Passkeys do marginally improve security against MITM and phishing attacks, but they are primarily for protecting the lowest common denominator from themselves: people who re-use passwords and/or don't use a password manager.
If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
I'm just storing my passkeys in 1password, which means they're synced across my two computers and phone and also means I gave up any kind of hardware security.
This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport). iOS and Android support this, and it’s generally not a locked-down thing if other devices wanted to do it too.
The only use case left is in “how do I login if all my devices are stolen/fall into a body of water” in which there really isn’t an answer beyond “get (a|your) device back, sign back into your password manager, use that to get back into critical accounts”.
The website should display a qr code you can scan with your phone that allows you to then login, unfortunately a lot of sites don't implement this, and some don't implement backup codes. This isn't the fault of passkeys per se, but of poor implementations.
If you're not happy connecting your phone to the network, then how likely is it that you would you be willing to enter your login details on a machine you don't control?
Steam does this. If I want to login, it shows a barcode I can scan with the app and it logs me in without needing to enter my login information. Phone needs internet access, doesn't need to be on the same network as the device I'm logging in on.
I assume the QR code contains a token for the device, which is used by the app to authorize the login and the server automatically logs in the client on the device with the matching token.
Steam does this. If I want to login, it shows a barcode I can scan with the app and it logs me in without needing to enter my login information. Phone needs internet access, doesn't need to be on the same network as the device I'm logging in on.
Sad reality is that such usecase is less and less common, thus, no one cares about it. I think majority of my friends would not be able to access their email, or facebook or alike, if they were forced to use my computer in emergency.
Which is a trade-off that makes sense for a lot of people. If you have multiple devices, many of which are portable and one you have on you all the time, the need for that is just way lower, so being more secure against commonplace automated widespread attacks is worth it to them.
Isn't there a workflow where you scan a QR code to confirm the pass key on your phone?
I've definitely done this, but not sure if the workflow was at the OS or browser level.
I'm honestly confused by all the negativity in the comments. Passkeys are great for convenience. Just leave your password login enabled as a backup. That defeats any security benefit, but oh well.
My MIL setup a passkey accidentally on her Google account and now has no idea where it is. Removing it now requires her password which she’s also forgotten. But now for some reason on Google I can’t initiate any type of forgot your password flow because of how Google sets up things and I have zero clue where she stored the passkey.
The offer a strong protection against phishing attacks that would still get plenty of password manager users: fake websites. A passkey is strongly linked to a domain, so a fake site can't get that credential.
Some password managers will only fill if a domain matches, but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in. I've also seen lots of them do stuff like happily autofill on any prefix of the domain, so your credential for `something.example.com` will autofill into `fake-something.example.com`.
"Oh, usually my bank just logs me in, that's strange. Let me just go grab my username and password and type it into this site that looks like my bank."
Same thing is going to happen with passkeys for non-technical users for exactly the same reason you stated. People will think the integration is busted and manually copy/paste the non-passkey credentials in. In that way, I would argue that passkey is not stronger protection against phishing attacks unless its the only way to login. It is, at best, a convenience for users.
If the user just has a username/password fallback and that's it, then yes, but the aim of passkeys is that won't be the norm, rather users will only have passkeys and the fallback would be to, e.g: magic link email log in where the phishing attack is still broken. I've seen some sites explicitly disallow plain username/password login after you enable passkeys for this reason (you can still put them in, but then it just does a magic link flow afterwards as a second factor).
> but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in.
I've seen people do this AFK as well, and I'm always helpfully suggesting them the correct way of solving this: verifying the URL again, and if correct, add it to the password manager so it remembers in the future, and never copy-paste passwords on the web. Basically 50/50 if they take the advice or come back after a week asking if it's safe to copy-paste the password into the website, and I try to inform again.
Shockingly, I saw one developer peer copy-pasting a password into a website, but I guess for these people there is no hope.
It should be a big red flag for sure, but the reality is most users aren't going to understand that. They got told to use a password manager by someone or find it convenient, but they don't understand the security flow enough to catch that it's a potential attack, or how to resolve it safely.
Historically I've seen lots of sites do a subdomain shuffle for login pages every now and then which routinely breaks domain matching, introducing false positives that users have to deal with, making them numb to the threat too. Passkeys baking in the domain check with no workaround means that sites can't do that, which is a benefit.
> Some password managers will only fill if a domain matches, but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in. I've also seen lots of them do stuff like happily autofill on any prefix of the domain, so your credential for `something.example.com` will autofill into `fake-something.example.com`.
Why would you trust the very same password managers that don't handle passwords properly to handle passkeys properly?
You don't. The browser handles the passkey matching to the domain which is obviously a better place to do it. There could obviously still be bugs as with all things, but it's much more intentionally integrated into the flow which makes it much harder to bypass.
Right, I haven't seen that particular flaw in baked-into-the-browser ones (probably because they already having secure domain matching code ready to use), but the distinction is that doing the domain check is a part of the spec and standard, so e.g: sites aren't going to break it by changing the log-in subdomain routinely, as has been common historically.
Password managers have had to be permissive enough to work with most websites, and there is no standard for it. There have been sites that blocked the autofilling of passwords and so on as well.
My point wasn't this one particular flaw in some password managers is the reason to use passkeys (the copy/paste point is the much bigger issue anyway), just that it's an example of how relatively brittle the password manager process is.
The users are the ones manually copy/pasting the password. There's no way the password manager could prevent this short of disallowing copying/viewing passwords.
The point about poor support for 3rd party managers is so frustrating. Because this is correct, that is the obvious solution for the normal user, but passkey implementations somehow do not know how to deal with it.
Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.
And the confusing mechanism hurts there too: I'm always a little bit afraid that i'm somehow more in danger because I keep them in a vault that's shared on all my devices rather than a TPM, because whenever the protocol is explained the "it can't leave your device" part is highlighted as the main source of the security, except.... mine obviously do leave my device, with the vault, so.....
Yet, the Apple + Google implementations will sync passkeys between your devices. "Securely", of course. (I've seen first hand how Apple implements this, and it seems.... sound)
Sites can request hardware-bound tokens, which would block any software based password managers. It's an option in the protocol but one not yet widely utilized.
> Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.
What setup are you using? Because I don't have that problem on Linux + Firefox at all
While the technology itself may be great (I don't really know since I don't use them) it has been co-opted by the tech conglomerates as another form of isolating and walling off users into their ecosystems.
And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".
> And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny.
The reason is the ever increasing number of hijacks of social media presences and code hosting portals, with the latter being a serious financial threat. Done right, passkeys stay in the Secure Enclave, at least for anything Apple and most of the Android sphere. There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
The doubt is more "how will tech companies use passkeys as an excuse to do something stupid" than "passkeys themselves must have inherent problems because tech companies are pushing them".
Passkeys could be the savior of all security problems worldwide from a capability point of view and tech companies would still ruin it by trying to force ways it pushes you into their ecosystem instead of just being whats both secure and convenient.
As an example, I have 3 different passkey APPS on my phone and cannot go down to one because of various reasons with each (e.g. MS authenticator forced for work).
From TFA: "Both Apple and Google want your identity anchored to their operating systems. The “happy path” on their devices is to use their synced passkey management tied to your Apple or Google account. If their automated systems decide one day to ban your account, you irreversibly lose access to all your passkeys used across all third-party accounts too."
This is, in my opinion, the most serious problem with passkeys. I'd like to adopt them, but this is a blocker.
Every time passkeys are brought up on HN it’s nothing but complaining and/or refusing to learn the basics about something new, but I’ve been switching to them on every site I can for months with literally no issues.
1Password everywhere, on iOS, Mac, and Windows. I’ve run into none of the issues elsewhere in the comments. Everything just works, including in-app logins.
Maybe your other password managers are just bad at implementing the right browser/OS hooks?
The author talks about the problem with using hardware keys, but they neglect to mention that many websites and apps simply do not allow the use of hardware keys! They will insist you use Apple or Google syncable keys. So after you have spent the money to buy 2 or 3 hardware keys, you find that they are not accepted.
Passkeys have a marketing problem where no one is able to describe simply what it is without having to use technical jargon. There's also the problem where each OS tries too hard in pushing this to the face of end-user
Imagine a password, but it a) types itself for you and b) detects when it's being sent to an impostor site and blocks them from seeing itself, so it can't be phished.
Cool, where are they stored? (I know the answer: 'it depends', and that's the big problem with their usability: most users haven't a clue what the answer is and most tech support can't answer that question straightforwardly because it depends on some decisions the user probably didn't even realise they made).
If you're using a USB hardware token your knowledge of it is at least an order of magnitude better than the median user's. I know where my passkeys are stored, I don't know where my family member's passkeys are stored and neither do they. The same is true for most of my otherwise fairly technical co-workers.
How do I use it on my desktop or laptop then? What if I switch browsers on my phone? What if I get a new phone? What if I change from android to iOS or visa versa? What if I need to log into the site on my Wii U's browser?
Not always. And which vault? There can be multiple on a given device. This isn't some hypothetical 'mollify the user's worries' question, this is an important practical question of what do they need to worry about losing access to. Trust me when I say that most users I have talked to have absolutely no idea about this, and usually only find out when they've already lost them.
Are you part of the 99.99999% users of one of iOS+Apple or Androidlike+Google/Tencent or HarmonyOS+Huawei? If that's the case, you don't need to as the key is automagically saved by your OS' platform and synced with your new device.
Otherwise, you're such an extreme outlier that you probably either know what you're doing or can find out by yourself, right?
Unlike physical objects they may reside in a TPM, a software vault, an export/backup, or any combination thereof. You may or may not be able to recover or migrate them, depending on where/how they were made.
Therefore you may need multiple per service, or maybe not. Services which only allow one may end up locking you out with no recourse. You get to find out.
None of this is obvious or self explanatory to normies.
Probably because these caveats and weird behaviours are platform-dependent, not really the passkey’s fault.
Passkeys really are not any more difficult to explain than 2-factor authentication. Anyone who’s currently been able to actually create an Apple or Google account and successfully navigate their devices up to a passkey screen will be able to grok how it works.
People around here really ought to stop thinking users are complete idiots. Hell, you don’t even to scroll that far to read people calling users “normies” for crying out loud. What is this? High school?
They're separate stores. I was under the same assumption until I tried to use `security` to get a saved password. It doesn't work, and as far as I know there is no CLI for the Passwords app's store.
That's the main thing I wish was done better. There was barely any actual lead up from the perspective of an average person. Just a new unfamiliar flow on half of the login screens that they use.
Sure, its explained. But not in a satisfactory way that would reach all users at their level.
This is a bit of an exaggeration and out of proportion, but I think my ideal would be one of the big tech companies should have bought out something like a super bowl ad. Something that actually conveys the idea "hey, we know you've used passwords since you were able to type on a keyboard, but here's new technology that's better and here's why" in plain language that the average person can understand.
Unfortunately, XKCD 2501 continues to be relevant. [1]
The average person? I have a Master's and PhD in CS, code regularly, and have followed and used all the cool technologies from the days of gopher, telnet and Mosaic to crypto, and lately LLMs. And I still don't have a clear enough picture of passkeys to know really basic things like "what if we have a family computer but each wants to access their private accounts and keep the others from accessing?", "what do I need do to login from an airport computer?" or "what should I do if my phone is stolen?"
If it's that unclear to me, I can't imagine how it can be to the average user.
The way they explain them is atrociously unclear, borderline negligent for services that nag people to activate it for accounts where they may hold valuable data for their personal lives. And while I don't want to spend much time finding out the details as long as I have the option to decline them, I suppose if they can't explain it and convince people of its advantages, it's because it's just bad tech.
Passkeys remind me of ipv6 in that they are a "solution" coming from the supply-side, without (apparently) having done any research in what motivates actual users (and what would motivate them to switch).
They make sense as a technology for businesses & their users. In that scenario, the owner of the account is not the user, but the business. It makes sense for the business to be able to place strong restrictions on how & where the user may log in, it fixes a lot of real problems businesses may have thanks to sloppy user behavior, and the business is also motivated to provide a way to fix broken logins. It's a good solution for that scenario.
But for regular end users where services are primarily motivated to take money from those users and lock them into their ecosystems, they are a usability disaster and yet another exploitation vector.
It's one solution for two very different usecases, and it just does not work. There is an approach that could work for end users who own their own accounts, but they need to go back to the drawing board and rewrite the protocol with the assumption that the keystore is hostile to the user's interests. That means strong guarantees on key portability so users can migrate away from hostile keystores, and absolutely no ability for services to restrict the user's choice in passkey provider software.
That's why I just implanted my NFC passkeys. I've got one in my left hand and one in my right forearm. If I lose access to them, I have other, much larger problems.
YES. This exactly. I work across multiple devices, some of which are nonstandard/uncommon (Linux, Xiaomi China ROM, ...) and I've NEVER had passkeys work properly - yet everything constantly prompts me to add one. Even if they did work, I'd have to carry around hardware keys or register each computer separately. And the lack of backups if a device is lost/broken is definitely a larger concern for me than being phished of my TOTP keys.
My wife clicked through a Google dialog and suddenly was using a passkey. It absolutely happens, though IMO more to the non technical users. I know what those login dialogs and pop ups mean, and decline them.
(At least til I get around to setting up my new usb c yubikeys!)
I continue to avoid passkeys but it's becoming an incredibly dense minefield. Certain sites try to trick me into adding one each time I log in and I have to be careful to dismiss the 1Password prompt, then dismiss the chrome prompt, then dismiss the OS-level prompt (all back-to-back). It's so incredibly user-hostile.
Where do you have so many sites asking for passkeys? I’m desperately trying to have more but I have ~1.1k passwords in my password manager and only 63 passkeys!
I actually prefer non-resident U2F in some ways. You don't have to store anything on your key, you are just signing requests. This is relevant where U2F/FIDO keys have limited slots for 'resident' keys.
In principle, it's great. You have one good password to remember for the average user, and that's enforced by their device's probably good enough security posture.
They are resistant to being phished and they won't reuse the same one everywhere. They then don't end up going from hunter2 to hunter2! everywhere.
But my experience for users is that they worry they are giving their biometrics to Amazon or whoever and so the UX just confuses them.
The certification aspect was new to me too last time passkeys came up. Sites can require that a given passkey has been certified.
The patchy support for them is also frustrating. MacOS does not support NFC FIDO/U2F. iOS does.
I love passkeys as a tech enthusiast with a password manager that can hang on to them but I don’t love them as a confusing user experience for the average joe.
I also don’t love how many websites and apps use them in stupid ways like using them alongside other 2FA or login methods when the passkey alone should be sufficient.
Personally I love passkeys and think it’s not deployed enough. It works great (for me anyways!) and it is SO MUCH better than “login with email” that is everywhere now.
It's the stupidity of Service Providers to adopt passkeys in the first place.
As a service provider myself, I've evaluated and said "Nah" to passkeys - because it's simply increased Customer Service contacts I have to invest in, whenever a user changes or loses devices, or any of the hundreds of ways Passkeys are not portable.
And guess what, the Tech companies pushing this have zero liability for user login support or security breaches. It's always me. There is no need for me to work hard and spend CS contacts, to wall off my users to the OS or Browser vendor.
I'll simply do passwordless Email or SMS 2FA / Magic Links and own my users without the overhead of Customer contacts, thank you.
I understand many passkey complaints but not this one. Why, for you as a service provider, are passkeys not just better (or at least equivalent to) passwords? You collect and verify an email address at signup and the account can be recovered in the same way as with passwords, or passwordless-email. No CS-verified recovery needed.
Do passkeys improve security posture for the average person, reducing the likelihood of them losing their accounts to fraudulent actors? Absolutely.
But they also introduce single points of failure, as the article points out. I can't even remember how many times I've had to help a family member recover their account or get confused when they can't sign in on a new device. It's incredibly frustrating that this flow is promoted as the default for so many services.
1password is the best solution I've found for the average person. It's not perfect (it's definitely more complex than writing down your passwords on a piece of paper or using the same password everywhere) but it's much easier than juggling yubikeys. I know so many non-technical staff members who prefer the OS or browser keys even if it means another account recovery is lurking around the corner.
Completely agree. I think the root of many of its issues is the inability to add a key that you don't currently hold. This prevents me from storing a backup key in a safe, for example.
I proposed an alternative scheme many years ago: https://www.researchgate.net/publication/343318317_Privacy-a... . By allowing "offline" keys you can also treat them as higher priority, and use them to revoke any lesser keys from attackers if your account is compromised.
It would also be nicer to get rid of usernames, but that's a fight against the data-gathering powers that we're unlikely to win.
So where do I keep my pass keys is the problem. They are in my password manager just like another password. So what's the point of having them because effectively, the passwords in the password manager and the passkey in the password manager offer the same UX to me? Except that at least I can memorize a password by heart just in case.
That is the point. They stop you from memorizing it “just in case” and reusing it, and they force you to use a password manager.
For the average user, which doesn’t use a password manager, this is great. It means they can’t get phished. And it’s also great for the average password manager user, who keeps dozens of insecure and reused passwords in their vault because they manually thought of a password when signing up instead of randomly generating one.
If you’re already using a password manager and random passwords, the UX is designed to be the same. It’s just a way to get regular people to do this.
>They are in my password manager just like another password. So what's the point of having them because effectively, the passwords in the password manager and the passkey in the password manager offer the same UX to me?
same ux, different security properties.
>Except that at least I can memorize a password by heart just in case.
"just in case" should be a thought out recovery flow, rather than hoping that you remember the password of the account you need to access.
I try to boycott passkeys due to built-in attestation feature in the standard. Not active now, but given how Google+Apple already use the passkey feature to lock you into their ecosystems, it is just a matter of time until their service will require that the passkey is attested from a non-rooted Google or Apple device. I think this will especially be true for Google to prevent AI scraping bots. Turning this on does not require anything, once passkeys are widely used, Apple, Google and Co. simply can flip a switch.
I'm was tempted to come in here and say "you're holding it wrong." But then I quickly realized that I had to spend weeks changing my behaviors and messing around with devices in order to get it to work correctly.
As someone who's OpSec puts swiss cheese to shame Passkey has been a godsend. My passwords are actually much better because of it.
I don’t like how tokens have gradually evolved from a secure 2F device that you carry with you (Yubikey etc) to a single factor “passkey” that’s built in to your computer/phone, or worse, a password manager with export capability.
It should always have remained a second factor device. It’s not impossible to teach people to use these, European banking did it for years. There’s just no will to do it.
If a user doesn’t have a second factor, what should their first and only factor be? The passkey people are trying to posit that a passkey is better than a password as the only factor.
It’s because we have effective biometrics now, so the need to carry around an inconvenient limiting physical 2nd factor is obsolete (for the vast majority of regular use cases)
I have physical passkeys, one attached to my keys and another on my desk at home and I absolutely hate software based passkeys. Every single time I'm asked for a passkey it always ask me if I want to use my Apple Keychain first and I wish I could default to physical.
Passkeys are great in that its turning login support on websites into simple "autheticate your device to seamlessly login". My biggest gripe is that it seems Apple/Google are using this to consolidate control into their own password ecosystems and don't support password managers as a store for passkeys.
Surprised to see so much hate towards passkeys. I absolutely love them when I can use them with Bitwarden and my own SSO.
Sucks when I am limited to hardware tokens like yubikeys.
To guard against lockout, you need to be able to log in from multiple devices. But you don’t need to copy passkeys around to do that! Instead, generate a new one for each device. This is similar to setting up ssh by copying public keys, not private keys.
(Or since syncing passkeys usually works within ecosystems, you might just need a passkey per OS.)
Related: the UX is currently terrible. Every time I go to a website that has passkey flow, I'm presented with:
- MacOS native UI; which I cancel; then I see
- Bitwarden UI; which I cancel; then I see
- Chrome UI; which I cancel;
I agree 100% i learned that my old school with whom I had linked to my windows computer and finished my degree with one day required passkeys rather than passwords on all devices. This force locked my windows PC back to passkey mode luckily I remember recovery account and got a passkey to work. But it took months to figure out why I had to use it. All the help board were said just click this button which was grayed out. Or set this register key which auto repopulated. It was an awful experience. I like my password as default
Ah yeah, Microsoft has this awful habit of just hiding the buttons for actions you don't have permission to do, which makes me feel like I'm being gaslit sometimes when a guide says 'there's a button right here' and there's not, and I've no idea if the button was just moved or if not, why it's not available (sometimes it's because I don't have permission, but sometimes it's because it's a different product with the same name and branding as a completely different product).
I agree with all the points this articulates. I understand why for many users they are great. But I would prefer better acceptance and continuance of the simpler, unfishable, u2f simple hardware keys.
I went in expecting yet another screed about how passkeys were not issued by RMS in a FOSS encyclical, and therefore not only were they insecure, but they were also a morally bankrupt abomination. I was pleasantly surprised to read an actual thoughtful critique, albeit one I largely disagree with.
The author's assertion that the greatest risk to an individual is account lockout versus phishing or password harvesting is just not grounded in reality. I get phishing emails and SMSs daily. The criminal ecosystem running these campaigns is extremely active already and set to become even more so with LLMs. These campaigns are by far the biggest threat to normies.
Whereas account lockout happens most often with multiple failed password entries, which passkeys completely eliminate. I just don't know where this risk evaluation comes from.
The author also points out that even with passkeys, if you're able to also log in with e.g. security questions, you still have a much weaker security footprint for that account. This is true, but it's also true of a TOTP second factor. So I'm not sure what the criticism is here.
The exportability argument is a real weakness and something I'd like to see addressed. Passkeys don't have an equivalent for backup TOTP codes that you can just write down somewhere or trivially store yourself. But it probably wasn't in v1 because the people who designed passkeys figured that websites would not go all in on them immediately and would preserve other authentication methods, which is exactly what's happened.
> Maybe I am getting old but password+yubikey/webauthn was really top UX.
It most definitely isn't. Any 2nd factor that is not the device I am currently using (either a yubikey or my phone) has a non-zero chance of not being near me when I need it, leading to the constant question of "where the fuck did I put that darn thing", only to find out that the cat has decided to believe the yubikey is a mouse and tried to devour it, the phone's battery went dead...
If you have to use passkeys, try KeePassXC and KeePassXC-Browser. I used them to set one up for Amazon a few days ago, as Amazon now forces passkeys as of this month, at least for my account. It was relatively painless.
My thinking is that Passkey is an extremely good and, in theory, extremely easy solution to security, authorization, and login issues. The problem is that Google, Apple, and Microsoft have done a just horrendous job, and made it suck as much as possible.
They didn't want to cooperate, and they wanted to make passkeys transferable within you cloud account, while not cooperating with anyone or anything else. The result was that you have no predictable and stable pattern/protocol/interface, or even general description, for how, for instance, a website connects to the passkey or even a hardware key, if you wanted it.
We basically have all the browsers, the operating systems, and the password managers, all fighting over who gets to store and present the passkey. And everybody assumes that they are the only one that exists and actively tries to fight the others is they can.
The basic technology is really good and could work well, but the large asshole tech firms focused on self-interest and walled gardens and made it insufferable.
I didn't like the passkeys that were handled by Google and only worked on my phone. But now that most of them support bitwarden they are really convenient.
Devices that break or get lost, and then either the user had password authentication activated all the time anyway in addition to the passkey, or they have the classic "mother's maiden name" recovery path, or they get locked out of their account.
Brilliant security: a highly secure high-tech shiny front door that can randomly fail to open, so you still need the low-tech back door, which is the one potential thieves will use.
Mind you, it can work if the back door is old but sturdy (basically, for a bank that will ask for KYC authentication, or in the worst case you can set foot in the brick-and-mortar branch showing your face and ID and ask for access) but for pretty much every other service it introduces risks for very little or no gain.
I had to setup a Passkey recently and wanted to store it in 1Password and the experience was quite absurd.
I don't know who designed this or who thinks these are acceptable affordances, but it seem to be part of the same disingenuous push that's behind passkeys in general.
Microsoft is especially poorly prepared for this - Often if you have a passkey, it will CONTINUE To ask you to create a passkey (a new and different one), and it may save it in a different place, which is infuriating.
Strong password + MFA is the way, and I don't see that changing.
I have said before, I'm personally not interested using "Something I have"/"device bound" as an authentication factor. I'm also not interested in the sync "workarounds" that store keys in the cloud.
People have replied it's possible to extract the private key, but it's not clear to me that that's usable (maybe it is I don't know). It's certainly not in line with what passkey devs want people to do and not do, so I'm not interested in "fighting" against the "flow" so to speak.
I'm happy with TOTP, as I can manage and use the codes where I want, under my control.
Passkeys work nicely, and I'll use them, in cases where I want decent security, but I don't consider them the "Philosopher's Stone" of regular end-user security. I think they are still a bit too "fiddly" for your average Joe[line].
What benefit does that give you? Passkeys cannot be moved, by design. So for the website, recieving the same one means you're talking to the same device, always.
The purpose of rotating passwords is to cycle out potentially compromised ones, due to phishing attacks, keyloggers, shoulder snoops, etc. But those cannot exist with a passkey.
Doesn’t this mean that a compromised device with passkeys on it is worse than a compromised password since the passkeys can’t be rotated? I feel like the answer is obvious so there must be another angle I’m missing
The experience is also junk if you're using a password manager, I have passkeys that I'm not sure if I saved to the OS manager or my password manager... mostly my fault but I enter passwords so many times a day it can be hard to stay on top of which UI I'm clicking yes in to store them.
Password managers are great IMO, I can use some absurdly long password, backup is reliable, I can use them across devices. For extra secure stuff 2FA works the same, I've got an app with codes I can easily back up and use from multiple devices.
Passkeys tend to obscure everything and take away a lot of control.
I've resisted passkeys for some of the reasons listed. I use third-party password managers, they're device/system independent, and I can export the data when I want to. I don't see passkeys as a big advantage, or perhaps I should say the bigger advantage isn't really for the _user_.
Of course, at the rate we see security failures everywhere, I'm not entirely convinced writing your passwords on post-it notes wasn't such a bad idea after all.
Keepass2Android without network permissions saving the file to a folder monitored by Syncthing is pretty good though - it keeps responsibilities nicely separated.
using them with 1password has been pretty effortless. 'want to add the passkey' sure why not. 'want to use the passkey?' sure why not. for me it works across devices/os/platform so not sure what the big gripe is tbh.
Two crucial things you can do with a password that you can't do with a passkey:
1. Write it down on a piece of paper and put it in a safe deposit box.
2. Read it on one device (or from a piece of paper!) and enter it manually on another device.
Plain text is the ultimate form of cross-platform portability. Passkeys are the ultimate form of vendor lockdown. The passkey vendors won't even allow you to view the private key, unlike with ssh keys, which you can also write down on a piece of paper. It's vendor cabal to destroy computing freedom in the name of "security", always the excuse. Tech company paternalism at its worst.
If passkeys were meant to be user friendly then there'd be a secure optical transfer mode to QR code them from device to device with the screen and camera.
Easy to implement (receiver flashes a public key, sender encrypts to that key and flashes the QR code back).
That it doesn't exist for a protocol meant to work with phones tells you exactly where the thinking was headed.
I absolutely hate them and avoid them everywhere I can. I'm not bound to a single device or I don't want to get bound to some, and some pages quit your option with a normal password login after setting up a passkey. Absolutely frustrating.
I've seen it. Websites are pretty inconsistent about the flow but I've had a few just try to install a passkey when I log in (amazon does it. Paypal seems to do it but only try to use it on the same browser it was installed on, even if it's synced through a password manager, just to be different. The more reasonably ones have a 'log in with passkey' button but this isn't universal. Microsoft seems to just nag the user on login periodically in their classic 'Yes/Ask me again later' style of 'consent'). You can, if you're paying attention, avoid it actually happening, but the average user isn't going to notice until they suddenly can't log in because they're on a different device. You can see some advocates are pretty vocal about making them mandatory as well.
Every time I login to certain sites (like my health insurance, for one) I get a passkey prompt (system dialog) with no way to keyboard-dismiss, so I'm forced to move my hand over to the mouse and figure out which of three poorly-named buttons to press to get on with the login and ignore the passkey.
It's a minor inconvenience, but happens so regularly I hate it. It also stops the login flow until I dismiss the prompt, which is also annoying as I could've already gotten to the page I wanted to get to in the time it took to dismiss the dialog.
As someone who uses a single password manager on my computer and phone, I don't see the problem with passkeys. I use Safari on both and I never even had to "set up" anything.
I can see why they would be problematic for people who otherwise live life with a single love2025 password though.
Imagine you lose your computer and phone. How do you recover your digital accounts? This happens every day to someone. The most common scenario being a house fire or robbery.
If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
Oh well.
This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport). iOS and Android support this, and it’s generally not a locked-down thing if other devices wanted to do it too.
The only use case left is in “how do I login if all my devices are stolen/fall into a body of water” in which there really isn’t an answer beyond “get (a|your) device back, sign back into your password manager, use that to get back into critical accounts”.
I assume the QR code contains a token for the device, which is used by the app to authorize the login and the server automatically logs in the client on the device with the matching token.
Sad reality is that such usecase is less and less common, thus, no one cares about it. I think majority of my friends would not be able to access their email, or facebook or alike, if they were forced to use my computer in emergency.
I've definitely done this, but not sure if the workflow was at the OS or browser level.
I'm honestly confused by all the negativity in the comments. Passkeys are great for convenience. Just leave your password login enabled as a backup. That defeats any security benefit, but oh well.
Some password managers will only fill if a domain matches, but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in. I've also seen lots of them do stuff like happily autofill on any prefix of the domain, so your credential for `something.example.com` will autofill into `fake-something.example.com`.
Same thing is going to happen with passkeys for non-technical users for exactly the same reason you stated. People will think the integration is busted and manually copy/paste the non-passkey credentials in. In that way, I would argue that passkey is not stronger protection against phishing attacks unless its the only way to login. It is, at best, a convenience for users.
I've seen people do this AFK as well, and I'm always helpfully suggesting them the correct way of solving this: verifying the URL again, and if correct, add it to the password manager so it remembers in the future, and never copy-paste passwords on the web. Basically 50/50 if they take the advice or come back after a week asking if it's safe to copy-paste the password into the website, and I try to inform again.
Shockingly, I saw one developer peer copy-pasting a password into a website, but I guess for these people there is no hope.
Historically I've seen lots of sites do a subdomain shuffle for login pages every now and then which routinely breaks domain matching, introducing false positives that users have to deal with, making them numb to the threat too. Passkeys baking in the domain check with no workaround means that sites can't do that, which is a benefit.
Why would you trust the very same password managers that don't handle passwords properly to handle passkeys properly?
I'm not sure why you're making a distinction. In many cases the browser is the password manager.
Password managers have had to be permissive enough to work with most websites, and there is no standard for it. There have been sites that blocked the autofilling of passwords and so on as well.
My point wasn't this one particular flaw in some password managers is the reason to use passkeys (the copy/paste point is the much bigger issue anyway), just that it's an example of how relatively brittle the password manager process is.
Gell-Mann amnesia effect
https://en.wikipedia.org/wiki/Michael_Crichton#%22Gell-Mann_...
Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.
And the confusing mechanism hurts there too: I'm always a little bit afraid that i'm somehow more in danger because I keep them in a vault that's shared on all my devices rather than a TPM, because whenever the protocol is explained the "it can't leave your device" part is highlighted as the main source of the security, except.... mine obviously do leave my device, with the vault, so.....
Sites can request hardware-bound tokens, which would block any software based password managers. It's an option in the protocol but one not yet widely utilized.
It should not be in the protocol. And I don't trust Apple and Google not to lock it away from me.
I want my own open source manager and if that is attempted I want it to lie about it.
What setup are you using? Because I don't have that problem on Linux + Firefox at all
And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".
Passwords with 2FA are simply better and more freedom friendly.
The reason is the ever increasing number of hijacks of social media presences and code hosting portals, with the latter being a serious financial threat. Done right, passkeys stay in the Secure Enclave, at least for anything Apple and most of the Android sphere. There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
Passkeys could be the savior of all security problems worldwide from a capability point of view and tech companies would still ruin it by trying to force ways it pushes you into their ecosystem instead of just being whats both secure and convenient.
As an example, I have 3 different passkey APPS on my phone and cannot go down to one because of various reasons with each (e.g. MS authenticator forced for work).
Click "I lost my device", enter contact, get a reset link via email/sms
I’d buy that there are too many different confusing ways to recover from this situation, but not that it’s impossible
This is, in my opinion, the most serious problem with passkeys. I'd like to adopt them, but this is a blocker.
1Password everywhere, on iOS, Mac, and Windows. I’ve run into none of the issues elsewhere in the comments. Everything just works, including in-app logins.
Maybe your other password managers are just bad at implementing the right browser/OS hooks?
That's a pain point in everyone's day that should make the benefit easy to understand.
My bigger problem with passkeys is how there's no universal way to register more than one device (in case the first one is lost).
Proton Pass is a specific way to do that, but not a universal way. Bitwarden can't use proton pass to move keys around, google can't, firefox can't.
Tada, passkeys.
Are you part of the 99.99999% users of one of iOS+Apple or Androidlike+Google/Tencent or HarmonyOS+Huawei? If that's the case, you don't need to as the key is automagically saved by your OS' platform and synced with your new device.
Otherwise, you're such an extreme outlier that you probably either know what you're doing or can find out by yourself, right?
Ironically on macOS we used to have an app called Keychain which unfortunately was effectively renamed to Passwords for non-technical users.
Unlike physical objects they may reside in a TPM, a software vault, an export/backup, or any combination thereof. You may or may not be able to recover or migrate them, depending on where/how they were made.
Therefore you may need multiple per service, or maybe not. Services which only allow one may end up locking you out with no recourse. You get to find out.
None of this is obvious or self explanatory to normies.
Passkeys really are not any more difficult to explain than 2-factor authentication. Anyone who’s currently been able to actually create an Apple or Google account and successfully navigate their devices up to a passkey screen will be able to grok how it works.
People around here really ought to stop thinking users are complete idiots. Hell, you don’t even to scroll that far to read people calling users “normies” for crying out loud. What is this? High school?
I always operated under the assumption that the passwords app was just a more casual view into the keychain
Maybe that's a bad assumption
Sure, its explained. But not in a satisfactory way that would reach all users at their level.
This is a bit of an exaggeration and out of proportion, but I think my ideal would be one of the big tech companies should have bought out something like a super bowl ad. Something that actually conveys the idea "hey, we know you've used passwords since you were able to type on a keyboard, but here's new technology that's better and here's why" in plain language that the average person can understand.
Unfortunately, XKCD 2501 continues to be relevant. [1]
[1] https://xkcd.com/2501/
If it's that unclear to me, I can't imagine how it can be to the average user.
The way they explain them is atrociously unclear, borderline negligent for services that nag people to activate it for accounts where they may hold valuable data for their personal lives. And while I don't want to spend much time finding out the details as long as I have the option to decline them, I suppose if they can't explain it and convince people of its advantages, it's because it's just bad tech.
<<ducks>>
But for regular end users where services are primarily motivated to take money from those users and lock them into their ecosystems, they are a usability disaster and yet another exploitation vector.
It's one solution for two very different usecases, and it just does not work. There is an approach that could work for end users who own their own accounts, but they need to go back to the drawing board and rewrite the protocol with the assumption that the keystore is hostile to the user's interests. That means strong guarantees on key portability so users can migrate away from hostile keystores, and absolutely no ability for services to restrict the user's choice in passkey provider software.
(At least til I get around to setting up my new usb c yubikeys!)
I actually prefer non-resident U2F in some ways. You don't have to store anything on your key, you are just signing requests. This is relevant where U2F/FIDO keys have limited slots for 'resident' keys.
In principle, it's great. You have one good password to remember for the average user, and that's enforced by their device's probably good enough security posture.
They are resistant to being phished and they won't reuse the same one everywhere. They then don't end up going from hunter2 to hunter2! everywhere.
But my experience for users is that they worry they are giving their biometrics to Amazon or whoever and so the UX just confuses them.
The certification aspect was new to me too last time passkeys came up. Sites can require that a given passkey has been certified.
The patchy support for them is also frustrating. MacOS does not support NFC FIDO/U2F. iOS does.
I also don’t love how many websites and apps use them in stupid ways like using them alongside other 2FA or login methods when the passkey alone should be sufficient.
As a service provider myself, I've evaluated and said "Nah" to passkeys - because it's simply increased Customer Service contacts I have to invest in, whenever a user changes or loses devices, or any of the hundreds of ways Passkeys are not portable.
And guess what, the Tech companies pushing this have zero liability for user login support or security breaches. It's always me. There is no need for me to work hard and spend CS contacts, to wall off my users to the OS or Browser vendor.
I'll simply do passwordless Email or SMS 2FA / Magic Links and own my users without the overhead of Customer contacts, thank you.
But they also introduce single points of failure, as the article points out. I can't even remember how many times I've had to help a family member recover their account or get confused when they can't sign in on a new device. It's incredibly frustrating that this flow is promoted as the default for so many services.
1password is the best solution I've found for the average person. It's not perfect (it's definitely more complex than writing down your passwords on a piece of paper or using the same password everywhere) but it's much easier than juggling yubikeys. I know so many non-technical staff members who prefer the OS or browser keys even if it means another account recovery is lurking around the corner.
I proposed an alternative scheme many years ago: https://www.researchgate.net/publication/343318317_Privacy-a... . By allowing "offline" keys you can also treat them as higher priority, and use them to revoke any lesser keys from attackers if your account is compromised.
It would also be nicer to get rid of usernames, but that's a fight against the data-gathering powers that we're unlikely to win.
there's some issues with passkeys, but not being able to memorize them is a feature
For the average user, which doesn’t use a password manager, this is great. It means they can’t get phished. And it’s also great for the average password manager user, who keeps dozens of insecure and reused passwords in their vault because they manually thought of a password when signing up instead of randomly generating one.
If you’re already using a password manager and random passwords, the UX is designed to be the same. It’s just a way to get regular people to do this.
same ux, different security properties.
>Except that at least I can memorize a password by heart just in case.
"just in case" should be a thought out recovery flow, rather than hoping that you remember the password of the account you need to access.
As someone who's OpSec puts swiss cheese to shame Passkey has been a godsend. My passwords are actually much better because of it.
It should always have remained a second factor device. It’s not impossible to teach people to use these, European banking did it for years. There’s just no will to do it.
I have physical passkeys, one attached to my keys and another on my desk at home and I absolutely hate software based passkeys. Every single time I'm asked for a passkey it always ask me if I want to use my Apple Keychain first and I wish I could default to physical.
Passkeys just make it harder/riskier.
(Or since syncing passkeys usually works within ecosystems, you might just need a passkey per OS.)
Like, seriously?
The author's assertion that the greatest risk to an individual is account lockout versus phishing or password harvesting is just not grounded in reality. I get phishing emails and SMSs daily. The criminal ecosystem running these campaigns is extremely active already and set to become even more so with LLMs. These campaigns are by far the biggest threat to normies.
Whereas account lockout happens most often with multiple failed password entries, which passkeys completely eliminate. I just don't know where this risk evaluation comes from.
The author also points out that even with passkeys, if you're able to also log in with e.g. security questions, you still have a much weaker security footprint for that account. This is true, but it's also true of a TOTP second factor. So I'm not sure what the criticism is here.
The exportability argument is a real weakness and something I'd like to see addressed. Passkeys don't have an equivalent for backup TOTP codes that you can just write down somewhere or trivially store yourself. But it probably wasn't in v1 because the people who designed passkeys figured that websites would not go all in on them immediately and would preserve other authentication methods, which is exactly what's happened.
It most definitely isn't. Any 2nd factor that is not the device I am currently using (either a yubikey or my phone) has a non-zero chance of not being near me when I need it, leading to the constant question of "where the fuck did I put that darn thing", only to find out that the cat has decided to believe the yubikey is a mouse and tried to devour it, the phone's battery went dead...
That said, I don't like passkeys either.
They didn't want to cooperate, and they wanted to make passkeys transferable within you cloud account, while not cooperating with anyone or anything else. The result was that you have no predictable and stable pattern/protocol/interface, or even general description, for how, for instance, a website connects to the passkey or even a hardware key, if you wanted it.
We basically have all the browsers, the operating systems, and the password managers, all fighting over who gets to store and present the passkey. And everybody assumes that they are the only one that exists and actively tries to fight the others is they can.
The basic technology is really good and could work well, but the large asshole tech firms focused on self-interest and walled gardens and made it insufferable.
Probably hundreds of millions or even billion people have devices that support biometric auth. How is that not mature?
Brilliant security: a highly secure high-tech shiny front door that can randomly fail to open, so you still need the low-tech back door, which is the one potential thieves will use.
Mind you, it can work if the back door is old but sturdy (basically, for a bank that will ask for KYC authentication, or in the worst case you can set foot in the brick-and-mortar branch showing your face and ID and ask for access) but for pretty much every other service it introduces risks for very little or no gain.
I don't know who designed this or who thinks these are acceptable affordances, but it seem to be part of the same disingenuous push that's behind passkeys in general.
Microsoft is especially poorly prepared for this - Often if you have a passkey, it will CONTINUE To ask you to create a passkey (a new and different one), and it may save it in a different place, which is infuriating.
Strong password + MFA is the way, and I don't see that changing.
People have replied it's possible to extract the private key, but it's not clear to me that that's usable (maybe it is I don't know). It's certainly not in line with what passkey devs want people to do and not do, so I'm not interested in "fighting" against the "flow" so to speak.
I'm happy with TOTP, as I can manage and use the codes where I want, under my control.
Passkeys work nicely, and I'll use them, in cases where I want decent security, but I don't consider them the "Philosopher's Stone" of regular end-user security. I think they are still a bit too "fiddly" for your average Joe[line].
The purpose of rotating passwords is to cycle out potentially compromised ones, due to phishing attacks, keyloggers, shoulder snoops, etc. But those cannot exist with a passkey.
Password managers are great IMO, I can use some absurdly long password, backup is reliable, I can use them across devices. For extra secure stuff 2FA works the same, I've got an app with codes I can easily back up and use from multiple devices.
Passkeys tend to obscure everything and take away a lot of control.
If you think passkeys aren't ready yet, blame the people implementing it on their platforms.
Of course, at the rate we see security failures everywhere, I'm not entirely convinced writing your passwords on post-it notes wasn't such a bad idea after all.
It's entirely one sided solution.
Like, no company should be storing anything but a salted hash of their users' passwords.
1. Write it down on a piece of paper and put it in a safe deposit box.
2. Read it on one device (or from a piece of paper!) and enter it manually on another device.
Plain text is the ultimate form of cross-platform portability. Passkeys are the ultimate form of vendor lockdown. The passkey vendors won't even allow you to view the private key, unlike with ssh keys, which you can also write down on a piece of paper. It's vendor cabal to destroy computing freedom in the name of "security", always the excuse. Tech company paternalism at its worst.
If passkeys were meant to be user friendly then there'd be a secure optical transfer mode to QR code them from device to device with the screen and camera.
Easy to implement (receiver flashes a public key, sender encrypts to that key and flashes the QR code back).
That it doesn't exist for a protocol meant to work with phones tells you exactly where the thinking was headed.
It's a minor inconvenience, but happens so regularly I hate it. It also stops the login flow until I dismiss the prompt, which is also annoying as I could've already gotten to the page I wanted to get to in the time it took to dismiss the dialog.
I can see why they would be problematic for people who otherwise live life with a single love2025 password though.