HN

Comments (195)

• Menu

  agwa
  Note that attestation can only be required during credential registration; at login time it's not possible to retroactively require attestation if it wasn't obtained during registration. And browsers will throw up a permission prompt if a website requests attestation. Are Netflix and Twitter currently requesting attestation when people register passkeys, and rejecting the registration if the user declines the permission prompt? I very much doubt it, since Apple's passkey implementation doesn't support attestation.Therefore, the author's scenario that sites will wait until most of their users are using attested passkeys and then "flip the switch and start rejecting non-attested passkeys" isn't very plausible.Attestation is certainly a stain on the WebAuthn spec, and it would have been better if Chrome and Firefox didn't support attestation (unless perhaps the browser is enrolled in enterprise management), but this blog post is presenting a hypothetical and unlikely scenario. That's not a good enough reason to recommend TOTP instead, given that TOTP is vulnerable to phishing and passkeys aren't.If consumer-facing sites start requesting attestation when registering passkeys, they deserve to be vigorously called out, and maybe then the recommendation to use passkeys should be revisited. But until that happens, don't tell people not to use passkeys.
• Menu

  bmitch3020
  I've yet to voluntarily enable passkeys, for the main reason that I want portability, and not to be tied to any single device that can be lost. I want to be able to backup and lock my credentials in a safe. I also want to control the strength of my credentials for different services, and I don't consider my thumbprint used to unlock my phone to be as strong as a long password in a password manager.The first time I was forced to use a passkey implemented within the vendor's app (3rd party password managers were not an option). I quickly closed that account.The second time was an app that popped up a passkey opt-in in the middle of a bunch of transaction screens. I quickly realized the error, but there was no easy undo. The opt in was one green button in the middle of the screen. Turning it back off required digging through settings to find the security option to disable, and then confirm my choice multiple times. That process also signed out all my other devices.The fact that companies are resorting to dark patterns and forced requirements, where my money is held hostage, should be pretty good evidence of how poorly the passkey rollout is going.
• Menu

  danpalmer
  The very last thing, past the conclusion, the very last footnote is:> Addendum: I feel I have made a compelling case for passkeys in this article. And I haven’t even pointed out one of their best security features: they are (in most use cases) domain-bound, meaning they are resistant to what are called Man-In-The-Middle attacks."I made a compelling case... but didn't point out the most important security feature that motivated passkeys in the first place"Honestly I don't think this post did make a compelling case. There's a lot of assuming bad faith on the part of the FIDO alliance, while completely missing that preventing MITM attacks was a key design feature. The FIDO alliance members deal with stolen accounts all the time, and passkeys largely solve that. Stealing accounts is almost always done with phishing or social engineering, and passkeys solve the former and reduce the surface for the latter.
• Menu

  oefrha
  I’m an advocate for passkeys and I abolished passwords and embraced discoverable passkeys for our org’s key internal systems exclusively. So the battle cry of a title immediately put me on the defensive, unfortunately. The urge to not read is strong. A more measured title may help here.But there’s definitely a kernel of truth here. 1Password recently began to enforce userVerification: required[1][2], and suddenly on the desktop without TouchID I have to enter my login password to use the passkey on a good number of websites. I didn’t sign up for 1Password 15 years ago so that I have to enter both my very complex master password and very complex login password to sign into websites, the “one password” contract is suddenly broken after 15 years. This experience independently alarmed me about the additional constraints potential of the passkey standard and power wielded by the FIDO Alliance and partnering organizations addressed in TFA, which are, to be clear, useful for security in an organization. (We use userVerification: preferred now btw.)Therefore, I believe the passkey technology is great for enforcing a standard of security in an organization and stand by my choice for my org. But as a general purpose B2C auth tech, if the additional constraints become widely adopted, user freedom will be seriously harmed.Edit: I asked Opus 5.5 to vibe code a passkey auth solution in Go a few times without saying anything specific about userVerification. It chose required each time. So expect to see more of these. Oh and vibe coding auth without understanding it entirely is bad, please don’t do that.[1] https://web.dev/articles/webauthn-user-verification[2] https://www.1password.community/1password-at-home-31/user-ve...
• Menu

  MathMonkeyMan
  I like the writing in this article. The author did warn us, but the punchline takes a while to get to:> I’d like to be clear that there are legitimate uses of remote attestation. By using a website that requires attested passkeys you can be sure you stay safe from accidentally installing a scammer’s fake passkey application that steals your data – the website will reject such a passkey. You might want an attested Passkey even if the website doesn’t require it, since you can use attestation to verify that your software has not been tampered with by a hacker while you weren’t looking.> As for reasons to not want attestation: you might want to be able to use software that Twitter (formally X) doesn’t specifically approve of, such as Linux. Or a phone with a refurbished operating system.So the bad timeline is the one in which the industry gradually transitions to "you can't log on unless everything about your system is exactly as we want." Figures.
• Menu

  david_shaw
  This is a (very long and) well-written treatise against passkeys in their common and disparate forms. It's worth reading, and brings up several interesting and often concerning points.I don't agree with the conclusion, though.TOTP is great, flexible, and keeps the user in control; however, using a passkey in a flexible password manager (Bitwarden, keepass, 1Password, etc) really does continue to give the user control. And the user experience is dramatically easier than filling in TOTP codes.To advocate for TOTP over passkeys, we're already relying on an application to generate those numbers (authenticator apps, password managers, etc). I see no reason to not simply continue using those pieces of software to manage passkeys, too.
• Menu

  Grombobulous
  I don’t know if it’s productive for me to talk about how a headline is off-putting, but I’m going to mention it because, well, it’s a headline, and a headline is a strong first impression.Is the audience of this article the kind of people who are already using passkeys and like them? Because, if so, we’re starting at a deficit here. The author is out to get my beloved passkeys that have saved me so much time and pain.Are passkeys perfect? No. Are they even very good for no-technical users? Absolutely not…they’re incredibly confusing for that kind of person if you ask me.However, for my workflow, I’ll take them over a password+2FA type of situation where logging in is such an annoyance. The security part of the discussion is very interesting and a lot of the things in this article are stuff that I didn’t know before reading it.The issue is that, putting on my user hat, I just don’t care. As long as my accounts are reasonably secure I’m much more concerned about ease of use and workflow.
• wry_xy
  I've been complaining about passkeys for a long time and it was driving me crazy that it seemed to be the one thing that Big Tech, tech-savvy people, and normies were all on the same page about. The recent PR push a few months back was overwhelming.Passkeys in theory are great, but the capabilities of the spec are worrying. Defaults can and do change, and when they do, so follows 99% of the population, and then you find yourself either getting blocked out of services because your hardware/software doesn't comply, or you give in.But on the other end, it might not matter anyways. Apple, Google, Cloudflare, are already pushing similar garbage and now you increasingly have to scan a QR code that verifies your mobile hardware to use a desktop.
• Menu

  skybrian
  Ideally, passkeys should be cattle, not pets. You should have more than one per account, saved to more than one password manager. Then it's fine if they're not copyable because you can get another.
• jmbwell
  The precedents for a site operator allowing only “approved” software are many. Passkeys doesn’t prevent that, and indeed offers a new way to implement it. The author argues that this is a trap.
• davexunit
  > Indeed, just now I generated a passkey using free and open source software, and then I emailed it to a friend, and now we can both access the same website using that passkey. At no point did I have to ask anyone for permission, not the website, not the FIDO Alliance; not even my friend, who kindly let me monopolize her time without objection. What’s more, I don’t have to type any numbers by hand to use a passkey; I don’t have to remember any magic words; passkeys just work.This (before they go on to describe actual passkeys) sounds like object capabilities to me. Capabilities combine designation and authorization so if you don't have it, you can't use it. It's the type of security that we should be moving to.Passkey attestation sounds like a nightmare for user privacy and for anyone that doesn't use a major corporate operating system.
• albert_e
  Microsoft logins are automatically taking us through "creating passkey" and "failed to create a passkey" without any prompt to user or consent from user
• Menu

  Cider9986
  Passkeys make it feel like the site is trying to get more info about me; it seems harder to maintain multiple accounts with passkeys. They feel worse for anonymity than a password where you know exactly what you're pasting into the site.Although this isn't true because actually with a password you have to choose how to generate it and everyone chooses different ways.
• Menu

  throooooo
  I skimmed the article, lots of info. I use multiple Yubikeys with passkeys and feel better about the auth experience than any other solution thus far. When I have a negative experience I'll reexamine my usage.
• djfergus
  Attested passkeys are a dream for Apple. While google is sliding down this slippery slope fastest (eg MEETS_STRONG_INTEGRITY to require security updates) Apple has the most to gain commercially, they must be salivating over the prospect of accelerating device replacement (and blocking Linux/android forks) driven by banks, streaming media and governments.
• Menu

  chr15m
  If you don't like passkeys the solution is very simple. Resist using them. As long as a significant minority resist and refuse, they will have to keep other types of auth around.
• Menu

  Havoc
  Knowing how big tech works this will get forced down throats desired or not
• rgoulter
  A major concern raised in the article is along the lines of "passkeys have technical mechanisms that may disallow use in future".That ... doesn't seem like a concern unique to passkeys, though?It seems more like a policy rather than a technical aspect.e.g. A website might decide they will only provide services if you upload a photo of government ID, or pass a verification where you show your face.If it's software running on someone else's computer, you don't get full control regardless.
• Menu

  drhagen
  Can someone tell why the whole standard for authentication on the web is not just this:me: Can you show me my stuff?website: HTTP 401, who are you? I understand EasyAuth 1.0, if that is good for you.me: Sure, here's my EasyAuth 1.0: Hi <website>, I'm <user_id>. The time is <timestamp>. Signed, <digital_signature>.
• Menu

  arjie
  You can put your passkeys in a file if you like. I do for my personal agent. It's logged in on a few sites and it uses passkeys. Saves a few steps when it's using the browser to navigate them because it doesn't need to input credentials except for the first time.
• Menu

  tgma
  Hard disagree. Phishing is a major problem. Passwords+OTP are phishable[1]--passkeys are not (the signature is bound to the domain and cannot be forwarded). That alone makes passkeys worthwhile for the vast vast majority of consumers. This is not a theoretical threat model. You simply cannot realistically expect even a savvy consumer to be able to save themselves from phishing all the time. One mistake and they are fucked.If you write a long article about the merit of passkeys and there is no occurrence of the string "phish" in your article, I am afraid I cannot take your rant seriously.Again, this stuff is not merely theoretical. YubiKeys have been a thing at Google and other major tech companies for almost two decades now and the effects are well-studied.[1]: I have found for some weird reason, this is often overlooked and misunderstood in the industry. People even know about SIM swaps and stuff like that, but don't realize OTP is not phishing-proof.
• Menu

  ttul
  TOTP is susceptible to man in the middle attacks. Passkeys are not. That alone is a solid reason to favor Passkeys!
• notatoad
  passkeys are a website telling you they don't trust you to manage your own password, and they would rather talk to your password manager directly and skip the meatbag in the middle.and the websites are usually justified in saying that.
• MiroslavPokorny
  Makes sense, requiring your phone number to send a OTP is another way to get another bit of data about the audience.
• jasonm23
  Passkeys are crap, use them if you are stupid.- Never underestimate the effectiveness of school yard persuasion.
• Menu

  newCrotchSmell
  Curious if the author can provide examples of things we ever had ultimate control over?None of us had a say in our existence itself. Skin color. If we cannot have a say over our provenance itself "ultimate control" is just an empty phrase.Their concerns about big corp might hold some meager merit but "beware the avarice of rich people who view you as a sheep in their flock whether you want it or not" isn't really new.
• LoganDark
  > receiving a text message or email with a one-time codeThis is less secure than pure username+password in principle because it gives an impression of greater security while actually delivering the important secret in plaintext. This can cause platforms to enable the higher trust features, or have additional confidence that someone is not an attacker, even when either one would be highly inappropriate.TOTP does not have this problem since the secret is enrolled once by the account owner and then never communicated again, especially never helpfully to an attacker right when they need it.> One use case is particularly intriguing to me. In principle, remote attestation can also be run in reverse, to verify that the server you connect to is not doing anything you don’t want it to be doing (such as stealing your credit card number, or keeping backups of the posts you delete). Sadly, to my knowledge, no major platform has ever implemented “reverse” remote attestation this way.This is only possible if you've audited the code in order to approve it. In practice, this requires auditing the entire SBOM, manually, yourself, for every single platform release. Or deferring to someone else to do it. I expect this will never happen.
• tonymet
  Passkeys are a pretty terrible UX on their own, in that you have no control over managing them . And every site has a custom experience.Epic for example has at least 3 different ways to load the pass key e.g. username first, passkey first, username + password, then passkey. Luckily their app lets you in with Passkeys aloneWalmart prompts for username first, then passkey, then it sends you a verification code to your email address.The issue is that every site has a random flow of username, password, oauth (then a few oauth screens), passkey, 2fa and so on.Authentication has become absurd. None of this is making people safer. If sites are seeing less fraud reports, it's likely they are harder to detect rather than less frequent.
• Menu

  jesse_dot_id
  I love passkeys. 1Password handles them beautifully.
• loeg
  As usual for an article critical of Passkeys, this one, too, is total nonsense.
• anon
  undefined
• Starlevel004
  I tried using a passkey to log in to something and it gave me an error and I simply didn't care about trying to fix it. So passwords it is for me.
• Menu

  shmerl
  > What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys.Use proper password managers, like keepassxc. Then you have control. But problem is that not all sites support that. If you can't use the above - then yes, passkeys are bad, especially if they become mandatory.
• ContinuityLab
  [flagged]
• hdb385
  [dead]
• Menu

  cyberax
  This screed is simply BS:> What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeysPasskeys are _by_ _design_ representable as clear-text strings. You can export them and sync between devices. I'm using BitWarden with a self-hosted Vaultwarden for the server-side to do that, for example.