Comment by jasomill
5 days ago
It's ironic that passkeys are most usable in conjunction with a password manager that syncs them across all of a user's devices, but this is also the scenario where they have the least security benefit over traditional passwords.
I do appreciate that passkey adoption has led to wider support for hardware security tokens for sites where I actually care about increased security over password managers, however.
The specific security benefit is that there's no way for a tech-stupid person, or a tech-literate person who's short on sleep, to copy paste their password into p4ypal.com instead of PayPal.com.
Yes but if you have a password manager that's set up well you'll never be copy pasting passwords in the first place. If the password doesn't show up you know there's a problem.
The benefit of a passkey here isn't zero but it's at the minimum.
I've used a number of password managers over decades. I'm still having to copy and paste passwords from time to time due to poor/hostile website designs, needing to authenticate into a browser/app that doesn't have the plugin configured yet, bugginess on the plugin detecting the right site, etc. And in the end, if the user can copy and paste that wherever, the user will copy and paste that wherever.
Meanwhile there are other security benefits as well. With a password, that static credential is transmitted in the handshake. It can be mishandled somewhere in between, and now that entire root credential is potentially compromised. This is just impossible with a passkey. The credential never leaves the client. In some implementations, the credential never leaves a secure enclave, never even entering the client's system memory. You can't say the same for passwords, not even close.
1 reply →
This would be true if websites consistently annotated inputs correctly, but they don't. So password managers are left to guess what input is the username, which is the password, etc. and they don't always get it right.
> for a tech-stupid person
> password doesn't show up you know there's a problem
Here is your contradiction.
The normal person will just assume that some tech isn't working today again.
A key point of passkeys seems to be that it guarantees to the site owner that the user cannot be phished, without having to make assumptions on whether the user is tech-stupid.
6 replies →
> I do appreciate that passkey adoption has led to wider support for hardware security tokens
In my experience this simply didn’t happen. Many sites support passkeys but only the native passkey stored on the current device, but not a hardware security key. Many sites don’t even allow multiple passkeys, which is frankly required if you use hardware security because you will want multiple pieces of hardware in case one is misplaced.
> Many sites support passkeys but only the native passkey stored on the current device, but not a hardware security key.
That's a function of your browser, not the site.
Your point about multiple passkeys is valid though. That affects me too. I use multiple hardware keys but cannot enroll many sites because of this.
> that syncs them across all of a user's devices
What's the point of a passkey that can technically be exfiltrated off a device it was created on? I thought the whole premise of passkeys is that they can't be copied, and hence can be trusted as much as the device access control. Am I missing something?
It would introduce a different usability problem to have them remain truly stuck on a device, like, locked inside a Secure Enclave. Mainly that you’d have to do the setup again for every website, on every device. Buy a new phone? Back to the Stone Age. Authenticate with a password to each site on the new device, find the “add passkey” place, and install it.
I think that is a big step down from the convenience and friction level that the native password managers get you, where you save your password once and for the rest of your life, as long as you maintain fealty to Apple/Google/Microsoft, your password will always be there in autofill.
I think you're missing the article that made it to the top of HN a few days ago that explained all the many different varieties of PassKeys
https://news.ycombinator.com/item?id=50048312
Passkeys are always more secure.
Password managers provide all the same security benefits as passkeys, without the lock in.
Absolutely not. Phishing resistance is the big one. But also if hardware backed, resistant to stealers.
7 replies →
Can you login using a password on an untrusted PC and be sure it's still safe? And there is no lock in. You can have multiple passkeys from different providers I have Windows and Android setup for my bank. The lock in conspiracy doesn't even make sense. Who benefits. Let's just say Google tried to only allow passkeys. Why is my bank going to drop passwords and enter into passkey only relationship with Google and/or Apple. If I have that power I am not going to use a web standard anyone can implement. I would use a proprietary system that nobody else can.