a password by heart just in case.
I agree 100% i learned that my old school with whom I had linked to my windows computer and finished my degree with one day required passkeys rather than passwords on all devices. This force locked my windows PC back to passkey mode luckily I remember recovery account and got a passkey to work. But it took months to figure out why I had to use it. All the help board were said just click this button which was grayed out. Or set this register key which auto repopulated. It was an awful experience. I like my password as default
Ah yeah, Microsoft has this awful habit of just hiding the buttons for actions you don't have permission to do, which makes me feel like I'm being gaslit sometimes when a guide says 'there's a button right here' and there's not, and I've no idea if the button was just moved or if not, why it's not available (sometimes it's because I don't have permission, but sometimes it's because it's a different product with the same name and branding as a completely different product).
Do passkeys improve security posture for the average person, reducing the likelihood of them losing their accounts to fraudulent actors? Absolutely.
But they also introduce single points of failure, as the article points out. I can't even remember how many times I've had to help a family member recover their account or get confused when they can't sign in on a new device. It's incredibly frustrating that this flow is promoted as the default for so many services.
1password is the best solution I've found for the average person. It's not perfect (it's definitely more complex than writing down your passwords on a piece of paper or using the same password everywhere) but it's much easier than juggling yubikeys. I know so many non-technical staff members who prefer the OS or browser keys even if it means another account recovery is lurking around the corner.
> Maybe I am getting old but password+yubikey/webauthn was really top UX.
It most definitely isn't. Any 2nd factor that is not the device I am currently using (either a yubikey or my phone) has a non-zero chance of not being near me when I need it, leading to the constant question of "where the fuck did I put that darn thing", only to find out that the cat has decided to believe the yubikey is a mouse and tried to devour it, the phone's battery went dead...
I agree with all the points this articulates. I understand why for many users they are great. But I would prefer better acceptance and continuance of the simpler, unfishable, u2f simple hardware keys.
Devices that break or get lost, and then either the user had password authentication activated all the time anyway in addition to the passkey, or they have the classic "mother's maiden name" recovery path, or they get locked out of their account.
Brilliant security: a highly secure high-tech shiny front door that can randomly fail to open, so you still need the low-tech back door, which is the one potential thieves will use.
Mind you, it can work if the back door is old but sturdy (basically, for a bank that will ask for KYC authentication, or in the worst case you can set foot in the brick-and-mortar branch with your ID and physical face and ask for access) but for pretty much every other service it introduces risks for very little or no gain.
Two crucial things you can do with a password that you can't do with a passkey:
1. Write it down on a piece of paper and put it in a safe deposit box.
2. Read it on one device (or from a piece of paper!) and enter it manually on another device.
Plain text is the ultimate form of cross-platform portability. Passkeys are the ultimate form of vendor lockdown. The passkey vendors won't even allow you to view the private key, unlike with ssh keys, which you can also write down on a piece of paper. It's vendor cabal to destroy computing freedom in the name of "security", always the excuse.
The experience is also junk if you're using a password manager, I have passkeys that I'm not sure if I saved to the OS manager or my password manager... mostly my fault but I enter passwords so many times a day it can be hard to stay on top of which UI I'm clicking yes in to store them.
Password managers are great IMO, I can use some absurdly long password, backup is reliable, I can use them across devices. For extra secure stuff 2FA works the same, I've got an app with codes I can easily back up and use from multiple devices.
Passkeys tend to obscure everything and take away a lot of control.
What benefit does that give you? Passkeys cannot be moved, by design. So for the website, recieving the same one means you're talking to the same device, always.
The purpose of rotating passwords is to cycle out potentially compromised ones, due to phishing attacks, keyloggers, shoulder snoops, etc. But those cannot exist with a passkey.
I've resisted passkeys for some of the reasons listed. I use third-party password managers, they're device/system independent, and I can export the data when I want to. I don't see passkeys as a big advantage, or perhaps I should say the bigger advantage isn't really for the _user_.
Of course, at the rate we see security failures everywhere, I'm not entirely convinced writing your passwords on post-it notes wasn't such a bad idea after all.
using them with 1password has been pretty effortless. 'want to add the passkey' sure why not. 'want to use the passkey?' sure why not. for me it works across devices/os/platform so not sure what the big gripe is tbh.
I've seen it. Websites are pretty inconsistent about the flow but I've had a few just try to install a passkey when I log in (amazon does it. Paypal seems to do it but only try to use it on the same browser it was installed on, even if it's synced through a password manager, just to be different. The more reasonably ones have a 'log in with passkey' button but this isn't universal. Microsoft seems to just nag the user on login periodically in their classic 'Yes/Ask me again later' style of 'consent'). You can, if you're paying attention, avoid it actually happening, but the average user isn't going to notice until they suddenly can't log in because they're on a different device. You can see some advocates are pretty vocal about making them mandatory as well.
Every time I login to certain sites (like my health insurance, for one) I get a passkey prompt (system dialog) with no way to keyboard-dismiss, so I'm forced to move my hand over to the mouse and figure out which of three poorly-named buttons to press to get on with the login and ignore the passkey.
It's a minor inconvenience, but happens so regularly I hate it. It also stops the login flow until I dismiss the prompt, which is also annoying as I could've already gotten to the page I wanted to get to in the time it took to dismiss the dialog.
As someone who uses a single password manager on my computer and phone, I don't see the problem with passkeys. I use Safari on both and I never even had to "set up" anything.
I can see why they would be problematic for people who otherwise live life with a single love2025 password though.
Yep, this is typical HN (aka that vocal minority that likes to stroke their own egos pretending to be greybeards or something): complain about how something works ignoring all the ways it is used and implemented correctly and make a blog post about it talking about some nonsense to pretend they know a lot about the thing they are complaining.
Passkeys are great. The Apple passkey experience is seamless. They just work. Anything else is poppycock of the highest order.
The point about poor support for 3rd party managers is so frustrating. Because this is correct, that is the obvious solution for the normal user, but passkey implementations somehow do not know how to deal with it.
Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.
And the confusing mechanism hurts there too: I'm always a little bit afraid that i'm somehow more in danger because I keep them in a vault that's shared on all my devices rather than a TPM, because whenever the protocol is explained the "it can't leave your device" part is highlighted as the main source of the security, except.... mine obviously do leave my device, with the vault, so.....
Yet, the Apple + Google implementations will sync passkeys between your devices. "Securely", of course. (I've seen first hand how Apple implements this, and it seems.... sound)
Sites can request hardware-bound tokens, which would block any software based password managers. It's an option in the protocol but one not yet widely utilized.
Passkeys do marginally improve security against MITM and phishing attacks, but they are primarily for protecting the lowest common denominator from themselves: people who re-use passwords and/or don't use a password manager.
If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
> how do I log in on a device that I don't own?
Sad reality is that such usecase is less and less common, thus, no one cares about it. I think majority of my friends would not be able to access their email, or facebook or alike, if they were forced to use my computer in emergency.
While the technology itself may be great (I don't really know since I don't use them) it has been co-opted by the tech conglomerates as another form of isolating and walling off users into their ecosystems.
And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".
It’s a bit ironic that Apple is the one that lets you export them.
They're also not supporting device attestation which would allow websites to insist on particular implementations of passkeys.
> And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny.
The reason is the ever increasing number of hijacks of social media presences and code hosting portals, with the latter being a serious financial threat. Done right, passkeys stay in the Secure Enclave, at least for anything Apple and most of the Android sphere. There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
> There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
Click "I lost my device", enter contact, get a reset link via email/sms
okay, so now you need access to their email or simjack their phone first.
Passkeys have a marketing problem where no one is able to describe simply what it is without having to use technical jargon. There's also the problem where each OS tries too hard in pushing this to the face of end-user
> Passkeys are passwords your second device makes/types for you, without you ever seeing it.
My bigger problem with passkeys is how there's no universal way to register more than one device (in case the first one is lost).
Proton Pass. I moved to it and love it.
Imagine a password, but it a) types itself for you and b) detects when it's being sent to an impostor site and blocks them from seeing itself, so it can't be phished.
Tada, passkeys.
Cool, where are they stored? (I know the answer: 'it depends', and that's the big problem with their usability: most users haven't a clue what the answer is and most tech support can't answer that question straightforwardly because it depends on some decisions the user probably didn't even realise they made).
In a secure vault on your phone
So if I drop my phone to the toilet, I will forever lose access to everything? Since the vault is on my phone.
Not always. And which vault? There can be multiple on a given device. This isn't some hypothetical 'mollify the user's worries' question, this is an important practical question of what do they need to worry about losing access to. Trust me when I say that most users I have talked to have absolutely no idea about this, and usually only find out when they've already lost them.
It's a key, what else do non-technical people need to know?
Ironically on macOS we used to have an app called Keychain which unfortunately was effectively renamed to Passwords for non-technical users.
It's a digital key.
Unlike physical objects they may reside in a TPM, a software vault, an export/backup, or any combination thereof. You may or may not be able to recover or migrate them, depending on where/how they were made.
Therefore you may need multiple per service, or maybe not. Services which only allow one may end up locking you out with no recourse. You get to find out.
None of this is obvious or self explanatory to normies.
Probably because these caveats and weird behaviours are platform-dependent, not really the passkey’s fault.
Passkeys really are not any more difficult to explain than 2-factor authentication. Anyone who’s currently been able to actually create an Apple or Google account and successfully navigate their devices up to a passkey screen will be able to grok how it works.
People around here really ought to stop thinking users are complete idiots. Hell, you don’t even to scroll that far to read people calling users “normies” for crying out loud. What is this? High school?
The keychain and passwords app are separate and keychain still exists
I always operated under the assumption that the passwords app was just a more casual view into the keychain
Maybe that's a bad assumption
They're separate stores. I was under the same assumption until I tried to use `security` to get a saved password. It doesn't work, and as far as I know there is no CLI for the Passwords app's store.
[dead]
That's the main thing I wish was done better. There was barely any actual lead up from the perspective of an average person. Just a new unfamiliar flow on half of the login screens that they use.
Sure, its explained. But not in a satisfactory way that would reach all users at their level.
This is a bit of an exaggeration and out of proportion, but I think my ideal would be one of the big tech companies should have bought out something like a super bowl ad. Something that actually conveys the idea "hey, we know you've used passwords since you were able to type on a keyboard, but here's new technology that's better and here's why" in plain language that the average person can understand.
Unfortunately, XKCD 2501 continues to be relevant. [1]
[1] https://xkcd.com/2501/
[dead]
YES. This exactly. I work across multiple devices, some of which are nonstandard/uncommon (Linux, Xiaomi China ROM, ...) and I've NEVER had passkeys work properly - yet everything constantly prompts me to add one. Even if they did work, I'd have to carry around hardware keys or register each computer separately. And the lack of backups if a device is lost/broken is definitely a larger concern for me than being phished of my TOTP keys.
My wife clicked through a Google dialog and suddenly was using a passkey. It absolutely happens, though IMO more to the non technical users. I know what those login dialogs and pop ups mean, and decline them.
(At least til I get around to setting up my new usb c yubikeys!)
Passkeys remind me of ipv6 in that they are a "solution" coming from the supply-side, without (apparently) having done any research in what motivates actual users (and what would motivate them to switch).
<<ducks>>
Account lockout as the author mentions is the biggest risk on personal accounts.
Passkeys just make it harder/riskier.
I am conflicted with passkeys.
I actually prefer non-resident U2F in some ways. You don't have to store anything on your key, you are just signing requests. This is relevant where U2F/FIDO keys have limited slots for 'resident' keys.
In principle, it's great. You have one good password to remember for the average user, and that's enforced by their device's probably good enough security posture.
They are resistant to being phished and they won't reuse the same one everywhere. They then don't end up going from hunter2 to hunter2! everywhere.
But my experience for users is that they worry they are giving their biometrics to Amazon or whoever and so the UX just confuses them.
The certification aspect was new to me too last time passkeys came up. Sites can require that a given passkey has been certified.
The patchy support for them is also frustrating. MacOS does not support NFC FIDO/U2F. iOS does.
Completely agree. I think the root of many of its issues is the inability to add a key that you don't currently hold. This prevents me from storing a backup key in a safe, for example.
I proposed an alternative scheme many years ago: https://www.researchgate.net/publication/343318317_Privacy-a... . By allowing "offline" keys you can also treat them as higher priority, and use them to revoke any lesser keys from attackers if your account is compromised.
It would also be nicer to get rid of usernames, but that's a fight against the data-gathering powers that we're unlikely to win.
I'm was tempted to come in here and say "you're holding it wrong." But then I quickly realized that I had to spend weeks changing my behaviors and messing around with devices in order to get it to work correctly.
As someone who's OpSec puts swiss cheese to shame Passkey has been a godsend. My passwords are actually much better because of it.
I will say it. They are all holding it wrong. But it's not their fault. Its how the platforms designed their implementation of it.
If you have to use passkeys, try KeePassXC and KeePassXC-Browser. I used them to set one up for Amazon a few days ago, as Amazon now forces passkeys as of this month, at least for my account. It was relatively painless.
That said, I don't like passkeys either.
They really are bad. Passkeys have turned out to be just another password that you cannot even memorize.
>just another password that you cannot even memorize
there's some issues with passkeys, but not being able to memorize them is a feature
So where do I keep my pass keys is the problem. They are in my password manager just like another password. So what's the point of having them because effectively, the passwords in the password manager and the passkey in the password manager offer the same UX to me? Except that at least I can memorize a password by heart just in case.
And this is why people bash passkeys, but they hear a buzzword lol
I agree 100% i learned that my old school with whom I had linked to my windows computer and finished my degree with one day required passkeys rather than passwords on all devices. This force locked my windows PC back to passkey mode luckily I remember recovery account and got a passkey to work. But it took months to figure out why I had to use it. All the help board were said just click this button which was grayed out. Or set this register key which auto repopulated. It was an awful experience. I like my password as default
Ah yeah, Microsoft has this awful habit of just hiding the buttons for actions you don't have permission to do, which makes me feel like I'm being gaslit sometimes when a guide says 'there's a button right here' and there's not, and I've no idea if the button was just moved or if not, why it's not available (sometimes it's because I don't have permission, but sometimes it's because it's a different product with the same name and branding as a completely different product).
Do passkeys improve security posture for the average person, reducing the likelihood of them losing their accounts to fraudulent actors? Absolutely.
But they also introduce single points of failure, as the article points out. I can't even remember how many times I've had to help a family member recover their account or get confused when they can't sign in on a new device. It's incredibly frustrating that this flow is promoted as the default for so many services.
1password is the best solution I've found for the average person. It's not perfect (it's definitely more complex than writing down your passwords on a piece of paper or using the same password everywhere) but it's much easier than juggling yubikeys. I know so many non-technical staff members who prefer the OS or browser keys even if it means another account recovery is lurking around the corner.
Passkeys have made my life very easy. Especially using Proton Vault.
If you think passkeys aren't ready yet, blame the people implementing it on their platforms.
Yes, thank you. Maybe I am getting old but password+yubikey/webauthn was really top UX.
> Maybe I am getting old but password+yubikey/webauthn was really top UX.
It most definitely isn't. Any 2nd factor that is not the device I am currently using (either a yubikey or my phone) has a non-zero chance of not being near me when I need it, leading to the constant question of "where the fuck did I put that darn thing", only to find out that the cat has decided to believe the yubikey is a mouse and tried to devour it, the phone's battery went dead...
I agree with all the points this articulates. I understand why for many users they are great. But I would prefer better acceptance and continuance of the simpler, unfishable, u2f simple hardware keys.
Ecosystem is not mature yet for individuals?
Probably hundreds of millions or even billion people have devices that support biometric auth. How is that not mature?
Devices that break or get lost, and then either the user had password authentication activated all the time anyway in addition to the passkey, or they have the classic "mother's maiden name" recovery path, or they get locked out of their account.
Brilliant security: a highly secure high-tech shiny front door that can randomly fail to open, so you still need the low-tech back door, which is the one potential thieves will use.
Mind you, it can work if the back door is old but sturdy (basically, for a bank that will ask for KYC authentication, or in the worst case you can set foot in the brick-and-mortar branch with your ID and physical face and ask for access) but for pretty much every other service it introduces risks for very little or no gain.
Two crucial things you can do with a password that you can't do with a passkey:
1. Write it down on a piece of paper and put it in a safe deposit box.
2. Read it on one device (or from a piece of paper!) and enter it manually on another device.
Plain text is the ultimate form of cross-platform portability. Passkeys are the ultimate form of vendor lockdown. The passkey vendors won't even allow you to view the private key, unlike with ssh keys, which you can also write down on a piece of paper. It's vendor cabal to destroy computing freedom in the name of "security", always the excuse.
I like using passkeys in bitwarden from Firefox, I just wish it didn't popup a dialog that's usually behind the browser.
They’re bad and I wish places would stop being so aggressive about them (I’m looking at you Amazon and PayPal)
Asking Amazon and Paypal to not do something bad is a big ask.
The experience is also junk if you're using a password manager, I have passkeys that I'm not sure if I saved to the OS manager or my password manager... mostly my fault but I enter passwords so many times a day it can be hard to stay on top of which UI I'm clicking yes in to store them.
Password managers are great IMO, I can use some absurdly long password, backup is reliable, I can use them across devices. For extra secure stuff 2FA works the same, I've got an app with codes I can easily back up and use from multiple devices.
Passkeys tend to obscure everything and take away a lot of control.
Is there a reason why passkeys couldn't be used in "expire-periodically" mode?
What benefit does that give you? Passkeys cannot be moved, by design. So for the website, recieving the same one means you're talking to the same device, always.
The purpose of rotating passwords is to cycle out potentially compromised ones, due to phishing attacks, keyloggers, shoulder snoops, etc. But those cannot exist with a passkey.
Then how do you log in? Not all sites let you keep password logins after.
I've resisted passkeys for some of the reasons listed. I use third-party password managers, they're device/system independent, and I can export the data when I want to. I don't see passkeys as a big advantage, or perhaps I should say the bigger advantage isn't really for the _user_.
Of course, at the rate we see security failures everywhere, I'm not entirely convinced writing your passwords on post-it notes wasn't such a bad idea after all.
using them with 1password has been pretty effortless. 'want to add the passkey' sure why not. 'want to use the passkey?' sure why not. for me it works across devices/os/platform so not sure what the big gripe is tbh.
They exist for sole purpose companies can just shoot the "we have been hacked, but worry not your 'passwords' have not been leaked" email.
It's entirely one sided solution.
But they could always do that with regular passwords.
Like, no company should be storing anything but a salted hash of their users' passwords.
Dev: Adds a passkey button to the login page. Groknards: "Oh My God Stop Forcing This On Me!"
I can't think of a single time I've had a passkey forced on me, but that nonsense sits at the core of every passkey related post.
I've seen it. Websites are pretty inconsistent about the flow but I've had a few just try to install a passkey when I log in (amazon does it. Paypal seems to do it but only try to use it on the same browser it was installed on, even if it's synced through a password manager, just to be different. The more reasonably ones have a 'log in with passkey' button but this isn't universal. Microsoft seems to just nag the user on login periodically in their classic 'Yes/Ask me again later' style of 'consent'). You can, if you're paying attention, avoid it actually happening, but the average user isn't going to notice until they suddenly can't log in because they're on a different device. You can see some advocates are pretty vocal about making them mandatory as well.
I feel like dozens of sites constantly nag me about this. The best ones at least save a cookie to note I'm not interested, such as GitHub.
Every time I login to certain sites (like my health insurance, for one) I get a passkey prompt (system dialog) with no way to keyboard-dismiss, so I'm forced to move my hand over to the mouse and figure out which of three poorly-named buttons to press to get on with the login and ignore the passkey.
It's a minor inconvenience, but happens so regularly I hate it. It also stops the login flow until I dismiss the prompt, which is also annoying as I could've already gotten to the page I wanted to get to in the time it took to dismiss the dialog.
You must not use Outlook
As someone who uses a single password manager on my computer and phone, I don't see the problem with passkeys. I use Safari on both and I never even had to "set up" anything.
I can see why they would be problematic for people who otherwise live life with a single love2025 password though.
Yep, this is typical HN (aka that vocal minority that likes to stroke their own egos pretending to be greybeards or something): complain about how something works ignoring all the ways it is used and implemented correctly and make a blog post about it talking about some nonsense to pretend they know a lot about the thing they are complaining.
Passkeys are great. The Apple passkey experience is seamless. They just work. Anything else is poppycock of the highest order.