Passkeys have a marketing problem where no one is able to describe simply what it is without having to use technical jargon. There's also the problem where each OS tries too hard in pushing this to the face of end-user
This burden is on the site using passkeys. There should be some equivalent of “My Account > Security > Passkeys > Add Passkey.” There often isn’t, which is an incomplete implementation. And yes it’s frustrating.
Imagine a password, but it a) types itself for you and b) detects when it's being sent to an impostor site and blocks them from seeing itself, so it can't be phished.
Are you part of the 99.99999% users of one of iOS+Apple or Androidlike+Google/Tencent or HarmonyOS+Huawei? If that's the case, you don't need to as the key is automagically saved by your OS' platform and synced with your new device.
Otherwise, you're such an extreme outlier that you probably either know what you're doing or can find out by yourself, right?
> … users of one of … Google …? If that's the case, you don't need to as the key is automagically saved by your OS' platform and synced with your new device.
This absolutely does not encourage confidence in me. We all know how easy it can be to get locked out of a Google account and have no way of getting back in unless you have enough clout to make a huge noise online so a human there pays attention instead of you being stuck in the 'ol support-bot-run-around loop. It doesn't happen often when you consider how many users there actually are out there, but the potential inconvenience is high enough that “fairly rare in the grand scheme of things” is still enough to be reason enough to be wary.
How does it get synced to my new device? Will Google charge me money because I'm using their cloud sync stuff? Are they going to charge me money like they do with "syncing pictures" (your phone starts telling you to do that, so you enable it and after a while it says you're out of space and need to pay $10 a month or 'you might lose your emails')?
How can it be saved and synced without credentials? I'm in that overwhelming majority, but I don't grok how I can recover the account when my phone is lost/stolen/damaged. The answer appears to be, use another device that was already logged in?
As others have pointed out, this is a terrible oversimplification which misses all the nuances which cause people headaches when using passkeys.
To your point, I for example would add point c) - Is linked to the device you are using currently. If you want to use another device to log in you are in a world of complexity and pain.
That's the main thing I wish was done better. There was barely any actual lead up from the perspective of an average person. Just a new unfamiliar flow on half of the login screens that they use.
Sure, its explained. But not in a satisfactory way that would reach all users at their level.
This is a bit of an exaggeration and out of proportion, but I think my ideal would be one of the big tech companies should have bought out something like a super bowl ad. Something that actually conveys the idea "hey, we know you've used passwords since you were able to type on a keyboard, but here's new technology that's better and here's why" in plain language that the average person can understand.
Unfortunately, XKCD 2501 continues to be relevant. [1]
The average person? I have a Master's and PhD in CS, code regularly, and have followed and used all the cool technologies from the days of gopher, telnet and Mosaic to crypto, and lately LLMs. And I still don't have a clear enough picture of passkeys to know really basic things like "what if we have a family computer but each wants to access their private accounts and keep the others from accessing?", "what do I need do to login from an airport computer?" or "what should I do if my phone is stolen?"
If it's that unclear to me, I can't imagine how it can be to the average user.
The way they explain them is atrociously unclear, borderline negligent for services that nag people to activate it for accounts where they may hold valuable data for their personal lives. And while I don't want to spend much time finding out the details as long as I have the option to decline them, I suppose if they can't explain it and convince people of its advantages, it's because it's just bad tech.
> "what if we have a family Computer but each wants to access their private accounts and keep the others from accessing?"
That's what OS level user accounts are for. Tbf
> "what do Ineed do to login from an airport computer?" or "what should do if my phone is stolen?"
Indeed I don't know the answers to these either if I wasn't syncing passkeys in 1password. Honestly we should educate people to use password managers more than any thing. It's also a smaller jump than to passkeys. Passkeys can be more of an advanced convenience feature after they get used to using password managers already.
ok cool so when somebody logs into a site on their phone and sets up a passkey, then goes to their laptop and tried to log into the same account, how do you easily explain how to deal with this situation?
What I have seen is that the site gives you a QR code to scan with your phone. People are already used to needing their phone to sign in via an Authenticator app or SMS code.
I tell people a website is like a payment terminal. Your device is like your debit card. A password is like a PIN on the card. A Passkey is like a chip on the card.
Logging into a site with your device is like putting your card into the terminal. The site can ask for a password the way the terminal asks for a PIN, but if your device supports Passkeys, that’s like your card having a chip, and it’ll use that instead.
So think of Passkeys like using a chip card.
I dunno how well this analogy works down to the last detail but it has gotten it across to all the parents I’ve used it with
Probably not. The magnetic strip was easy to explain (it contains some info the terminal checks), but it's also pretty easy to explain why skimming was a problem. Explaining how chips fixed that (signing keys and cryptography) is probably beyond a 30 second explanation with Joe Schmo.
As implemented they also lack conceptual integrity: you get them somehow (where are they?), and somehow you can use them (how, exactly?) but you can't enumerate them anywhere, see them, see where they came from and what they can do for you.
What benefit does that give you? Passkeys cannot be moved, by design. So for the website, recieving the same one means you're talking to the same device, always.
The purpose of rotating passwords is to cycle out potentially compromised ones, due to phishing attacks, keyloggers, shoulder snoops, etc. But those cannot exist with a passkey.
Doesn’t this mean that a compromised device with passkeys on it is worse than a compromised password since the passkeys can’t be rotated? I feel like the answer is obvious so there must be another angle I’m missing
Passkeys can be rotated, of course. The question was whether they should be rotated on a regular basis.
What kind of compromise are we talking about? Was the device stolen? Then yeah, you need to rotate passkeys (and all your passwords, and remotely cancel all your live sessions, none of which is new).
Was the device hacked from afar and the data read off of it? The passkey is probably fine. You can rotate it if you want to, it's not a bad idea, I probably would to be certain, but you're not pwnd even if a bad guy got a shell for a while, heck even if they got a root shell.
I understood the question to be "should passkeys be rotated regularly" to which the answer is probably no because there's not really a compromise mechanism that periodic rotation defends against as far as I know.
Rotation defends against secrets that leak through normal use and without your knowledge, like a password entered into a phishing page or snooped over your shoulder or cracked from a breached hash. Passkeys aren't vulnerable to those things because they never travel over a network, are never seen by the server, are never seen by their own users.
You change the locks on your house when a key goes missing, or is known to be in the hands of somebody you don't want getting in, it's not something you do every three months just in case. Same with passkeys.
So where do I keep my pass keys is the problem. They are in my password manager just like another password. So what's the point of having them because effectively, the passwords in the password manager and the passkey in the password manager offer the same UX to me? Except that at least I can memorize a password by heart just in case.
That is the point. They stop you from memorizing it “just in case” and reusing it, and they force you to use a password manager.
For the average user, which doesn’t use a password manager, this is great. It means they can’t get phished. And it’s also great for the average password manager user, who keeps dozens of insecure and reused passwords in their vault because they manually thought of a password when signing up instead of randomly generating one.
If you’re already using a password manager and random passwords, the UX is designed to be the same. It’s just a way to get regular people to do this.
While the technology itself may be great (I don't really know since I don't use them) it has been co-opted by the tech conglomerates as another form of isolating and walling off users into their ecosystems.
And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".
Not as far as I’m aware? They of course require the target app to be compatible with the way they export them, but I don’t think they vet them manually. At the very least, on my phone, the apps it agrees to export to include Chrome and Bitwarden (the latter of which lets me export them further).
> And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny.
The reason is the ever increasing number of hijacks of social media presences and code hosting portals, with the latter being a serious financial threat. Done right, passkeys stay in the Secure Enclave, at least for anything Apple and most of the Android sphere. There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
Fun fact: Google can decide to reject these. Lose access to the original device, try to rely on recovery codes to login with known current password on family member’s device… nope!
I guarantee you this is within the realm of possibility based on one single experience.
When you upgrade your phone perhaps keep your old one in a safe and charge it and login to Gmail monthly or something?
I’m also quite certain the codes could work instantly with no trouble in some circumstances. Now know it’s risky though. And I’m sure it’s a security measure based on real, deeply painful and costly instances of unauthorized access. Just don’t know what we’re exactly supposed to do…
Google gives you no guarantee of service for your account. They could arbitrarily decide to lock you out for any reason and you have literally no recourse.
The doubt is more "how will tech companies use passkeys as an excuse to do something stupid" than "passkeys themselves must have inherent problems because tech companies are pushing them".
Passkeys could be the savior of all security problems worldwide from a capability point of view and tech companies would still ruin it by trying to push or force ways it pushes you into their ecosystem instead of just being whats both secure and convenient.
My yubikeys have survived dips in the ocean, spilled beers, run over by cars, dropped in pans of used motor oil, left out in thunderstorms, and multiple trips through the washer and dryer. They're still fine even after a decade.
Physical keys can easily be copied, and physical locks can easily be picked. That might be fine for your house or storage unit, but for your bank account or your car (newer cars no longer have simple physical keys/locks), we've moved beyond that tech.
That any and all physical security measures can be defeated is a feature, not a bug. Almost no human beings actually need that level of security, and the tradeoffs are absolutely not worth it for those of us without Mossad as a threat.
How often do people lock themselves out of their own house? Don't you know anyone with ADHD? Imagine any time that happens it is mathematically verifiably permanent as a fact of reality itself. It doesn't matter that the state still views you as the legal owner, you are never allowed in ever again.
Now we aren't talking about a security problem, we're talking about who really owns what. Google can lock you out of your account no matter what kind of authentication they use for that account
I'm not even sure what your point is anymore. If Google decides they don't want you to log in anymore, you can't log in anymore. It doesn't matter if you try to log in with a passkey, a password, your fingerprint, or sending a secret code in with carrier pidgeon. This has nothing to do with passkeys vs passwords vs anything else.
If Google does want you to be able to log in then they will work with you to make that happen, whether you forgot your password, lost your passkey, or your carrier pidgeon died.
Passkeys are not special in this regard at all. What does make them special is that nobody can use a phishing attack to steal your passkey and log in to your account. Nobody can guess your passkey and log into your account. Nobody can intercept your passkey in flight and log in as you. That's the important distinction.
That's not the problem for me - I carry a bunch of tokens with me anyway (all my banking stuff is on hardware tokens, for example). My problem is more: My browsers run in containers or VMs, intentionally without hardware access. Getting passkeys to work there would be quite a bit of effort.
Passwords can move between walled gardens generally very easily (export) or manually in all cases (enter by hand).
Passkeys only very recently got relatively broad support for migrating data (after years of promise and no support at all), and they report (optionally with hardware attestation) what password manager you're using so sites can force specific ones.
but what do passkeys offer in terms of security, when stored in password managers, compared to having a (password manager) generated password and a totp?
I believe that by allowing password managers to store passkeys, the whole purpose of "device based security" got lost..
Yes. I use hardware based passkeys and absolutely love them. I think it was a giant mistake having them 'software' based. It some ways it kind of defeats the entire purpose...
They are 100% immune to credentials phishing. You literally cannot authenticate to an impersonator site based on cryptographic guarantees.
And yes, I know the happy path of password managers uses host-based autofill which does add some friction to phishing attempts, but given the prevalence of unexpected but legitimate urls with weird alternate subdomains/SSO/redirects in modern login flows, you have to manually autofill/add an exception often enough that it's possible to let your guard down once at the wrong time.
I did a deep dive on this since progressively more places are taking a hard line about Passkeys.
The most flexible, independence preserving thing to do is to use a third party password manager like Bitwarden, and make that the default passkey flow for your devices. If desired, you can self-host something like Vaultwarden so that you can both keep the keys independent of third parties and walled gardens and also propagate them to other client devices.
To be clear I'd much rather not have learned / implemented any of this, and I don't use passkeys unless forced, but this seems like a valid coping strategy.
The creds they store hold no value. These creds only give access to their system anyway. They store the email address either way so the situation is no better but less convenient.
They hold no value precisely because they don't store them and send you a magic link! If they stored a recycled password or its hash, then it would be valuable.
Not sure this is what I meant. Password is still stored, along will all the keypass stuff. If you have the option to login with the keypass... or the password - possibly sending you a link (or code) to the email, in case the device/browser has not been seen, yet.
Do passkeys improve security posture for the average person, reducing the likelihood of them losing their accounts to fraudulent actors? Absolutely.
But they also introduce single points of failure, as the article points out. I can't even remember how many times I've had to help a family member recover their account or get confused when they can't sign in on a new device. It's incredibly frustrating that this flow is promoted as the default for so many services.
1password is the best solution I've found for the average person. It's not perfect (it's definitely more complex than writing down your passwords on a piece of paper or using the same password everywhere) but it's much easier than juggling yubikeys. I know so many non-technical staff members who prefer the OS or browser keys even if it means another account recovery is lurking around the corner.
Passkeys remind me of ipv6 in that they are a "solution" coming from the supply-side, without (apparently) having done any research in what motivates actual users (and what would motivate them to switch).
They make sense as a technology for businesses & their users. In that scenario, the owner of the account is not the user, but the business. It makes sense for the business to be able to place strong restrictions on how & where the user may log in, it fixes a lot of real problems businesses may have thanks to sloppy user behavior, and the business is also motivated to provide a way to fix broken logins. It's a good solution for that scenario.
But for regular end users where services are primarily motivated to take money from those users and lock them into their ecosystems, they are a usability disaster and yet another exploitation vector.
It's one solution for two very different usecases, and it just does not work. There is an approach that could work for end users who own their own accounts, but they need to go back to the drawing board and rewrite the protocol with the assumption that the keystore is hostile to the user's interests. That means strong guarantees on key portability so users can migrate away from hostile keystores, and absolutely no ability for services to restrict the user's choice in passkey provider software.
> and the business is also motivated to provide a way to fix broken logins. It's a good solution for that scenario.
This is a big part of it. An employee at a business will be able to talk to someone in person and say 'I can't login. Can you reset my password?' or whatever equivalent, and be made whole. Even if the business is is made up of 10000 people and the identity of the employee is for some reason in question, the situation can still be resolved with a passport or a driver's licence.
Google is never going to make you whole again if you're locked out of your account, unless you're a celebrity and make a stink. There is no help desk where you can prove who you are (and even if you could, would you want to? That's a whole second domain of problems that I'm not sure will ever be solved completely).
I think passkeys were made to work in mind with complete idiots (here's a pop-up, tap it, now you have access to website without password, don't think about where it was saved or that it exists at all). I can understand parts of IPv6 like Router Advertisement being like that but there is so much customizability for the user that I can't really see them being similar that way.
It'll work if you have a laptop on the same account, iCloud or 1password or whatever else. If you only had a phone, you set the account up again on your new phone.
I agree with all the points this articulates. I understand why for many users they are great. But I would prefer better acceptance and continuance of the simpler, unfishable, u2f simple hardware keys.
The experience is also junk if you're using a password manager, I have passkeys that I'm not sure if I saved to the OS manager or my password manager... mostly my fault but I enter passwords so many times a day it can be hard to stay on top of which UI I'm clicking yes in to store them.
Password managers are great IMO, I can use some absurdly long password, backup is reliable, I can use them across devices. For extra secure stuff 2FA works the same, I've got an app with codes I can easily back up and use from multiple devices.
Passkeys tend to obscure everything and take away a lot of control.
Completely agree. I think the root of many of its issues is the inability to add a key that you don't currently hold. This prevents me from storing a backup key in a safe, for example.
I proposed an alternative scheme many years ago: https://www.researchgate.net/publication/343318317_Privacy-a... . By allowing "offline" keys you can also treat them as higher priority, and use them to revoke any lesser keys from attackers if your account is compromised.
It would also be nicer to get rid of usernames, but that's a fight against the data-gathering powers that we're unlikely to win.
YES. This exactly. I work across multiple devices, some of which are nonstandard/uncommon (Linux, Xiaomi China ROM, ...) and I've NEVER had passkeys work properly - yet everything constantly prompts me to add one. Even if they did work, I'd have to carry around hardware keys or register each computer separately. And the lack of backups if a device is lost/broken is definitely a larger concern for me than being phished of my TOTP keys.
Same as traditional physical keys, you don't have a single key, you have multiple ones precisely so that if you lose/break one, you are not stuck and can go to the local locksmith and get another one in minutes.
In fact it's even nicer since you can just re-use the backup key with no security loss by revoking the other one, and buying another key.
You don't copy the keys themselves, instead you make multiple relationships with different keys. You can get as many or as little keys as you want. The point is the keys themselves are not important.
> Same as traditional physical keys, you don't have a single key, you have multiple ones [...]
I have multiple identical ones.
> [...] and can go to the local locksmith and get another one in minutes.
Can I go to the digital equivalent of a locksmith (like a backup software) and duplicate my passkey? Can I do that with only my passkey in hand (without having to do anything to the corresponding lock, or having to contact its issuer), like I recently did with a physical key?
Heh, in the security world, this shows how your traditional metal key is "something you know" (like a password) because it can be copied and many people can know it at once!
So if we are enforcing MFA requirements and allow this kind of clonable key, then we should really require some other factor that is not clonable.
That's the core silliness of this whole passkey mess, IMHO. So many turns of rhetoric and weird compromises, we have cargo cult security and no real understanding of what security level is in place.
Instead of the best of worlds, we can accidentally have the worst of worlds without realizing until it is too late and we're painted into one of those ugly corners.
> Heh, in the security world, this shows how your traditional metal key is "something you know" (like a password) because it can be copied and many people can know it at once!
If you have a photo of a traditional metal key, you can duplicate it. AFAIK, there's also a numeric representation of the height of each position on the key; if you know that number, you can duplicate the key. A traditional metal key is more like a password than most people think.
That's not accurate. Bitwarden syncs passkeys across all my devices including both mobile/desktop (iOS/Android/MacOS/Windows/Fedora) using Chrome/Edge/Safari (I haven't tried Firefox).
KeepassXC is an open source alternative for cross-device synced passkeys. Marginally less secure than device bound passkeys but it's seamless and I save so much time now being able to login with one-click everywhere instead of wasting it on arbitrary "let's make sure you're you" MFA nonsense.
As someone who uses a single password manager on my computer and phone, I don't see the problem with passkeys. I use Safari on both and I never even had to "set up" anything.
I can see why they would be problematic for people who otherwise live life with a single love2025 password though.
Yep, this is typical HN (aka that vocal minority that likes to stroke their own egos pretending to be greybeards or something): complain about how something works ignoring all the ways it is used and implemented correctly and make a blog post about it talking about some nonsense to pretend they know a lot about the thing they are complaining.
Passkeys are great. The Apple passkey experience is seamless. They just work. Anything else is poppycock of the highest order.
Imagine you lose your computer and phone. How do you recover your digital accounts? This happens every day to someone. The most common scenario being a house fire or robbery.
Receiving an email at your backup email address? Getting a text message? It’s whatever you have decided to set up in your account, the same as with a password.
I think the point with a passkey is that those very loose backup methods are required, since just knowing the password is not a thing. Everyone gets a new phone and is at risk of the previous one being unavailable. So passkeys mean that there's no way to deal with that reality, and also be truly secure.
I don’t know any of my passwords and haven’t for a decade, so passkeys are no different in that respect.
If the worry is your phone getting lost then use a password manager that syncs to the cloud and log in with the same passkey using another device. I just got a new iPhone and logged into a bunch of things on-device using synced passkeys. It worked just fine.
Every conversation about this seems to involve someone asserting that improving upon passwords in any way at all is unacceptable unless the solution is perfect in every possible way, with the goalposts constantly moving.
Passkeys do marginally improve security against MITM and phishing attacks, but they are primarily for protecting the lowest common denominator from themselves: people who re-use passwords and/or don't use a password manager.
If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
Sad reality is that such usecase is less and less common, thus, no one cares about it. I think majority of my friends would not be able to access their email, or facebook or alike, if they were forced to use my computer in emergency.
Which is a trade-off that makes sense for a lot of people. If you have multiple devices, many of which are portable and one you have on you all the time, the need for that is just way lower, so being more secure against commonplace automated widespread attacks is worth it to them.
Many people are moving to only a single portable device that’s easily lost, broken, or stolen, without any understanding of backups or fallbacks for their accounts.
And many are moving to virtual wallets like Cashapp rather than banks with a physical presence where you can take out money without a phone.
Isn't there a workflow where you scan a QR code to confirm the pass key on your phone?
I've definitely done this, but not sure if the workflow was at the OS or browser level.
I'm honestly confused by all the negativity in the comments. Passkeys are great for convenience. Just leave your password login enabled as a backup. That defeats any security benefit, but oh well.
There are a lot of reasons why I might want to login on a computer I don't own to do something, rather than to use my phone. Having a keyboard is a major usability benefit for many types of work. Larger screen, printer. Software that is on the machine that can't run on my phone.
This is what I use to log into our remote desktop software at work. The passkey is on my phone and I scan a QR code presented by the remote desktop software (in this case it's the Windows App on my macbook and Microsoft Authenticator on my android).
That's actually a good use case for HW keys. Since untrusted computers are much more likely to have keyloggers/malware, etc. So you don't need to reset password and invalidate all sessions after each such login on an untrusted computer.
And that sounds fine, until you're traveling and your devices get stolen or lost. How, exactly, are you going to get into your email then, once passkeys become the only means of login? Because that moment is when you really do need to access your email, stat.
What services implement it like this? Don't services usually implement passkeys as a more secure alternative to a password, but password login is still available?
Some sites allow passkeys as an option for MFA, so that could be an issue if the passkey is your only MFA option and MFA is required. But I imagine email would pretty much always be a fallback.
Didn't Outlook.com famously rolled out passkeys with no recovery option and no option to sign in using username and password once enrolled. So if you lost your trusted device, you couldn't sign in, nor could Microsoft send you an email, because... Outlook.com is your email provider.
And not even that, now that I think about it. I have my very long Bitwarden password memorized but if my devices are all stolen I won't be able to get passed the 2-factor, so I'd still be screwed.
A variant of that is alternative accounts that properly live on a different device/context.
For instance YouTubers usually have a different account for their channel than the one they use privately, and don't want their channel account logged in everywhere.
That means having to log in as a guest when push comes to shove. And similar setups are common for most self-employed keeping a "work" account IMHO.
The offer a strong protection against phishing attacks that would still get plenty of password manager users: fake websites. A passkey is strongly linked to a domain, so a fake site can't get that credential.
Some password managers will only fill if a domain matches, but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in. I've also seen lots of them do stuff like happily autofill on any prefix of the domain, so your credential for `something.example.com` will autofill into `fake-something.example.com`.
> Some password managers will only fill if a domain matches, but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in. I've also seen lots of them do stuff like happily autofill on any prefix of the domain, so your credential for `something.example.com` will autofill into `fake-something.example.com`.
Why would you trust the very same password managers that don't handle passwords properly to handle passkeys properly?
> but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in.
I've seen people do this AFK as well, and I'm always helpfully suggesting them the correct way of solving this: verifying the URL again, and if correct, add it to the password manager so it remembers in the future, and never copy-paste passwords on the web. Basically 50/50 if they take the advice or come back after a week asking if it's safe to copy-paste the password into the website, and I try to inform again.
Shockingly, I saw one developer peer copy-pasting a password into a website, but I guess for these people there is no hope.
It should be a big red flag for sure, but the reality is most users aren't going to understand that. They got told to use a password manager by someone or find it convenient, but they don't understand the security flow enough to catch that it's a potential attack, or how to resolve it safely.
Historically I've seen lots of sites do a subdomain shuffle for login pages every now and then which routinely breaks domain matching, introducing false positives that users have to deal with, making them numb to the threat too. Passkeys baking in the domain check with no workaround means that sites can't do that, which is a benefit.
There are too many websites where this is broken for me (even with Firefox's built-in password fill) to go as far as to never copy-paste passwords. If web devs actually implemented it consistently, I might be that draconian about it, but asking them to do that when we already have the '200 MB of JS is needed to view this page' problem, I have my doubts we're going to see this problem going away any time soon.
Probably the whole authentication thing shouldn't be implemented by the website at all. There should be some standardized way to ask for authentication that's implemented by the browser or the operating system.
Your last sentence got me good, as I'm a developer who copy-pastes passwords into websites (from a 12? year old KeePass database, for whatever that's worth).
I've tried using the Firefox integration in the past - more than once - and I don't know... it had so many warts that I got fed up with it and turned it off. And now I have 1Password (from work) also doing its best to feed me credentials all the time. So trying the KeePass integration again is going to have them both drawing suggestion dropdowns all the time..
But ok, I'll give it another honest shot. Because of your comment.
"Oh, usually my bank just logs me in, that's strange. Let me just go grab my username and password and type it into this site that looks like my bank."
Same thing is going to happen with passkeys for non-technical users for exactly the same reason you stated. People will think the integration is busted and manually copy/paste the non-passkey credentials in. In that way, I would argue that passkey is not stronger protection against phishing attacks unless its the only way to login. It is, at best, a convenience for users.
If the user just has a username/password fallback and that's it, then yes, but the aim of passkeys is that won't be the norm, rather users will only have passkeys and the fallback would be to, e.g: magic link email log in where the phishing attack is still broken. I've seen some sites explicitly disallow plain username/password login after you enable passkeys for this reason (you can still put them in, but then it just does a magic link flow afterwards as a second factor).
Which is a laudible goal, but something that makes "oh just fall back to the standard insecure recovery process" not a very good response to the concerns about users being able to actually hold on to their passkeys easily and reliably.
I've been told by multiple people that the recovery method of passkeys is to enter your username/password. If passwords are eliminated, your final recourse is fucked.
Why would it be that is the only recovery method? The most convenient one is just more passkeys on other devices of course, but you can have any other recovery methods you want. Magic link emails are the most common, but there is nothing about passkeys stopping you from implementing anything you want.
This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport). iOS and Android support this, and it’s generally not a locked-down thing if other devices wanted to do it too.
The only use case left is in “how do I login if all my devices are stolen/fall into a body of water” in which there really isn’t an answer beyond “get (a|your) device back, sign back into your password manager, use that to get back into critical accounts”.
How is that different from accidentally deleting your keepass database? Or forgetting your password? I think it’d be easier for me to forget than find myself trying to flush all my hw tokens…
But a majority don't do that. For them let them use passkeys. If the possibility is once in 10 years then I am happy to do that. A majority is happy to do that.
And yes, Google or Apple - dont say you should not keep passwords in your database and sync it with dropbox. DIY.
Copy pasting my other comment from an earlier thread
FIDO2 USB Security key -> Bitwarden (With master password) -> Every other method (topt/password)
I have 3 FIDO2 USB Security keys, One I carry with my persons at all times, one that stays with my main machine at all times and an offsite backup that is sitting in a friend's server, if my house burns down, I can either physically collect the key or use USB-IP to authenticate back into bitwarden and enroll a new key. (Actually all 3 are at home right now but that's ok)
I recommend a reciprocating saw with a metal cutting blade to get them into small enough pieces. Do not try to flush them all of the pieces at the same time. It's not just about whether they fit or not, they also need to be light enough for the water current of the flush to carry them all the way through. Otherwise, they may end up in the water trap and hinder your future use of the appliance. For small partial blockages, it may be possible to consume some extra fiber in order to be able to "sweep" some of the metallic remnants along, but this will void both your warranty and your bowels.
I am a doctor -- and a lawyer and an orbital mechanics specialist, as well as a highly respected behavioral therapist -- so you can trust my advice. Also, feel free to consult an AI on this topic; it would make for an amusing benchmark.
This is a legitimate problem, and one of the few cases where a third party login provider makes sense, at least for non-critical “apps”. If both tokens can be authorized to that provider, then you don’t need to enroll any more tokens for apps using that provider. The difficulty is creating a trustworthy provider system without weakening security (the provider shouldn’t be able to login without you) that doesn’t collect information about you and which can’t lock you out from all your accounts.
I’m not sure what work has been done on this since Mozilla Persona. I certainly wouldn’t want Google and Apple, or governments, to be the sole gatekeepers.
Why would you choose that over a synchronizing passkey manager?
A third party OAuth provider puts you at the mercy of the service provider, the other can work fully on your client side even if the app provider were to disappear tomorrow.
The only advantage I can think of is that you have a centralized place to revoke credentials in case your password manager does get compromised.
"A third party OAuth provider puts you at the mercy of the service provider" This is they key issue with trusting a third party to manage my passkeys, they can also BLOCK them and lock me out. An exception is if the passkeys are synced to all your devices and cannot be remotely wiped. I think this is how Apple works.
I didn’t think of this in the moment, but you’re right, this is an even bigger risk than compromise. There’s regularly a thread here about someone getting locked out of their cloud accounts, and now we’re going to gate everything behind those same accounts? Horrible idea.
The problem with hardware tokens is that they 1) Only store a limited number of logins, 2) It is very difficult to keep them in sync- every time you need to add a passkey, you have to get them both out, which makes it difficult to keep one a in a secure safe to keep it safe from damage/loss
This two fatal flaws are what limits their usefulness to enterprise SSO and perhaps some other limited uses where the organization has the ability to replace tokens. (Even in a distributed enterprise, enterprise SSO may not be a good fit for hardware tokens, if they can't get replacements out to employees fast enough).
Yes, this is the issue. People don't like how adversarial security people act, and how they force things onto people. It's fine if a corporation wants to have some internal policy since they're the ones eating the cost if an employee can't work or whatever. Less so if individuals are forced into these wonky setups for no benefit (e.g. now I have to run and maintain and backup a Vaultwarden server just to log into my HSA, which is absurd).
>This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport).
Ok but how do I share my Netflix or Spotify accounts for example with those?
In general you shouldn’t - Netflix[0] really should get proper invite-based family sharing, and Spotify’s subscriber agreement has a section that defines Premium as a “Single-user Paid Subscription” and thus can’t be used by multiple people, legally (and you might be at risk of getting banned if they detect it)
However, passkeys can and are available to be shared via password managers. They’re not locked to the secure chip on the device where they live usually. iOS’ Passwords app has a share button and 1Password lets you share passkey-containing items.
In fact, the QR code login feature makes it even easier to do a one-time sign in to your account for a friend, if you don’t want them to be able to login to your account indefinitely.
0: Netflix doesn’t support passkeys because their main audience is people signing in via smart TVs and whatnot, which largely don’t support CTAP or Webauthn in general)
The same way you share them now: sharing the account name and password and doing whatever you currently do to deal with any 2FA they occasionally toss in.
If they also allow passkeys as an alternative form of login that doesn't need 2FA you can use those to make the account sharing more secure.
When setting up sharing with someone first change the password to something else, and then share the account name and password. After they log in the can add a passkey to the account on their device or devices.
Then you can change the password back to your real password. When they want to use the account they login with their passkey.
If the service doesn't accept login passkeys but does allows passkeys for 2FA, you have to use real password sharing, but at least they can have a passkey for 2FA which may be easier than how you know handle 2FA.
How do people handle 2FA with account sharing? If the site uses TOTP you can give them the QR code that you received back when you made the account (you do save a screenshot of such QR codes for backup, right?).
But how do you handle SMS 2FA, which seems to be far more commonly offered than TOTP?
For email 2FA I suppose you could set up a filter on your incoming mail that forwards any incoming code emails to the people you shared with, and hope that the time limit on the code is long enough for this to work.
Sign in with a QR code is dangerous though because at that point theres very little stopping QR phishing and forwarding the bluetooth request to your browser. See the most common Discord scam.
> forwarding the bluetooth request to your browser.
This isn't a thing. Discord's QR Code scanning is entirely a feature they made unrelated to passkeys or bluetooth. Passkey auth using a QR code has a step that verifies the proximity of both devices using BLE.
In the same vein as 2fa, going up to a fresh computer and trying to log into anything is now a nightmare. Every service has a 2fa that somehow loops into another provider that also has 2fa.
And some 2fa, if not many, make accounts weaker. Apple's solution to get around 2fa is to put in SOMEBODY ELSES phone number that I trust, as a backdoor. It's an insane solution. And its normalized, and nobody questions it.
My MIL setup a passkey accidentally on her Google account and now has no idea where it is. Removing it now requires her password which she’s also forgotten. But now for some reason on Google I can’t initiate any type of forgot your password flow because of how Google sets up things and I have zero clue where she stored the passkey.
It should be but haven’t checked her apple vault. I checked Google password manager and her windows password manager and there nothing in either. She might have used her phone and it’s in her iOS vault which I’ll check next. But this is what makes this entire passkey thing a mess. She’s 75, she didn’t do this on purpose and the ecosystem is just a mess
Even the concept of "where on the PC" has been totally annihilated by OS vendors and app developers. Is it on the filesystem? Is it on The Cloud? Is it vaguely "In An App"? Is it in some "Secure Enclave"? Who the fuck knows anymore? And the apps are no help--they insist on blurring the lines between local and cloud, hiding full paths, and generally just saying "Don't worry about where your data actually is. We pinky swear to be able to find it for you!"
Windows prompting her about Bluetooth for the pass key threw me too. I thought for sure she had clicked the wrong thing before I realized that somehow her widows pass key requires communicating to some device? Maybe her phone? No idea
I know on my Windows if I sign into icloud.com I have the option of using a passkey which I do by scanning a picture with my iPhone and it also using Bluetooth, presumably to prove physical presence of it.
Also in the process of helping my dad with his phone, 76 and my grandmother 99. Maybe this works better with Apple, but the biggest problem on Android is, that it feels like every update shuffles everything around. Allmost no point in explaining, that they can solve some things on their own.
And all the time new things on the screen, new features they don't understand, need nor asked for.
I just made one for PayPal using my MacBook which seems to have ended up in Bitwarden rather than the mac thing. But there's nothing in Bitwarden to say list all passkeys. Not sure how I check elsewhere. Maybe they should email you "you have created a paypal passkey in Tim's Bitwarden" or something. Then at least you could search the email for "passkey"?
I wonder if I can use Bitwarden on another device with that? I honestly don't know.
You can't search for passkeys, but you can search for logins by URL and check the much shorter list for passkeys. The good news is that having the passkey in Bitwarden means you can use it on another device.
I for sure don't. Websites only know there is a passkey associated with my account, and the OS only knows there might be one on the device, or maybe on another device, and offers me options to check here or do a Bluetooth/QR Code dance, and when all of them fail, I'm no closer to knowing where the damn passkey is.
No, it doesn't have to be associated with the phone, and IMO you are better off not letting the big tech companies own your identity, which is effectively getting Apple or Google to store it in your phone for you ends up being. There are physical passkeys that feel like a door key in everyday use. You can attach them to your house key ring, and like house keys are near indestructible. Lookup the Yubikey 5 NFC.
The only downside is unlike a house key, you can't get a backup "cut". Copying a physical passkey currently isn't possible. If you lose it, you've lost access to all your logins. As the article says, their recommended workaround is to keep backup physical passkeys, and log all your passkeys (including the backups) into every site. Which is insane - very few people have the patience to do that.
The article is really a long rant about that one issue - there is currently no way to securely backup a physical passkey. Solve that, and all the other issues melt away.
Ran into the same issue with my dad the other day. Has a passkey set up on his Google account. Bear in mind that he doesn’t know what a passkey is, so Google obviously sent him through a pattern at one point to get him to create one.
He didn’t have access to it the other day and we needed access to his account. He didn’t remember his password, and we were unable to reset it because you need the passkey! No other options to authenticate for a reset were available.
Add in the fact that I was trying to help him with this by long distance call and you can imagine the frustration.
As someone with elderly parents, the Googles and the Microsofts of the world really don't seem to give a shit about the elderly anymore, if they ever did. Random UI updates and workflow changes with no announcements, thinking they're "intuitive."
One of these days the product managers who push these things thinking "oh, it's easy, you just . . ." are either going to be explaining it to confused Mom or Dad, or they're going to be elderly and irritated themselves. Until then I hope they stub their toe or step on random Legos regularly.
I'm not even elderly but I would really like an e-mail client with a stable UI. I used to like Apple Mail but it's been a buggy mess since Catalina. It doesn't even sort or search mail reliably any more. It's basically a trope at this point but a robot-rewrite-in-Rust seems inevitable at this point.
A while ago I helped an elderly relative migrate off off a copy of Eudora that they'd been using for many years. (To Thunderbird.)
Originally it was about difficulty migrating to a new laptop with a different version of Windows, but I was quite firm about it because when I realized it wasn't able to do secure connections for some reason, so the instant they took their laptop to public Wi-Fi...
P.S.: bike reading all the local old mail was a huge problem. After so much time basically no (free) user-facing mailbox import/export features were easy to find. I was even loading up extremely old versions of Thunderbird.
However the GitHub edition (not Sourceforge) of Eudora2Unix [0] saved me and deserves a shout-out.
The migration wasn't perfect, (some file attachment issues linger) but it's better than having it all locked up at risk of Eudora.exe just refusing to start one day.
Yubikeys generally have much worse recovery scenarios than passkeys do, for consumers. In enterprise if you lose your yubikey, an IT admin can help you get back into your account. If you lose a security key as a consumer, you're generally in a much tougher account recovery situation.
Not all services let you enroll multiple keys. Amazon, with all the money in the world, was guilty of this for a long time.
Practically, it is a huge challenge. I would want my day to day fob, an onsite backup, and an offsite backup. That’s a lot of hassle and potential for mistakes. To even register the offsite backup means I need access to it. Remotely copying a password database is so much reliable
>He didn’t remember his password, and we were unable to reset it because you need the passkey! No other options to authenticate for a reset were available.
AFAIK there's nothing different about the recovery scenario for a Google account in that state regardless of whether it has a password in use as its primary cred, a passkey in use as primary credential, or both.
Thanks. Upon further investigation we could have hit “Try another way” on the account recovery process UI a few times to get to a workable account recovery method.
Would be nice if Google would lay your recovery options out for you (which I am used to it doing in regard to 2FA if you are doing a regular log in) instead of having to hammer the “Try another way” link repeatedly as it cycles through options.
It does when I log in. You click "Try another way" and then it brings up a menu of options you have for 2FA. For some reason they have designed the account recovery flow to be different.
So, if you are used to the "Try another way" flow on login, it can be confusing to see an entirely different "Try another way" flow on account recovery.
I'm just storing my passkeys in 1password, which means they're synced across my two computers and phone and also means I gave up any kind of hardware security.
> I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
No doubt there exist services that do not offer recovery method for passkey or mfa enabled account. But this is entirely on them (the service), to blame for, not the passkeys or the users. It’s bad implementation.
> Passkeys do marginally improve security against MITM and phishing attacks ...
The tragedy of passkeys is that they're a step back from the security offered by the likes of Yubikeys.
But because passkeys are pushed by both Google, Microsoft and Apple: there is is simply no fighting these three. It is impossible.
Passkeys won not because they're better (they're not and the entire concept of "secret behind a hardware security module" that can be transferred to another system defeats the whole point of a HSM in the first place) but because the powers-that-be decided that passkeys are to be used.
It's still a win: the commoners are better served with passkeys.
But a secret in control of Google/Apple/Microsoft that can be backed up is not a secret I control: it's a complete step back from yubikeys.
Passkeys won and we better get used to them (and, yup, there are usability issues as you mentioned).
> The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for.
My irritation is that I know what it is, and I've said no thanks many times, but I'm still asked regularly by the likes of Amazon, and they usually pick a time when I'm trying to order something quick¹. It is one of the growing number of things in life that simply have no “no” option, it is always “yes or later” - I wouldn't mind so much if “later” meant “I know the option exists, I'll ask for it if I change my mind, don't bother me again otherwise”. Call me cynical, but if companies are trying to nag me into something I very much doubt the main benefit is mine. I'm sure there are many people out there who go along with it simply because they are sick of being asked repeatedly.
I also don't see the real benefit with the way things are often implemented anyway. When the credential recovery process is sending a magic email or text, making SMTP or SMS the weak link of the chain just as it often is for passwords so I'd be giving up my preferred workflows for no better security.
----
[1] A short while ago I actually ordered from somewhere else because of this, bitter twit that I am. “I wonder if I can get this almost certainly drop-shipped item on next day delivery via Prime?”, [goes to Amazon to check], [get passkey prompt], “sod it, I'll go back to the original place”.
I dropped Amazon entirely a couple years ago because they didn't provide any way at all to separate my credit card from my kid's Fire tablet and I didn't want to be on the hook for thousands in charges because he pushed the wrong button. It's remarkably easy! It has made basically no change to my life except that I'm a little smug about not using Amazon.
Shop.App doesn't have everything, but they do have a lot and many merchants have fast shipping options. I always try to search them and Newegg before trying Amazon.
Newegg marketplace is a funny place. Not only many items are more expensive than elsewhere, I had my orders delivered literally in Amazon or Walmart packaging. There are genuine merchants that made a choice to work with Newegg but there are many resellers from other stores as well.
Target/Walmart/BestBuy. They both have fast shipping options as well as store pickup. Sometimes (if you live somewhere more rural) they have _faster_ shipping times than Amazon.
Walmart / Home Depot / Lowes / Kroger are generally going to beat Amazon on quickest delivery for most people for most items, if they want to, by virtue of their local brick and mortar footprint.
One reason I imagine Amazon pushed so hard for short delivery times was knowing eventually their legacy peers would leverage this against them.
Not to mention a long delivery time gives people more opportunity to simply go to the store and get something, while they’re out running other errands.
I live in a well populated suburban area. If I’m willing to actually leave my house, I can get most things much faster than Amazon can deliver them. This also helps keep those local businesses running, so shipping doesn’t become the only option in the future.
I live in the country. Amazon takes days to ship out here, though sometimes it has 1-2 day. Walmart has same day shipping (not delivery, regular shipping) and is cheaper or comparable to Amazon.
but then how do you pay for things if/when you want to buy the little one something?
you either add the card then remove it, get a separate card, or find a way to use credits somehow -- but in the case of the latter two, Junior could still slam a few buttons and eat up all available funds on that card -- just without the impact of your regular card.
This is something that Apple really got right. My kids can initiate any kind of purchase they want (At least, those that are allowed based on Screen Time controls) but every purchase stops and waits for approval from me or my wife. Even if the item is free. No faffing about with credits, or extra cards, or setting limits.
Just use a bank with a decent service (like Revolut), create a separate card number for your kid (10s within the bank app), where you put more money when needed and can easily put the number on hold or activate it whenever you please.
> After the publication went live, Revolut reassured that the review is still ongoing. "We have so far still found no indications of any breach."
> "We have checked the user and card identifiers contained in the alleged records against our systems, and none of them correspond to valid or genuine Revolut identifiers," the spokesperson said.
The parent had a practical problem. I told him what kind of simple banking feature would easily solve it. I also mentioned a bank, which has it for sure.
For sure, this feature is not a Revolut-exclusive. Plata from Mexico should also have this and much more, from what I have read.
If American/European banks don't have such a simple feature, this speaks volumes about them.
Your comment has a vibe of "a bank that doesn't have a local office has no decent service". To each their own, I guess.
I mean, you can gift things when you purchase them, not sure why that can't be a way. But I still agree it's silly to have the customers find work arounds.
I think this is the biggest reason why these category of discussion happens in the first place, there is a gap between what technology is good for, whats its ideal for and then the products motivation to push it on to the user assuming it would give a good name to the company.
Passkeys are one of the few protocols that supports against phishing (Accidentally giving away your credential to some rough site) so it has its benefits and more so for enterprise users.
It becomes challenging and is ill suited when its pushed to general public. A middle ground could have been to give it as an option to user instead of forcing it on the user. For some reason its not cool enough.
From a company's perspective
- Authentication is a friction and the discoverable credential (where you just click on username button and log in) reduces the friction for user, making it easier for user to make that purchase decision
- Account take over attempts (ATOs) do take a dip, saves quite a lot of resources on customer support side for the company
Account recovery works the same with passkeys as with passwords. You click “I forgot/lost my passkey” and get a link sent you via email that lets you create a new one.
Passkeys can also be shared with other people like spouses or friends, just like passwords.
> Passkeys can also be shared with other people like spouses or friends, just like passwords.
How? They're literally designed to not be, because they're trying to prevent phishing, and you cannot in general case distinguish phishing from legitimate delegation of authority.
Oh right, I started to notice it too - couple non-tech people around me seem to treat "password reset" as default login flow, and definitely don't complain as much about auth flows as the rest.
I guess that's one effective way to cope with security industry bullshit.
And now you have to log into your email with a Passkey that probably you lost at the same time you lost your Passkey to the original site (e.g. lost or stolen device).
If you are not using Passkeys for your email (and the site supports that type of account recovery), then you still have only the security of passwords, just with additional steps.
Well, it puts people in a bind. The current status quo of TOTP 2FA with recovery codes is bad, but it's probably the best we have - because applying passkeys to your primary e-mail is beyond stupid at this point, it's putting your digital life in mortal peril.
> Account recovery works the same with passkeys as with passwords … get a link sent you via email
Making the email account, an often attacked resource that is always online, a single point of failure. I don't mind relatively unimportant accounts being that weak, for instance where the only reason to have an account at all is to separate your preferences from someone else's, and you don't actually care about security, but for accounts where there is significant PII or payment details or other sensitive information it is a terrible idea.
A second problem with this is that for many their email account is the same as their account where their passkeys are backed up. What if you have lost your passkey due to Google locking you out for no readily apparent reason and you don't have the online influence needed to get them to take you seriously (instead being trapped in the support bot loop)?
I still run my own mail server, and if I didn't my important mail accounts wouldn't be with someone like Google (I do have a gmail address, but that account is only really used for testing other accounts when needed), so that isn't a problem for me, but most people can't be bothered with that faf¹ so usually end up with one of the big providers.
--------
[1] It isn't actually that much faf², until those occasions when it is³, but more faf than most people care for, especially those that don't enjoy tinkering with technical matters.
[2] Just quietly ticking over as long as I remember to regularly verify it is patched up-to-date, and keep an eye out for zero-day issues concerning the parts involved
[3] When there is a deliverability problem, where I host it has problems so I need to make sure the backup is synced and then switch over to it, when there is a relevant zero-day and I have to rush a patch in (or take other remedial action until a fix is available) then investigate to make sure I wasn't quietly affected, etc.
I guess it really depends on how one choses to define general public, probably an assumption has been made that everyone has their own personal device.
> Built-in password managers are great for this. But they’re not universal (e.g. I believe using Apple Passwords on Mac doesn’t carry over to Android.
1.Only security keys (single device credentials) are what you can use across the device not the regular platform based one
2.Browser based password managers do provide you with that interoperability across the platforms and in fact the password manager as an supported passkey authenticator allows you do the same
Amazon does benefit from increased account security; they don't have to refund non-fraudulent orders after all. For most people, a passkey is genuinely more secure.
Amazon and PayPal are horrible for this. Clicking out of the dialogs and modals to actually get logged in? (Shout out to PayPal for a dark pattern that implies "continue to login" but is actually "continue to set up PassKeys", and you actually need to "cancel" to actually login).
I think it is simpler than that: they ask irritatingly often, and I'm often looking quickly to see if I can get something on next-day delivery, so the two factors coincide.
Sony Playstation will only let you setup a passkey if you disable password auth.
But I have not found any way to use my browser's passkey to login on my PS5. I can scan a QR code, but that requires logging into the mobile app with a passkey. And I can't add one to my mobile phone because I can't login on mobile... the passkey is on my laptop, and it won't autofill from 1Password (Android).
> But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own?
at least in Apple land, if you try to sign on on a device that you don’t own (let’s say a work laptop where you’re not signed in to your apple id) it’ll give you a QR code to scan with your iPhone and it’ll do faceID on your iphone then do some bluetooth handshake to use your passkey on the other device. I’m not sure if this is Apple exclusive or if android/windows/linux would be able to do the same
If passkeys were implemented properly, the would be most useful to relatively technical users that already use password managers. Ideally, the only real change is that a single text password is replaced with multiple non-text "passwords" that cannot be entered on the wrong website by accident.
The problem is exactly that they're being forced on nontechnical users when the UX isn't even good enough yet to sell them to technical users.
I got a new cell phone and installed Microsoft Swiftkey and tried to login to Microsoft. It said my device's password or security manager would popup, but it never did and it never showed an option to login via password, just a mostly blank screen. I tried logging in from my laptop browser and it immediately tried using a passkey, but I've never created a passkey for Microsoft, so it errored out, still never showing an option for password login. I tried again and it errored out again and FINALLY showed the option to login via password. It had to fail 2 times to finally show the option for password login.
I was finally able to login via password, then had to go to Microsoft's passkey management page to create a new passkey, store it in 1password, and use that on my phone.
I'm a software engineer and it was annoying and time consuming and took a minute to figure out. How are non engineers supposed to even use this crap?
In the Apple ecosystem this is trivial - you select to sign in using a QR code which you scan with a device you do own. It works perfectly in my experience (of using them wherever possible for several years)
This. My simple brain is always like...."This passkey is going to be lost and only usable on this machine and I don't even trust that to work consistently because I do weird stuff sometimes"
> how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
I agree with you 100%, although I will say that it seems like newer OSes (perhaps it depends on the desktop + mobile combination, or maybe Chrome + Android is enough, not sure) have a way for you to use a passkey from your phone by scanning a QR code. I still think it's not super user-friendly but it is a clever workaround at least. Most people are accustomed to scanning QR codes, so scanning a QR code from your phone to sign in seems like not too big of a leap. (Although I wonder if it conditions users to scan random QR codes to sign in which could be a bigger phishing problem lol...).
I haven't articulated my thoughts about passkeys nearly as eloquently, but you did an amazing job here. This really sums up a latent problem I've had with passkeys.
I have a passkey on CVS, but that YubiKey was eaten by the sewer.
Thankfully I can still log-in with a password & text. But how to reset the passkey? No-one knows.
Edit: I take that back, for some reason they stopped taking the password I used when setting up the account. It's only email or SMS with code verification + birth-date.
As an IT manager weak and/or re-used passwords are an absolute scourge. Ideally every time you set a passkey you'd also add an OTP Authenticator factor as fallback. Passkeys are incredibly useful and relatively secure when pair with biometric authorization (touch/face ID). I agree with a lot of the points about consumer level use, but still think they're net positive compared with bad password (re)use. I'd advocate for email recover as a decent fallback, but there's only so much you can do when the average user won't establish a base line of security for their primary account and access point.
Security is frustrating and it's hard to get people to do the bare minimum to establish secure access to their services.
> But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
This is meant to be solved by the cross-device flow - a QR code pops up that you scan, and a secure channel is established from that with your other device.
[Disclosure: an editor of said standard]
> The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for.
On macOS/iOS, the system gives this prompt regardless of where your passkeys are being created/stored:
Save a passkey?
"<site>" supports passkeys, a stronger alternative to passwords that cannot be leaked or stolen. A passkey for "<username>" will be saved in "<provider>".
There is a transparent upgrade option though that sites can request - basically when a site supports passwords and passkeys, they can request a password manager supporting both create and return a new passkey on password sign-in.
> [...] and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
That's unfortunate. A site/service should absolutely not replace other passkeys, nor should it remove other sign-in options like passwords, without explicit user consent.
The above credential upgrade flow makes that doubly so; even if someone relies on a password manager to manage and provide their credentials for a site, it very well may not be the singular piece of software that does so.
> This is meant to be solved by the cross-device flow - a QR code pops up that you scan, and a secure channel is established from that with your other device.
That only works if the device has working camera and bluetooth. What if I want to log in from my new desktop PC to an account whose Passkey is stored on my old desktop PC?
I agree 100% i learned that my old school with whom I had linked to my windows computer and finished my degree with one day required passkeys rather than passwords on all devices. This force locked my windows PC back to passkey mode luckily I remember recovery account and got a passkey to work. But it took months to figure out why I had to use it. All the help board were said just click this button which was grayed out. Or set this register key which auto repopulated. It was an awful experience. I like my password as default
Ah yeah, Microsoft has this awful habit of just hiding the buttons for actions you don't have permission to do, which makes me feel like I'm being gaslit sometimes when a guide says 'there's a button right here' and there's not, and I've no idea if the button was just moved or if not, why it's not available (sometimes it's because I don't have permission, but sometimes it's because it's a different product with the same name and branding as a completely different product).
SSH keys are much easier to use and understand. Heck, passkeys could have just been a ZIP file holding a key-pair instead of whatever hostile design by committee we ended up with.
If they actually worked like SSH keys that would solve some of the problems with them. (like keeping a backup that you can still enroll into new accounts without it being present).
I'm was tempted to come in here and say "you're holding it wrong." But then I quickly realized that I had to spend weeks changing my behaviors and messing around with devices in order to get it to work correctly.
As someone who's OpSec puts swiss cheese to shame Passkey has been a godsend. My passwords are actually much better because of it.
If you have to use passkeys, try KeePassXC and KeePassXC-Browser. I used them to set one up for Amazon a few days ago, as Amazon now forces passkeys as of this month, at least for my account. It was relatively painless.
Devices that break or get lost, and then either the user had password authentication activated all the time anyway in addition to the passkey, or they have the classic "mother's maiden name" recovery path, or they get locked out of their account.
Brilliant security: a highly secure high-tech shiny front door that can randomly fail to open, so you still need the low-tech back door, which is the one potential thieves will use.
Mind you, it can work if the back door is old but sturdy (basically, for a bank that will ask for KYC authentication, or in the worst case you can set foot in the brick-and-mortar branch showing your face and ID and ask for access) but for pretty much every other service it introduces risks for very little or no gain.
The point about poor support for 3rd party managers is so frustrating. Because this is correct, that is the obvious solution for the normal user, but passkey implementations somehow do not know how to deal with it.
Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.
And the confusing mechanism hurts there too: I'm always a little bit afraid that i'm somehow more in danger because I keep them in a vault that's shared on all my devices rather than a TPM, because whenever the protocol is explained the "it can't leave your device" part is highlighted as the main source of the security, except.... mine obviously do leave my device, with the vault, so.....
> Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.
What setup are you using? Because I don't have that problem on Linux + Firefox at all
Linux, Mac, and Windows (i happen to use all three regularly for work, hobbies, gaming), Firefox + Bitwarden.
It's totally possible there's something specific about my situation, or the way it was set up in the first place that enables this, idk, but somebody else replied saying they have the same experience so it's not just me.
And even if it was just me, it's still clearly something wrong on the provider's implementation, because it should not be possible for software to sidetrack the user to create a passkey, when that user logged in with a passkey to open the current session.
I will take a wild guess (based on that you are using firefox) is that you probably have enabled the various don't save cookies, clear sessions on close or other hardened privacy settings that are the source of 99% of problems firefox users encounter, like increased cloudflare captchas .
Could be! I don't recall turning things like those on, I use firefox for features not privacy, and mostly leave stuff like that at their defaults, which I trust Mozilla + uBlock to filter the invasive trackers while leaving actually useful functionality, but it's possible I fiddled with it years ago and forgot.
Some probably kinda strong counterevidence to that though is that this doesn't happen on all sites, only Amazon. I've never been prompted to make a new passkey after passkey login on the 12 other sites that I have passkeys in bitwarden for.
Very strange! Whatever the bug is, I hope Amazon fixes it.
It's quite crazy to just surprise a user with a passkey in any event, even if they get saved and don't reprompt you. Suddenly spawning an OS popup without any explanation, which may or may not try to ask for biometrics, is crazy.
> Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.
I haaaaaate this. And every time I'm like, "do I not already have one??" Passkey implementation has been half-assed by everyone.
> Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.
I use 1Password and Amazon does not prompt me like that. However I do have two passkeys for Amazon, one in 1Password and one in Apple Passwords. There's not enough data yet to say if it happens to you because of something not working right between Bitwarden and Amazon, or something about Amazon doesn't work right if you don't have a passkey in your OS passkey store.
Might be worth adding a passkey for Amazon to your OS passkey store and see if the problem goes away. If it does, blame Amazon. If it does not, report it as a possible bug in Bitwarden (altough it still could be an Amazon bug that just happens to mess with Bitwarden but not 1Password).
I don't have any issues using Bitwarden as the default password manager on any of my devices, except the occasional Android/Google issue with apps where it opens the Chrome passkey store and doesn't prompt for Bitwarden.
But websites pretty much universally trigger the Bitwarden passkey prompt, or I can bypass via the popup and go to the OS passkey manager.
I've resisted passkeys for some of the reasons listed. I use third-party password managers, they're device/system independent, and I can export the data when I want to. I don't see passkeys as a big advantage, or perhaps I should say the bigger advantage isn't really for the _user_.
Of course, at the rate we see security failures everywhere, I'm not entirely convinced writing your passwords on post-it notes wasn't such a bad idea after all.
Keepass2Android without network permissions saving the file to a folder monitored by Syncthing is pretty good though - it keeps responsibilities nicely separated.
I actually prefer non-resident U2F in some ways. You don't have to store anything on your key, you are just signing requests. This is relevant where U2F/FIDO keys have limited slots for 'resident' keys.
In principle, it's great. You have one good password to remember for the average user, and that's enforced by their device's probably good enough security posture.
They are resistant to being phished and they won't reuse the same one everywhere. They then don't end up going from hunter2 to hunter2! everywhere.
But my experience for users is that they worry they are giving their biometrics to Amazon or whoever and so the UX just confuses them.
The certification aspect was new to me too last time passkeys came up. Sites can require that a given passkey has been certified.
The patchy support for them is also frustrating. MacOS does not support NFC FIDO/U2F. iOS does.
Absolutely! U2F keys are unlimited, but I only have so many slots on my hardware key. And now sites are moving away from supporting U2F towards a passkey-only model. No! I have limited slots!
I don't want to have the security sensitivity of my devices be escalated by the fact that I access a very important service with that device. Currently I have separate passwords and a 2FA on my investing and bank accounts. I don't want to have to treat my cheap travel laptop as a SCIF because it is synced with my cloud services and has passwordless access to my entire financial life.
580 comments
[ 0.23 ms ] story [ 42.7 ms ] threadIt's entirely one sided solution.
Like, no company should be storing anything but a salted hash of their users' passwords.
Ironically on macOS we used to have an app called Keychain which unfortunately was effectively renamed to Passwords for non-technical users.
My bigger problem with passkeys is how there's no universal way to register more than one device (in case the first one is lost).
Proton Pass is a specific way to do that, but not a universal way. Bitwarden can't use proton pass to move keys around, google can't, firefox can't.
Tada, passkeys.
Are you part of the 99.99999% users of one of iOS+Apple or Androidlike+Google/Tencent or HarmonyOS+Huawei? If that's the case, you don't need to as the key is automagically saved by your OS' platform and synced with your new device.
Otherwise, you're such an extreme outlier that you probably either know what you're doing or can find out by yourself, right?
This absolutely does not encourage confidence in me. We all know how easy it can be to get locked out of a Google account and have no way of getting back in unless you have enough clout to make a huge noise online so a human there pays attention instead of you being stuck in the 'ol support-bot-run-around loop. It doesn't happen often when you consider how many users there actually are out there, but the potential inconvenience is high enough that “fairly rare in the grand scheme of things” is still enough to be reason enough to be wary.
To your point, I for example would add point c) - Is linked to the device you are using currently. If you want to use another device to log in you are in a world of complexity and pain.
Sure, its explained. But not in a satisfactory way that would reach all users at their level.
This is a bit of an exaggeration and out of proportion, but I think my ideal would be one of the big tech companies should have bought out something like a super bowl ad. Something that actually conveys the idea "hey, we know you've used passwords since you were able to type on a keyboard, but here's new technology that's better and here's why" in plain language that the average person can understand.
Unfortunately, XKCD 2501 continues to be relevant. [1]
[1] https://xkcd.com/2501/
If it's that unclear to me, I can't imagine how it can be to the average user.
The way they explain them is atrociously unclear, borderline negligent for services that nag people to activate it for accounts where they may hold valuable data for their personal lives. And while I don't want to spend much time finding out the details as long as I have the option to decline them, I suppose if they can't explain it and convince people of its advantages, it's because it's just bad tech.
That's what OS level user accounts are for. Tbf
> "what do Ineed do to login from an airport computer?" or "what should do if my phone is stolen?"
Indeed I don't know the answers to these either if I wasn't syncing passkeys in 1password. Honestly we should educate people to use password managers more than any thing. It's also a smaller jump than to passkeys. Passkeys can be more of an advanced convenience feature after they get used to using password managers already.
That's a pain point in everyone's day that should make the benefit easy to understand.
Logging into a site with your device is like putting your card into the terminal. The site can ask for a password the way the terminal asks for a PIN, but if your device supports Passkeys, that’s like your card having a chip, and it’ll use that instead.
So think of Passkeys like using a chip card.
I dunno how well this analogy works down to the last detail but it has gotten it across to all the parents I’ve used it with
The purpose of rotating passwords is to cycle out potentially compromised ones, due to phishing attacks, keyloggers, shoulder snoops, etc. But those cannot exist with a passkey.
What kind of compromise are we talking about? Was the device stolen? Then yeah, you need to rotate passkeys (and all your passwords, and remotely cancel all your live sessions, none of which is new).
Was the device hacked from afar and the data read off of it? The passkey is probably fine. You can rotate it if you want to, it's not a bad idea, I probably would to be certain, but you're not pwnd even if a bad guy got a shell for a while, heck even if they got a root shell.
I understood the question to be "should passkeys be rotated regularly" to which the answer is probably no because there's not really a compromise mechanism that periodic rotation defends against as far as I know.
Rotation defends against secrets that leak through normal use and without your knowledge, like a password entered into a phishing page or snooped over your shoulder or cracked from a breached hash. Passkeys aren't vulnerable to those things because they never travel over a network, are never seen by the server, are never seen by their own users.
You change the locks on your house when a key goes missing, or is known to be in the hands of somebody you don't want getting in, it's not something you do every three months just in case. Same with passkeys.
there's some issues with passkeys, but not being able to memorize them is a feature
For the average user, which doesn’t use a password manager, this is great. It means they can’t get phished. And it’s also great for the average password manager user, who keeps dozens of insecure and reused passwords in their vault because they manually thought of a password when signing up instead of randomly generating one.
If you’re already using a password manager and random passwords, the UX is designed to be the same. It’s just a way to get regular people to do this.
In that case, they've completely and utterly failed.
And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".
The reason is the ever increasing number of hijacks of social media presences and code hosting portals, with the latter being a serious financial threat. Done right, passkeys stay in the Secure Enclave, at least for anything Apple and most of the Android sphere. There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
Click "I lost my device", enter contact, get a reset link via email/sms
I’d buy that there are too many different confusing ways to recover from this situation, but not that it’s impossible
Fun fact: Google can decide to reject these. Lose access to the original device, try to rely on recovery codes to login with known current password on family member’s device… nope!
When you upgrade your phone perhaps keep your old one in a safe and charge it and login to Gmail monthly or something?
I’m also quite certain the codes could work instantly with no trouble in some circumstances. Now know it’s risky though. And I’m sure it’s a security measure based on real, deeply painful and costly instances of unauthorized access. Just don’t know what we’re exactly supposed to do…
Passkeys could be the savior of all security problems worldwide from a capability point of view and tech companies would still ruin it by trying to push or force ways it pushes you into their ecosystem instead of just being whats both secure and convenient.
Passwords with 2FA are simply better and more freedom friendly.
Though realistically I use a passkey for services I care about and a password manager for the rest.
How often do people lock themselves out of their own house? Don't you know anyone with ADHD? Imagine any time that happens it is mathematically verifiably permanent as a fact of reality itself. It doesn't matter that the state still views you as the legal owner, you are never allowed in ever again.
But if true, that means that Google can choose to not provide you a recovery service, which is functionally the same as them not having it.
If Google does want you to be able to log in then they will work with you to make that happen, whether you forgot your password, lost your passkey, or your carrier pidgeon died.
Passkeys are not special in this regard at all. What does make them special is that nobody can use a phishing attack to steal your passkey and log in to your account. Nobody can guess your passkey and log into your account. Nobody can intercept your passkey in flight and log in as you. That's the important distinction.
Even if you throw your phone into a volcano and buy a new one, you can still receive SMS verification.
Passkeys only very recently got relatively broad support for migrating data (after years of promise and no support at all), and they report (optionally with hardware attestation) what password manager you're using so sites can force specific ones.
I believe that by allowing password managers to store passkeys, the whole purpose of "device based security" got lost..
And yes, I know the happy path of password managers uses host-based autofill which does add some friction to phishing attempts, but given the prevalence of unexpected but legitimate urls with weird alternate subdomains/SSO/redirects in modern login flows, you have to manually autofill/add an exception often enough that it's possible to let your guard down once at the wrong time.
The most flexible, independence preserving thing to do is to use a third party password manager like Bitwarden, and make that the default passkey flow for your devices. If desired, you can self-host something like Vaultwarden so that you can both keep the keys independent of third parties and walled gardens and also propagate them to other client devices.
To be clear I'd much rather not have learned / implemented any of this, and I don't use passkeys unless forced, but this seems like a valid coping strategy.
But they also introduce single points of failure, as the article points out. I can't even remember how many times I've had to help a family member recover their account or get confused when they can't sign in on a new device. It's incredibly frustrating that this flow is promoted as the default for so many services.
1password is the best solution I've found for the average person. It's not perfect (it's definitely more complex than writing down your passwords on a piece of paper or using the same password everywhere) but it's much easier than juggling yubikeys. I know so many non-technical staff members who prefer the OS or browser keys even if it means another account recovery is lurking around the corner.
<<ducks>>
But for regular end users where services are primarily motivated to take money from those users and lock them into their ecosystems, they are a usability disaster and yet another exploitation vector.
It's one solution for two very different usecases, and it just does not work. There is an approach that could work for end users who own their own accounts, but they need to go back to the drawing board and rewrite the protocol with the assumption that the keystore is hostile to the user's interests. That means strong guarantees on key portability so users can migrate away from hostile keystores, and absolutely no ability for services to restrict the user's choice in passkey provider software.
This is a big part of it. An employee at a business will be able to talk to someone in person and say 'I can't login. Can you reset my password?' or whatever equivalent, and be made whole. Even if the business is is made up of 10000 people and the identity of the employee is for some reason in question, the situation can still be resolved with a passport or a driver's licence.
Google is never going to make you whole again if you're locked out of your account, unless you're a celebrity and make a stink. There is no help desk where you can prove who you are (and even if you could, would you want to? That's a whole second domain of problems that I'm not sure will ever be solved completely).
Password managers are great IMO, I can use some absurdly long password, backup is reliable, I can use them across devices. For extra secure stuff 2FA works the same, I've got an app with codes I can easily back up and use from multiple devices.
Passkeys tend to obscure everything and take away a lot of control.
I proposed an alternative scheme many years ago: https://www.researchgate.net/publication/343318317_Privacy-a... . By allowing "offline" keys you can also treat them as higher priority, and use them to revoke any lesser keys from attackers if your account is compromised.
It would also be nicer to get rid of usernames, but that's a fight against the data-gathering powers that we're unlikely to win.
Same as traditional physical keys, you don't have a single key, you have multiple ones precisely so that if you lose/break one, you are not stuck and can go to the local locksmith and get another one in minutes.
In fact it's even nicer since you can just re-use the backup key with no security loss by revoking the other one, and buying another key.
I have multiple identical ones.
> [...] and can go to the local locksmith and get another one in minutes.
Can I go to the digital equivalent of a locksmith (like a backup software) and duplicate my passkey? Can I do that with only my passkey in hand (without having to do anything to the corresponding lock, or having to contact its issuer), like I recently did with a physical key?
So if we are enforcing MFA requirements and allow this kind of clonable key, then we should really require some other factor that is not clonable.
That's the core silliness of this whole passkey mess, IMHO. So many turns of rhetoric and weird compromises, we have cargo cult security and no real understanding of what security level is in place.
Instead of the best of worlds, we can accidentally have the worst of worlds without realizing until it is too late and we're painted into one of those ugly corners.
If you have a photo of a traditional metal key, you can duplicate it. AFAIK, there's also a numeric representation of the height of each position on the key; if you know that number, you can duplicate the key. A traditional metal key is more like a password than most people think.
That's not accurate. Bitwarden syncs passkeys across all my devices including both mobile/desktop (iOS/Android/MacOS/Windows/Fedora) using Chrome/Edge/Safari (I haven't tried Firefox).
KeepassXC is an open source alternative for cross-device synced passkeys. Marginally less secure than device bound passkeys but it's seamless and I save so much time now being able to login with one-click everywhere instead of wasting it on arbitrary "let's make sure you're you" MFA nonsense.
I can see why they would be problematic for people who otherwise live life with a single love2025 password though.
Passkeys are great. The Apple passkey experience is seamless. They just work. Anything else is poppycock of the highest order.
Or do you demand that the user has an email with that 128-bits authn too, with a key on the same phone that was lost?
If the worry is your phone getting lost then use a password manager that syncs to the cloud and log in with the same passkey using another device. I just got a new iPhone and logged into a bunch of things on-device using synced passkeys. It worked just fine.
Every conversation about this seems to involve someone asserting that improving upon passwords in any way at all is unacceptable unless the solution is perfect in every possible way, with the goalposts constantly moving.
I can't think of a single time I've had a passkey forced on me, but that nonsense sits at the core of every passkey related post.
If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
Sad reality is that such usecase is less and less common, thus, no one cares about it. I think majority of my friends would not be able to access their email, or facebook or alike, if they were forced to use my computer in emergency.
And many are moving to virtual wallets like Cashapp rather than banks with a physical presence where you can take out money without a phone.
It’s a bad situation.
Person 1: "People that end up in this situation that can easily happen should be punished to the full extent of the law with no mercy!"
[Exact situation happens to Person 1]
Person 1: "This is the greatest injustice, do people have no empathy? I could not have avoided this situation!"
I've definitely done this, but not sure if the workflow was at the OS or browser level.
I'm honestly confused by all the negativity in the comments. Passkeys are great for convenience. Just leave your password login enabled as a backup. That defeats any security benefit, but oh well.
For people in this position, if they had their phone, they probably wouldn't be logging in on a computer anyway.
Some sites allow passkeys as an option for MFA, so that could be an issue if the passkey is your only MFA option and MFA is required. But I imagine email would pretty much always be a fallback.
I don't know if they fixed it, they probably did. Edit: Maybe not, because the recovery option at the end is just nuts: https://learn.microsoft.com/en-us/answers/questions/5454924/...
For instance YouTubers usually have a different account for their channel than the one they use privately, and don't want their channel account logged in everywhere.
That means having to log in as a guest when push comes to shove. And similar setups are common for most self-employed keeping a "work" account IMHO.
Some password managers will only fill if a domain matches, but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in. I've also seen lots of them do stuff like happily autofill on any prefix of the domain, so your credential for `something.example.com` will autofill into `fake-something.example.com`.
Why would you trust the very same password managers that don't handle passwords properly to handle passkeys properly?
The passkey integration goes the other way, which is much more reliable.
I've seen people do this AFK as well, and I'm always helpfully suggesting them the correct way of solving this: verifying the URL again, and if correct, add it to the password manager so it remembers in the future, and never copy-paste passwords on the web. Basically 50/50 if they take the advice or come back after a week asking if it's safe to copy-paste the password into the website, and I try to inform again.
Shockingly, I saw one developer peer copy-pasting a password into a website, but I guess for these people there is no hope.
Historically I've seen lots of sites do a subdomain shuffle for login pages every now and then which routinely breaks domain matching, introducing false positives that users have to deal with, making them numb to the threat too. Passkeys baking in the domain check with no workaround means that sites can't do that, which is a benefit.
I've tried using the Firefox integration in the past - more than once - and I don't know... it had so many warts that I got fed up with it and turned it off. And now I have 1Password (from work) also doing its best to feed me credentials all the time. So trying the KeePass integration again is going to have them both drawing suggestion dropdowns all the time..
But ok, I'll give it another honest shot. Because of your comment.
Same thing is going to happen with passkeys for non-technical users for exactly the same reason you stated. People will think the integration is busted and manually copy/paste the non-passkey credentials in. In that way, I would argue that passkey is not stronger protection against phishing attacks unless its the only way to login. It is, at best, a convenience for users.
This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport). iOS and Android support this, and it’s generally not a locked-down thing if other devices wanted to do it too.
The only use case left is in “how do I login if all my devices are stolen/fall into a body of water” in which there really isn’t an answer beyond “get (a|your) device back, sign back into your password manager, use that to get back into critical accounts”.
And yes, Google or Apple - dont say you should not keep passwords in your database and sync it with dropbox. DIY.
Rest of us want convenience.
FIDO2 USB Security key -> Bitwarden (With master password) -> Every other method (topt/password)
I have 3 FIDO2 USB Security keys, One I carry with my persons at all times, one that stays with my main machine at all times and an offsite backup that is sitting in a friend's server, if my house burns down, I can either physically collect the key or use USB-IP to authenticate back into bitwarden and enroll a new key. (Actually all 3 are at home right now but that's ok)
I am a doctor -- and a lawyer and an orbital mechanics specialist, as well as a highly respected behavioral therapist -- so you can trust my advice. Also, feel free to consult an AI on this topic; it would make for an amusing benchmark.
I suspect that most people that ostensibly do this actually only enroll one for non-critical accounts and then depend on some fallback mechanism.
I’m not sure what work has been done on this since Mozilla Persona. I certainly wouldn’t want Google and Apple, or governments, to be the sole gatekeepers.
A third party OAuth provider puts you at the mercy of the service provider, the other can work fully on your client side even if the app provider were to disappear tomorrow.
The only advantage I can think of is that you have a centralized place to revoke credentials in case your password manager does get compromised.
This two fatal flaws are what limits their usefulness to enterprise SSO and perhaps some other limited uses where the organization has the ability to replace tokens. (Even in a distributed enterprise, enterprise SSO may not be a good fit for hardware tokens, if they can't get replacements out to employees fast enough).
Yes, this is the issue. People don't like how adversarial security people act, and how they force things onto people. It's fine if a corporation wants to have some internal policy since they're the ones eating the cost if an employee can't work or whatever. Less so if individuals are forced into these wonky setups for no benefit (e.g. now I have to run and maintain and backup a Vaultwarden server just to log into my HSA, which is absurd).
Ok but how do I share my Netflix or Spotify accounts for example with those?
However, passkeys can and are available to be shared via password managers. They’re not locked to the secure chip on the device where they live usually. iOS’ Passwords app has a share button and 1Password lets you share passkey-containing items.
In fact, the QR code login feature makes it even easier to do a one-time sign in to your account for a friend, if you don’t want them to be able to login to your account indefinitely.
0: Netflix doesn’t support passkeys because their main audience is people signing in via smart TVs and whatnot, which largely don’t support CTAP or Webauthn in general)
Me to said companies: I will do what I want.
If they also allow passkeys as an alternative form of login that doesn't need 2FA you can use those to make the account sharing more secure.
When setting up sharing with someone first change the password to something else, and then share the account name and password. After they log in the can add a passkey to the account on their device or devices.
Then you can change the password back to your real password. When they want to use the account they login with their passkey.
If the service doesn't accept login passkeys but does allows passkeys for 2FA, you have to use real password sharing, but at least they can have a passkey for 2FA which may be easier than how you know handle 2FA.
How do people handle 2FA with account sharing? If the site uses TOTP you can give them the QR code that you received back when you made the account (you do save a screenshot of such QR codes for backup, right?).
But how do you handle SMS 2FA, which seems to be far more commonly offered than TOTP?
For email 2FA I suppose you could set up a filter on your incoming mail that forwards any incoming code emails to the people you shared with, and hope that the time limit on the code is long enough for this to work.
This isn't a thing. Discord's QR Code scanning is entirely a feature they made unrelated to passkeys or bluetooth. Passkey auth using a QR code has a step that verifies the proximity of both devices using BLE.
In the same vein as 2fa, going up to a fresh computer and trying to log into anything is now a nightmare. Every service has a 2fa that somehow loops into another provider that also has 2fa.
And some 2fa, if not many, make accounts weaker. Apple's solution to get around 2fa is to put in SOMEBODY ELSES phone number that I trust, as a backdoor. It's an insane solution. And its normalized, and nobody questions it.
its just three additional passwords.
should you type the same brother name in each time? should you even answer with a name?
don't get me wrong, they were insane, but they can be repurposed.
Then you at least have the option to craft a question which is memorable, specific, and unique.
* "Where is your first pet buried?"
* "While on vacation, The Noodle Incident happened in which city?"
* In what year did you first see Example Band live in concert?"
Also in the process of helping my dad with his phone, 76 and my grandmother 99. Maybe this works better with Apple, but the biggest problem on Android is, that it feels like every update shuffles everything around. Allmost no point in explaining, that they can solve some things on their own.
And all the time new things on the screen, new features they don't understand, need nor asked for.
I just made one for PayPal using my MacBook which seems to have ended up in Bitwarden rather than the mac thing. But there's nothing in Bitwarden to say list all passkeys. Not sure how I check elsewhere. Maybe they should email you "you have created a paypal passkey in Tim's Bitwarden" or something. Then at least you could search the email for "passkey"?
I wonder if I can use Bitwarden on another device with that? I honestly don't know.
I for sure don't. Websites only know there is a passkey associated with my account, and the OS only knows there might be one on the device, or maybe on another device, and offers me options to check here or do a Bluetooth/QR Code dance, and when all of them fail, I'm no closer to knowing where the damn passkey is.
The only downside is unlike a house key, you can't get a backup "cut". Copying a physical passkey currently isn't possible. If you lose it, you've lost access to all your logins. As the article says, their recommended workaround is to keep backup physical passkeys, and log all your passkeys (including the backups) into every site. Which is insane - very few people have the patience to do that.
The article is really a long rant about that one issue - there is currently no way to securely backup a physical passkey. Solve that, and all the other issues melt away.
He didn’t have access to it the other day and we needed access to his account. He didn’t remember his password, and we were unable to reset it because you need the passkey! No other options to authenticate for a reset were available.
Add in the fact that I was trying to help him with this by long distance call and you can imagine the frustration.
One of these days the product managers who push these things thinking "oh, it's easy, you just . . ." are either going to be explaining it to confused Mom or Dad, or they're going to be elderly and irritated themselves. Until then I hope they stub their toe or step on random Legos regularly.
Originally it was about difficulty migrating to a new laptop with a different version of Windows, but I was quite firm about it because when I realized it wasn't able to do secure connections for some reason, so the instant they took their laptop to public Wi-Fi...
However the GitHub edition (not Sourceforge) of Eudora2Unix [0] saved me and deserves a shout-out.
The migration wasn't perfect, (some file attachment issues linger) but it's better than having it all locked up at risk of Eudora.exe just refusing to start one day.
[0] https://github.com/jonabbey/eudora2unix
It’s been fine.
Practically, it is a huge challenge. I would want my day to day fob, an onsite backup, and an offsite backup. That’s a lot of hassle and potential for mistakes. To even register the offsite backup means I need access to it. Remotely copying a password database is so much reliable
Google treats both a password and a passkey as a primary factor, and if you forget either of them you have to go through their account recovery flow: https://support.google.com/accounts/answer/7682439?hl=en
AFAIK there's nothing different about the recovery scenario for a Google account in that state regardless of whether it has a password in use as its primary cred, a passkey in use as primary credential, or both.
Would be nice if Google would lay your recovery options out for you (which I am used to it doing in regard to 2FA if you are doing a regular log in) instead of having to hammer the “Try another way” link repeatedly as it cycles through options.
So, if you are used to the "Try another way" flow on login, it can be confusing to see an entirely different "Try another way" flow on account recovery.
Oh well.
No doubt there exist services that do not offer recovery method for passkey or mfa enabled account. But this is entirely on them (the service), to blame for, not the passkeys or the users. It’s bad implementation.
You scan the qr code from your phone and it logs you in on that device. The experience is pretty amazing, honestly.
The tragedy of passkeys is that they're a step back from the security offered by the likes of Yubikeys.
But because passkeys are pushed by both Google, Microsoft and Apple: there is is simply no fighting these three. It is impossible.
Passkeys won not because they're better (they're not and the entire concept of "secret behind a hardware security module" that can be transferred to another system defeats the whole point of a HSM in the first place) but because the powers-that-be decided that passkeys are to be used.
It's still a win: the commoners are better served with passkeys.
But a secret in control of Google/Apple/Microsoft that can be backed up is not a secret I control: it's a complete step back from yubikeys.
Passkeys won and we better get used to them (and, yup, there are usability issues as you mentioned).
My irritation is that I know what it is, and I've said no thanks many times, but I'm still asked regularly by the likes of Amazon, and they usually pick a time when I'm trying to order something quick¹. It is one of the growing number of things in life that simply have no “no” option, it is always “yes or later” - I wouldn't mind so much if “later” meant “I know the option exists, I'll ask for it if I change my mind, don't bother me again otherwise”. Call me cynical, but if companies are trying to nag me into something I very much doubt the main benefit is mine. I'm sure there are many people out there who go along with it simply because they are sick of being asked repeatedly.
I also don't see the real benefit with the way things are often implemented anyway. When the credential recovery process is sending a magic email or text, making SMTP or SMS the weak link of the chain just as it often is for passwords so I'd be giving up my preferred workflows for no better security.
----
[1] A short while ago I actually ordered from somewhere else because of this, bitter twit that I am. “I wonder if I can get this almost certainly drop-shipped item on next day delivery via Prime?”, [goes to Amazon to check], [get passkey prompt], “sod it, I'll go back to the original place”.
Same or next day shipping on most things I order is wild, when something goes beyond a 2-3 days on Amazon it even feels odd
And the “do you actually need the item/s that fast” isn’t the response I am looking for
(Here, unfortunately, their web site is useless crap.)
One reason I imagine Amazon pushed so hard for short delivery times was knowing eventually their legacy peers would leverage this against them.
I live in a well populated suburban area. If I’m willing to actually leave my house, I can get most things much faster than Amazon can deliver them. This also helps keep those local businesses running, so shipping doesn’t become the only option in the future.
you either add the card then remove it, get a separate card, or find a way to use credits somehow -- but in the case of the latter two, Junior could still slam a few buttons and eat up all available funds on that card -- just without the impact of your regular card.
https://cybernews.com/security/revolut-data-breach-75-millio...
> "We have checked the user and card identifiers contained in the alleged records against our systems, and none of them correspond to valid or genuine Revolut identifiers," the spokesperson said.
For sure, this feature is not a Revolut-exclusive. Plata from Mexico should also have this and much more, from what I have read.
If American/European banks don't have such a simple feature, this speaks volumes about them.
Your comment has a vibe of "a bank that doesn't have a local office has no decent service". To each their own, I guess.
if you're not in the US. revolut in the US is a fintech group with a bunch of bank partners.
The people responsible show a distinct lack of understanding when it comes to consent.
Gf just logged in to hotmail without knowing her password because of a popup. I tried to explain but there was no understanding to be had.
This is how the world works. You either understand it or suffer it unknowingly.
Passkeys are one of the few protocols that supports against phishing (Accidentally giving away your credential to some rough site) so it has its benefits and more so for enterprise users.
It becomes challenging and is ill suited when its pushed to general public. A middle ground could have been to give it as an option to user instead of forcing it on the user. For some reason its not cool enough.
From a company's perspective
What is the average person’s threat model? Re-using passwords.
What is their most common annoyance? They forget their passwords.
Built-in password managers are great for this. But they’re not universal (e.g. I believe using Apple Passwords on Mac doesn’t carry over to Android.)
Passkeys are amazing. They’re basically magic to the average person. No typing passwords; no remembering; simply vibing, securely.
I don’t think people are regularly logging in to a huge number of accounts on other devices. Maybe they are! I doubt it.
Wrong.
As article points out, it's not having access to their account.
Followed by not being able to easily delegate access to their account to a trusted third party (like a spouse, a friend).
Password reuse addresses the first problem, however imperfectly. Ability to share password over any channel, including analog, addresses the second.
Passkeys defeat both.
Passkeys can also be shared with other people like spouses or friends, just like passwords.
How? They're literally designed to not be, because they're trying to prevent phishing, and you cannot in general case distinguish phishing from legitimate delegation of authority.
Huh, that is a really funny way to spell "the primary login method used by every not-tech-savvy person I have ever met before".
I guess that's one effective way to cope with security industry bullshit.
I don't trust my email provider.
If you are not using Passkeys for your email (and the site supports that type of account recovery), then you still have only the security of passwords, just with additional steps.
Making the email account, an often attacked resource that is always online, a single point of failure. I don't mind relatively unimportant accounts being that weak, for instance where the only reason to have an account at all is to separate your preferences from someone else's, and you don't actually care about security, but for accounts where there is significant PII or payment details or other sensitive information it is a terrible idea.
A second problem with this is that for many their email account is the same as their account where their passkeys are backed up. What if you have lost your passkey due to Google locking you out for no readily apparent reason and you don't have the online influence needed to get them to take you seriously (instead being trapped in the support bot loop)?
I still run my own mail server, and if I didn't my important mail accounts wouldn't be with someone like Google (I do have a gmail address, but that account is only really used for testing other accounts when needed), so that isn't a problem for me, but most people can't be bothered with that faf¹ so usually end up with one of the big providers.
--------
[1] It isn't actually that much faf², until those occasions when it is³, but more faf than most people care for, especially those that don't enjoy tinkering with technical matters.
[2] Just quietly ticking over as long as I remember to regularly verify it is patched up-to-date, and keep an eye out for zero-day issues concerning the parts involved
[3] When there is a deliverability problem, where I host it has problems so I need to make sure the backup is synced and then switch over to it, when there is a relevant zero-day and I have to rush a patch in (or take other remedial action until a fix is available) then investigate to make sure I wasn't quietly affected, etc.
> Built-in password managers are great for this. But they’re not universal (e.g. I believe using Apple Passwords on Mac doesn’t carry over to Android.
1.Only security keys (single device credentials) are what you can use across the device not the regular platform based one
2.Browser based password managers do provide you with that interoperability across the platforms and in fact the password manager as an supported passkey authenticator allows you do the same
Passkeys are crap. They are just random password prompts to give a false sense of security.
they have an algorithm that can predict the likeliest moment you'll not see or panic-hit the "ok" button in haste
Bingo.
This is why you use hardware keys which work across devices like yubikeys and the like.
I have two of the old neos and two of the newer usb c + NFC enabled ones.
No issues.
But I have not found any way to use my browser's passkey to login on my PS5. I can scan a QR code, but that requires logging into the mobile app with a passkey. And I can't add one to my mobile phone because I can't login on mobile... the passkey is on my laptop, and it won't autofill from 1Password (Android).
at least in Apple land, if you try to sign on on a device that you don’t own (let’s say a work laptop where you’re not signed in to your apple id) it’ll give you a QR code to scan with your iPhone and it’ll do faceID on your iphone then do some bluetooth handshake to use your passkey on the other device. I’m not sure if this is Apple exclusive or if android/windows/linux would be able to do the same
There's an undo? Could you elaborate?
The problem is exactly that they're being forced on nontechnical users when the UX isn't even good enough yet to sell them to technical users.
I got a new cell phone and installed Microsoft Swiftkey and tried to login to Microsoft. It said my device's password or security manager would popup, but it never did and it never showed an option to login via password, just a mostly blank screen. I tried logging in from my laptop browser and it immediately tried using a passkey, but I've never created a passkey for Microsoft, so it errored out, still never showing an option for password login. I tried again and it errored out again and FINALLY showed the option to login via password. It had to fail 2 times to finally show the option for password login.
I was finally able to login via password, then had to go to Microsoft's passkey management page to create a new passkey, store it in 1password, and use that on my phone.
I'm a software engineer and it was annoying and time consuming and took a minute to figure out. How are non engineers supposed to even use this crap?
So the vast majority of all humans on this very planet?
I agree with you 100%, although I will say that it seems like newer OSes (perhaps it depends on the desktop + mobile combination, or maybe Chrome + Android is enough, not sure) have a way for you to use a passkey from your phone by scanning a QR code. I still think it's not super user-friendly but it is a clever workaround at least. Most people are accustomed to scanning QR codes, so scanning a QR code from your phone to sign in seems like not too big of a leap. (Although I wonder if it conditions users to scan random QR codes to sign in which could be a bigger phishing problem lol...).
Do you have a blog?
Thankfully I can still log-in with a password & text. But how to reset the passkey? No-one knows.
Edit: I take that back, for some reason they stopped taking the password I used when setting up the account. It's only email or SMS with code verification + birth-date.
I use my github passkey on my phone to log in on my laptop by scanning a QR code. “My” laptop for work, which I wouldn’t put said passkey on.
Security is frustrating and it's hard to get people to do the bare minimum to establish secure access to their services.
This is meant to be solved by the cross-device flow - a QR code pops up that you scan, and a secure channel is established from that with your other device.
[Disclosure: an editor of said standard]
> The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for.
On macOS/iOS, the system gives this prompt regardless of where your passkeys are being created/stored:
Save a passkey?
"<site>" supports passkeys, a stronger alternative to passwords that cannot be leaked or stolen. A passkey for "<username>" will be saved in "<provider>".
There is a transparent upgrade option though that sites can request - basically when a site supports passwords and passkeys, they can request a password manager supporting both create and return a new passkey on password sign-in.
> [...] and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
That's unfortunate. A site/service should absolutely not replace other passkeys, nor should it remove other sign-in options like passwords, without explicit user consent.
The above credential upgrade flow makes that doubly so; even if someone relies on a password manager to manage and provide their credentials for a site, it very well may not be the singular piece of software that does so.
That only works if the device has working camera and bluetooth. What if I want to log in from my new desktop PC to an account whose Passkey is stored on my old desktop PC?
If you think passkeys aren't ready yet, blame the people implementing it on their platforms.
As someone who's OpSec puts swiss cheese to shame Passkey has been a godsend. My passwords are actually much better because of it.
That said, I don't like passkeys either.
Probably hundreds of millions or even billion people have devices that support biometric auth. How is that not mature?
Brilliant security: a highly secure high-tech shiny front door that can randomly fail to open, so you still need the low-tech back door, which is the one potential thieves will use.
Mind you, it can work if the back door is old but sturdy (basically, for a bank that will ask for KYC authentication, or in the worst case you can set foot in the brick-and-mortar branch showing your face and ID and ask for access) but for pretty much every other service it introduces risks for very little or no gain.
Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.
And the confusing mechanism hurts there too: I'm always a little bit afraid that i'm somehow more in danger because I keep them in a vault that's shared on all my devices rather than a TPM, because whenever the protocol is explained the "it can't leave your device" part is highlighted as the main source of the security, except.... mine obviously do leave my device, with the vault, so.....
What setup are you using? Because I don't have that problem on Linux + Firefox at all
It's totally possible there's something specific about my situation, or the way it was set up in the first place that enables this, idk, but somebody else replied saying they have the same experience so it's not just me.
And even if it was just me, it's still clearly something wrong on the provider's implementation, because it should not be possible for software to sidetrack the user to create a passkey, when that user logged in with a passkey to open the current session.
Some probably kinda strong counterevidence to that though is that this doesn't happen on all sites, only Amazon. I've never been prompted to make a new passkey after passkey login on the 12 other sites that I have passkeys in bitwarden for.
It's quite crazy to just surprise a user with a passkey in any event, even if they get saved and don't reprompt you. Suddenly spawning an OS popup without any explanation, which may or may not try to ask for biometrics, is crazy.
I haaaaaate this. And every time I'm like, "do I not already have one??" Passkey implementation has been half-assed by everyone.
I use 1Password and Amazon does not prompt me like that. However I do have two passkeys for Amazon, one in 1Password and one in Apple Passwords. There's not enough data yet to say if it happens to you because of something not working right between Bitwarden and Amazon, or something about Amazon doesn't work right if you don't have a passkey in your OS passkey store.
Might be worth adding a passkey for Amazon to your OS passkey store and see if the problem goes away. If it does, blame Amazon. If it does not, report it as a possible bug in Bitwarden (altough it still could be an Amazon bug that just happens to mess with Bitwarden but not 1Password).
But websites pretty much universally trigger the Bitwarden passkey prompt, or I can bypass via the popup and go to the OS passkey manager.
Of course, at the rate we see security failures everywhere, I'm not entirely convinced writing your passwords on post-it notes wasn't such a bad idea after all.
I actually prefer non-resident U2F in some ways. You don't have to store anything on your key, you are just signing requests. This is relevant where U2F/FIDO keys have limited slots for 'resident' keys.
In principle, it's great. You have one good password to remember for the average user, and that's enforced by their device's probably good enough security posture.
They are resistant to being phished and they won't reuse the same one everywhere. They then don't end up going from hunter2 to hunter2! everywhere.
But my experience for users is that they worry they are giving their biometrics to Amazon or whoever and so the UX just confuses them.
The certification aspect was new to me too last time passkeys came up. Sites can require that a given passkey has been certified.
The patchy support for them is also frustrating. MacOS does not support NFC FIDO/U2F. iOS does.