Comment by gortok
5 days ago
This is the issue.
I can’t adopt Passkeys if I’m not certain they’re going to work as well as my password manager and Authenticator app, which is to say 100% of the time.
When sites ask to set up passkeys, it’s usually native passkeys (especially on iOS). And figuring out how to get the flow to set up a LastPass key by default seems unusually difficult.
I also use a MacBook, windows desktop, an iPhone and iPad. I use Firefox, edge, brave across these devices.
When I say “passkeys are a trap” they are a usability trap where no one can attest with certainty that I won’t wake up in a painful situation because I decided to adopt passkeys.
It's ironic that passkeys are most usable in conjunction with a password manager that syncs them across all of a user's devices, but this is also the scenario where they have the least security benefit over traditional passwords.
I do appreciate that passkey adoption has led to wider support for hardware security tokens for sites where I actually care about increased security over password managers, however.
The specific security benefit is that there's no way for a tech-stupid person, or a tech-literate person who's short on sleep, to copy paste their password into p4ypal.com instead of PayPal.com.
Yes but if you have a password manager that's set up well you'll never be copy pasting passwords in the first place. If the password doesn't show up you know there's a problem.
The benefit of a passkey here isn't zero but it's at the minimum.
10 replies →
> I do appreciate that passkey adoption has led to wider support for hardware security tokens
In my experience this simply didn’t happen. Many sites support passkeys but only the native passkey stored on the current device, but not a hardware security key. Many sites don’t even allow multiple passkeys, which is frankly required if you use hardware security because you will want multiple pieces of hardware in case one is misplaced.
> Many sites support passkeys but only the native passkey stored on the current device, but not a hardware security key.
That's a function of your browser, not the site.
Your point about multiple passkeys is valid though. That affects me too. I use multiple hardware keys but cannot enroll many sites because of this.
> that syncs them across all of a user's devices
What's the point of a passkey that can technically be exfiltrated off a device it was created on? I thought the whole premise of passkeys is that they can't be copied, and hence can be trusted as much as the device access control. Am I missing something?
It would introduce a different usability problem to have them remain truly stuck on a device, like, locked inside a Secure Enclave. Mainly that you’d have to do the setup again for every website, on every device. Buy a new phone? Back to the Stone Age. Authenticate with a password to each site on the new device, find the “add passkey” place, and install it.
I think that is a big step down from the convenience and friction level that the native password managers get you, where you save your password once and for the rest of your life, as long as you maintain fealty to Apple/Google/Microsoft, your password will always be there in autofill.
I think you're missing the article that made it to the top of HN a few days ago that explained all the many different varieties of PassKeys
https://news.ycombinator.com/item?id=50048312
Passkeys are always more secure.
Password managers provide all the same security benefits as passkeys, without the lock in.
9 replies →
> no one can attest with certainty that I won’t wake up in a painful situation because I decided to adopt passkeys
Seems that way. Better luck next year, passkey standards(?) people. Hope it’ll be ironed out at some point.
I think the repeated posts and articles constantly rehashing this topic is telling. Every thread is nearly the same in terms of some people saying “here are the reasons why passkeys don’t work for me” and other people saying “you’re holding it wrong”. I don’t think many people come away with their views changed.
It breaks the traditional login paradigm. I had a hard time trying to setup a single device as my passkey manager. Now I realize that you should make one on all your devices. My bank website, I have my password and two separate passkeys. Individual sites may have an implementation issue, but in that case I use the more troublesome password workflow. I still come across password implementation issues on some sites.
3 replies →
[dead]
From my experience, passkeys work great in the Apple ecosystem. Adding a passkey for a new site on my Mac results in that passkey syncing automatically on my iPhone and iPad via iCloud.
"But what if I lose all of my Apple devices in a freak boating accident?" people often ask or something like it. Apple has a procedure for this [1].
You can contact your "recovery contact" (a trusted friend or family member) that can help authenticate you to regain access to your account, especially if you're locked out or forgot your password.
On a new device, you login to your Apple account, make sure iCloud Keychain is enabled, and all of your credentials, including your passkeys, sync to your device.
I get it—not everyone wants or uses iCloud. Apparently, you can use 3rd party password managers like 1Password, Bitwarden, etc. to backup and recover your passkeys to use elsewhere.
Here's a video of an export from 1Password to the Passwords app on an iPhone [2].
[1]: https://support.apple.com/guide/iphone/passwords-devices-iph...
[2]: https://youtube.com/shorts/gJ8BzT73JzY?si=zSY8vp_v297IfCro
I don't fear loosing all my devices in a freak boating accident. I fear apple deciding they don't like me for whatever reason and then I am fucked.
It is why I never use "sign in with <google, meta, apple, whatever>"
True... but a majority don't care. And it works.
As always you are not compelled to that. Lets others enjoy the convenience of passkey.
But what I don't understand is how are passkeys improving what Apple provides here. You could have just done this with passwords and had all the ecosystem benefits you outlined.
You can't enter a passkey at the wrong website.
5 replies →
Ok, great. What about in a mixed ecosystem like I’m using?
The 1password integration works great IME. When a site supports passkeys, 1password seems to offer to save the passkey, and at login time, a little popup appears from 1password asking if I want to use my passkey, and I can either enter my password, or use TouchID to unlock 1password.
I use this across iPhone, MacOS and Windows, and haven't run into any issues.
3 replies →
As mentioned a cross-platform password manager like Bitwarden is the way to go in this case. But yeah, the vast majority of internet users don’t use one.
You're in a mixed ecosystem. You unfortunately get mixed results.
1 reply →
Get a Yubikey?
So the solution to my iDevice dying is that I have to buy a new one to maintain access to my accounts and have no option to move to non-Apple hardware?
Usually you can setup an alternate 2FA like TOTP, a recovery SMS, or something else you can use to prove who you are. And then once you're into the site, wipe the current passkey and setup a new one on your current device.
2 replies →
What do you do when Apple ban your Apple account?
Seeing how effortlessly 1Password supports exporting to other clients really makes me want to use 1Password more. How does it handle other fields - Apple Passwords has like 5 fixed fields while 1P has dozens and custom fields?
A third party cloud solution that's not even open source I think and an attacker will get all your passcodes if he hacks them? No thank you.
This sounds like an iOS problem. Bitwarden + Firefox on Linux, or Bitwarden + Android, has never been anything but smooth for me when it comes to saving or using Passkeys.
If we go for anecdotal examples that are not representative, then in my case, Bitwarden passkey use ends in an endless loop with most websites. Import and export is still a promise or "coming soon." In the case of hardware keys, two devices are needed. I was a proponent of passkeys, but big players screwed that up, like every single shared "standard".
Bitwarden / ProtonPass + iOS has also been smooth. So sounds like a lastpass issue.
iOS has really good support for third party Password Managers. I've seen the integration with both Strongbox and 1Password. I've heard Bitwarden supports it as well. I think it is a Lastpass problem in this specific case.
I’ve never seen an implementation where passkeys deleted my password or could lead to a situation where it was locked out. They usually just bypass the password+2fa dance when functioning, and otherwise just don’t matter if they don’t function. (Well perhaps except home depot, where it gets mad at me every time I use a password and tries to install a new copy of the same broken passkey as last time, for my convience)
If that's so then what actual security benefit is derived from it?
Of course the sites presumably will flip the switch at some dreaded point in the future where you can no longer circumvent them, but at this rate it may take a long time to reach a use by majority of users.
This. I use passkeys on mobile os to more quickly access commonly used services, but they do not completely replace other passcode+2fa credentials.
On XMoney I can't access the app on my desktop because it forced me to use an iOS device to set up the account, and I guess, but don't remember it mentioning, that it created a passkey on there. There is no alternate way to log in. You're just permanently locked out. I spoke to the devs, they say that's intentional.
LastPass has a tutorial video that shows you how to only use them for autofill: https://www.lastpass.com/features/autofill/iphone
Other password managers do, too: https://bitwarden.com/help/auto-fill-ios/#keyboard-autofill
If you need a tutorial for something that’s supposed to be as simple and transparent as a website authentication, your standard has already failed the usability test.
This isn't a standards problem, this is an "Apple, Google, and Microsoft made using your own software difficult" problem. They have an interest in making their authenticators the default, and the settings UX on all three platforms makes it unclear that their authenticator is active as well as your own "third-party" authenticator choice.
6 replies →
you're misunderstanding: this isn't specific to passkeys, this is for changing the password manager(s) used when filling passwords, 2fa codes and passkeys.
since the person I responded to couldn't find it, I linked tutorials. it amounts to opening the Settings app, going to "General" and then "AutoFill & Passwords", so it's also not terribly difficult to find compared to other iOS settings.
you could've at least tried to understand what's being talked about before blindly complaining.
Whenever LostPass, I mean LastPass is mentioned, it makes me feel twitchy and reminds me of that time I made a really bad tech decision of using it.
LastPass is not a secure place to store your passwords. Bitwarden is the second worst place. Don't just take my word for it, do your own research.
> figuring out how to get the flow to set up a LastPass key by default seems unusually difficult
Disable iOS passwords and set lastpass as your only password autofill source. It’s far from difficult. In settings under autofill passwords
In my experience iCloud Passwords is a superior cross-platform password manager than LastPass today, so I’d recommend going in the other direction. (Source: I switched from LastPass to Passwords a couple of years ago.)
In Coders at Work, Peter Seibel quotes Jamie Zawinski as saying that certain Netscape acquirees were people for whom "cross-platform means both Windows 3.1 and Windows 95."
You might not have heard but Lastpass got hacked fairly recently. I would be careful about storing your passwords in the cloud (or at least that cloud). Keepass / KeepassDX would be safer. Sync devices with SyncThing.
That sounds terrible. Passkeys work great for me with bitwarden.
[flagged]