Comment by chaboud
5 days ago
I thought "Passkeys are a trap" was going to be about this usability nightmare. Some sites, once connected via passkey, make it all but impossible to connect in another way. Some support multiple passkeys. Some do not. Some support passkey or something else. Some do not.
The idea and protocol are pretty solid, though we're back to a "biometrics as password" problem in many device flows, but every time I'm urged by a site to convert to a passkey, I wonder "is this site the sort that would screw this up?"
So far, it's about 30% of sites screwing it up...
This is the issue.
I can’t adopt Passkeys if I’m not certain they’re going to work as well as my password manager and Authenticator app, which is to say 100% of the time.
When sites ask to set up passkeys, it’s usually native passkeys (especially on iOS). And figuring out how to get the flow to set up a LastPass key by default seems unusually difficult.
I also use a MacBook, windows desktop, an iPhone and iPad. I use Firefox, edge, brave across these devices.
When I say “passkeys are a trap” they are a usability trap where no one can attest with certainty that I won’t wake up in a painful situation because I decided to adopt passkeys.
It's ironic that passkeys are most usable in conjunction with a password manager that syncs them across all of a user's devices, but this is also the scenario where they have the least security benefit over traditional passwords.
I do appreciate that passkey adoption has led to wider support for hardware security tokens for sites where I actually care about increased security over password managers, however.
The specific security benefit is that there's no way for a tech-stupid person, or a tech-literate person who's short on sleep, to copy paste their password into p4ypal.com instead of PayPal.com.
12 replies →
> I do appreciate that passkey adoption has led to wider support for hardware security tokens
In my experience this simply didn’t happen. Many sites support passkeys but only the native passkey stored on the current device, but not a hardware security key. Many sites don’t even allow multiple passkeys, which is frankly required if you use hardware security because you will want multiple pieces of hardware in case one is misplaced.
1 reply →
> that syncs them across all of a user's devices
What's the point of a passkey that can technically be exfiltrated off a device it was created on? I thought the whole premise of passkeys is that they can't be copied, and hence can be trusted as much as the device access control. Am I missing something?
2 replies →
Passkeys are always more secure.
10 replies →
> no one can attest with certainty that I won’t wake up in a painful situation because I decided to adopt passkeys
Seems that way. Better luck next year, passkey standards(?) people. Hope it’ll be ironed out at some point.
I think the repeated posts and articles constantly rehashing this topic is telling. Every thread is nearly the same in terms of some people saying “here are the reasons why passkeys don’t work for me” and other people saying “you’re holding it wrong”. I don’t think many people come away with their views changed.
5 replies →
From my experience, passkeys work great in the Apple ecosystem. Adding a passkey for a new site on my Mac results in that passkey syncing automatically on my iPhone and iPad via iCloud.
"But what if I lose all of my Apple devices in a freak boating accident?" people often ask or something like it. Apple has a procedure for this [1].
You can contact your "recovery contact" (a trusted friend or family member) that can help authenticate you to regain access to your account, especially if you're locked out or forgot your password.
On a new device, you login to your Apple account, make sure iCloud Keychain is enabled, and all of your credentials, including your passkeys, sync to your device.
I get it—not everyone wants or uses iCloud. Apparently, you can use 3rd party password managers like 1Password, Bitwarden, etc. to backup and recover your passkeys to use elsewhere.
Here's a video of an export from 1Password to the Passwords app on an iPhone [2].
[1]: https://support.apple.com/guide/iphone/passwords-devices-iph...
[2]: https://youtube.com/shorts/gJ8BzT73JzY?si=zSY8vp_v297IfCro
I don't fear loosing all my devices in a freak boating accident. I fear apple deciding they don't like me for whatever reason and then I am fucked.
It is why I never use "sign in with <google, meta, apple, whatever>"
1 reply →
But what I don't understand is how are passkeys improving what Apple provides here. You could have just done this with passwords and had all the ecosystem benefits you outlined.
6 replies →
Ok, great. What about in a mixed ecosystem like I’m using?
9 replies →
So the solution to my iDevice dying is that I have to buy a new one to maintain access to my accounts and have no option to move to non-Apple hardware?
3 replies →
What do you do when Apple ban your Apple account?
Seeing how effortlessly 1Password supports exporting to other clients really makes me want to use 1Password more. How does it handle other fields - Apple Passwords has like 5 fixed fields while 1P has dozens and custom fields?
1 reply →
This sounds like an iOS problem. Bitwarden + Firefox on Linux, or Bitwarden + Android, has never been anything but smooth for me when it comes to saving or using Passkeys.
If we go for anecdotal examples that are not representative, then in my case, Bitwarden passkey use ends in an endless loop with most websites. Import and export is still a promise or "coming soon." In the case of hardware keys, two devices are needed. I was a proponent of passkeys, but big players screwed that up, like every single shared "standard".
Bitwarden / ProtonPass + iOS has also been smooth. So sounds like a lastpass issue.
iOS has really good support for third party Password Managers. I've seen the integration with both Strongbox and 1Password. I've heard Bitwarden supports it as well. I think it is a Lastpass problem in this specific case.
I’ve never seen an implementation where passkeys deleted my password or could lead to a situation where it was locked out. They usually just bypass the password+2fa dance when functioning, and otherwise just don’t matter if they don’t function. (Well perhaps except home depot, where it gets mad at me every time I use a password and tries to install a new copy of the same broken passkey as last time, for my convience)
If that's so then what actual security benefit is derived from it?
Of course the sites presumably will flip the switch at some dreaded point in the future where you can no longer circumvent them, but at this rate it may take a long time to reach a use by majority of users.
This. I use passkeys on mobile os to more quickly access commonly used services, but they do not completely replace other passcode+2fa credentials.
On XMoney I can't access the app on my desktop because it forced me to use an iOS device to set up the account, and I guess, but don't remember it mentioning, that it created a passkey on there. There is no alternate way to log in. You're just permanently locked out. I spoke to the devs, they say that's intentional.
LastPass has a tutorial video that shows you how to only use them for autofill: https://www.lastpass.com/features/autofill/iphone
Other password managers do, too: https://bitwarden.com/help/auto-fill-ios/#keyboard-autofill
If you need a tutorial for something that’s supposed to be as simple and transparent as a website authentication, your standard has already failed the usability test.
8 replies →
Whenever LostPass, I mean LastPass is mentioned, it makes me feel twitchy and reminds me of that time I made a really bad tech decision of using it.
LastPass is not a secure place to store your passwords. Bitwarden is the second worst place. Don't just take my word for it, do your own research.
> figuring out how to get the flow to set up a LastPass key by default seems unusually difficult
Disable iOS passwords and set lastpass as your only password autofill source. It’s far from difficult. In settings under autofill passwords
In my experience iCloud Passwords is a superior cross-platform password manager than LastPass today, so I’d recommend going in the other direction. (Source: I switched from LastPass to Passwords a couple of years ago.)
1 reply →
You might not have heard but Lastpass got hacked fairly recently. I would be careful about storing your passwords in the cloud (or at least that cloud). Keepass / KeepassDX would be safer. Sync devices with SyncThing.
That sounds terrible. Passkeys work great for me with bitwarden.
[flagged]
Yep, any time you're asked to set up a passkey it feels like Russian Roulette with future access to that account. A year or so ago, a site I relied on started enforcing biometric passkey enrollment. Without thinking about it I logged into the site on my phone and enrolled there, but unfortunately (a) that meant it didn't get registered as an "other device" in the internal system, and (b) the site didn't work correctly on mobile devices (legacy system). So logging in on a desktop would then demand that I activate the passkey, but of course the passkey was on the phone. No way to access it, and the site didn't offer me the QR code / bluetooth method. I don't remember exactly why, but it just didn't work - probably had something to do with it not liking Firefox on Linux or something.
And to add insult to injury, it wasn't even a single factor login the way passkey advocates promise. The site still demanded a normal password to log in! It was actually 3 factor authentication; something I know (the password), something I have (the passkey), something I am (the biometric).
This wasn't some random website that didn't matter made by nobodies. It was a US government website for managing grant money.
> Yep, any time you're asked to set up a passkey it feels like Russian Roulette with future access to that account.
We rolled out passkeys a couple of years ago (I work for an auth/CIAM provider). This was before most passkeys were synced (which gives me the heebie jeebies--that's a valuable set of private keys to be shipping around).
We built passkeys to be an alternate login method, not a primary one, for that exact reason.
Supporting multiple passkeys should be a minimum requirement for every Passkey implementation. It's generally worth naming and shaming the websites that don't implement that correctly. People want backup passkeys. People want both iOS keys and Windows keys for the most convenience.
My general advice for non-technical users that seems to work pretty well is "sign up for new sites with passkeys on your phone" because most non-technical people trust the password manager ecosystem on their phone, have some amount of multi-device sync already established, and the QR code started Bluetooth LE flow on desktop/Windows PCs for sharing passkeys works easiest with phone passkeys.
(I run a tiny site that is Passkey Only for login and it's been interesting providing technical support for it. One of the biggest recurring issues at this point is nothing in the Passkey flows themselves but the fact that the Facebook in app browser does not support Passkeys for a number of presumably security reasons, plus Meta being jerks, and having to remind new users to "Open in External Browser" before signing up/logging in when posting links to the site in Facebook.)
> The idea and protocol are pretty solid, though we're back to a "biometrics as password" problem in many device flows
It's still just biometrics as "device PIN". The crucial difference remains that the biometric data never leaves your device. To support Passkeys the remote website only ever sees your Passkeys' public keys, they never see biometric data, they never have a chance to store biometric data in a database to violate PII/HIPPAA/etc standards when it inevitably leaks to "hackers" (or gets sold to the highest bidder).
> Supporting multiple passkeys should be a minimum requirement for every Passkey implementation.
To go a step further, "multiple minimum" should be like... 5+. Enough to cover several devices (Laptop, Phone, Desktop) then at least one for backup/disaster-recovery purposes, and some wiggle-room for when replacing an old device with a new one.
P.S.: Though to re-echo the cynical refrain from the prior "is a trap" other piece [0], "Yet still Netflix does not want you to share your passkeys." In other words, services like them have a (bad, unreasonable) incentive to try keep that number down.
[0] https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-...
1 reply →
My takeway from “Passkeys are a trap” is that there are like four different approaches to something that everyone just calls “passkeys”, and they are not the same. For example, some are portable and some are not.
Passkey-over-Ethernet-over-USB C!
And they always ask right when logging in which is the absolute worst time to ask anything.
If I'm logging in to your app or service it's because I want to do something. Throwing up a "hey would you like to setup this complicated auth thing before you're able to do anything else?" Is annoying at best.
Then they normally follow it up with a tutorial that blocks the part of the app you need, and a full screen modal to subscribe to their newsletter, and a cookie dialog asking to let you track them, and a popup asking you to rate them on the app store, and...
Only once I've beaten away all the interruptions am I finally able to use the damn app.
> Some sites, once connected via passkey, make it all but impossible to connect in another way.
That's the issue I had with Okta a few years back. I used a password then later added a passkey through Bitwarden on my work laptop. Bitwarden hadn't yet implemented passkeys for mobile.
I went to authenticate through Okta on my work phone. It prompted me for the passkey. Since mobile passkeys didn't exist, I got stonewalled. I had to make a blood sacrifice just to get Okta to allow password access again.
This is why I don’t like passkeys. I’m surprised the “use site from multiple devices” use case isn’t more common.
Am I nuts for accessing a site from both my mobile phone as well as from the multiple computers I use?
This also gets super messy when combined with multi-site auth services like id.me where I need to use the same login to access very diverse sites and services from multiple computers (eg, irs.gov, treasurydirect.gov, disburser.treasury.gov).
[dead]
The trap is the ratchet towards attested hardware and closed-source-only implementations.
Some of them support multiple passkeys and somehow I've now got three different ones for the same site in my password manager...