Passkeys were invented by engineers with zero understanding of consumer brain

It just so happened that Microsoft sent an email today to our M365 tenant administrators that SMS and voice for 2FA is being removed 1-Feb-2027 and that automatic enrollment to passkeys starts 1-Sep-2026. Bring on the passkey overlords. Although, LLMs say that passkeys are superior to passwords since it includes a public/private key setup with the private key saved to a device that requires a PIN or biometric to access the private key.

> Passkeys were invented by security engineers with zero understanding of the consumer brain.

... of the human brain.

Have to agree. They are, indeed, very safe and effective, but no user that usually picks "fuckyouhacker" as a password, is gonna use them, given a choice.

You’d think a head of product at a tech company would embrace a “it’s literally impossible to have your password stolen if you use this” technology.

the real achievement of passkeys is making people nostalgic for passwords

Passkeys are so, so, so bad. One of the worst things our industry invented. The sooner sites start leaving them on the wayside and just go back to TOTP, SMS, and Email codes/links, the better. These work. We solved auth. Its fine.

I don't know everything there is to know about passkeys or anything, but my reaction to most of these comments is "You're passing yourself off as someone who has relevant opinions about security, and you can't possibly imagine how these things work or how they're useful? Come the fuck on."

Passkeys are basically session cookies that are signed by a secure element in one of your devices at the time you log in. That's it. They cannot be phished because there is no password to steal. If I had to guess, the basic flow is something like this:

1. When the passkey is created, the device's secure element coughs up a public key or something to the server representing itself as a trusted device

2. When a user logs in, the server issues a challenge (basically a random number) to the device and says "sign this with a private key that corresponds to one of the trusted public keys I have"

3. The secure element signs the challenge and sends it back

4. The server goes through its list of trusted device public keys until it finds one that verifies the challenge response. If it finds one, it logs you in. If it doesn't, you don't log in

Step (1) is probably bootstrapped with a username/password and second factor like SMS 2FA, OTP, or email 2FA.

Even if this isn't exactly how they work, it's a plausible implementation. Nothing about this requires vendor lock-in. The various secure elements that can produce passkeys come from many different places, so I'm sure sufficiently motivated open source people could create a firmware TPM that is certified for use with passkeys or something if they cared enough.

I find it difficult to explain how to use password manager to non-IT person. Whatever I say, they say it is not secure. No amount of explanation will change their mind. They prefer to keep their passwords in their physical note book hidden in the safe (yes, they open the safe etc each time they need to log in somewhere when they get logged out).

As someone with ADHD a passkey is something I can lose easily and I don't want my accounts to be tied to any specific device. What if I have to upgrade my laptop tomorrow because one I use got bricked? Sounds like an absolute nightmare.

Password on the other hand I can remember for dozens of services, each very long.

Obligatory https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt...

It's a shame, because WebAuthn is really great technology. But tech companies are botching the rollout.

Another noteworthy annoyance is the increasing number of services that try to aggressively push you towards passkeys, without you ever asking.

Every other time I open the Costco app (needed to walk in to the store, since I don't carry my card and they refuse to provide Apple Wallet integration) I get asked to switch to passkey, without a way of saying "don't ask me again".

If you're in any position to determine this in your company/software, please stop this pattern. Give users the option to say "stop asking me about passkeys".

I just stick with TOTP.

Why not use SQRL instead?

The cumbersome and poorly designed workflows surrounding passkeys are a significant hindrance to their adoption as well. It surprised me how bad they were when they emerged -- it was as if the UX was intentionally designed to kill passkey adoption.

I hate passkeys so much. They're so confusingly implemented.

I find it annoying that gmail has simply decided that my unlocked phone is more secure than my computer.

I'd like to try passkeys out. I actually tried again on Amazon in response to reading the comments here. But it just.... doesn't work?

I'm on a laptop running Ubuntu, I use Firefox as my browser, and I use 1Password as my password manager. I have both the browser extension and native Linux application installed, and they sync/communicate with each other (so if I unlock the native Linux app, the browser extension also unlocks).

When I open my Amazon.com item in 1Password, it has a helpful link to https://passkeys.directory/details/amazon which tells you clearly, step-by-step how to set up a passkey. Great! I love clear directions.

But when I get to the step when I click the "Set Up" passkey, Firefox gives me an address bar pop-up saying "Touch your security to continue with www.amazon.com".

Huh?

I don't have a security key. My laptop does have a fingerprint reader, which I use to unlock my screensaver (and it's integrated with some KDE keyring thing), so I tried putting my finger on that. Nothing. I opened the 1Password extension. Nothing there, just normal view of my login info. I opened the 1Password native application. Nothing there either.

Maybe it's a Firefox issue, or a Linux issue? So I tried setting it up on my phone (running GrapheneOS and their Chromium-based browser), which has the 1Password app installed. I logged in, and this time got far enough that 1Password brought up a prompt asking "Do you want to save this passkey?" I tapped Yes, and it then immediately told me "Unable to save passkey: For security reasons, 1Password did not save this passkey. The associated URL for this passkey does not match the selected app." So... does that mean 1Password is refusing to touch the passkey because it didn't come from the com.google.chrome Android application?

This whole experience has re-affirmed my skepticism of passkeys in practice. I think it would be awesome to have public/private key security on my online accounts. I think it would be great if I could log in without having to copy/paste passwords (when autofill doesn't work, or for TOTP codes). But I have zero confidence that this opaque stream of bytes will actually work to get me logged in to my account. When the 1Password input field detection fails, I sigh, copy/paste my username and password, and then forget about the mild inconvenience after about 30 seconds. I don't even want to think about what would happen to an account if the only way to log in to an account was via passkeys.

I do not understand all of the drama surrounding passkeys. They work flawlessly for me on all my devices. Maybe that’s because I’m all-in on Apple devices, but I have yet to have a single problem with passkeys.

Ah! Like Pgp

One of the worst technologies I've had the misfortune of being forced to use honestly. It's always confusing and always breaking or not working as I expect across my devices?

Passkeys do have drawbacks and tradeoffs, as has everything, but my god did I feel the energy of „lol I’m so bad at math” in that tweet and a lot of „lol smelly nerds” in replies.

Passkeys? That shit that's not a password or a crypto key that I never use?

I don't know how to rationalize it: is passkey so good that even the banking apps start pushing it, or is it all a big conspiracy theory with a hidden agenda?

Passkeys were invented so hacked sites could brush off their leaks with "no credentials were leaked" and minimise any regulatory fines. This is the reason why its being pushed by the big players.

Additionally this puts the same players in control of your logins - want to sync your passkeys? - enable "iCloud Keychain", or some other 'trust me bro' app that will 'securely store/sync your data' - no thank you.

In perfect world users should be able to generate a certificate, upload it to a couple nfc capable ubikey like devices that blow a fuse afterwards preventing from additional writes/reads and use that to login to every app ever. You would buy such devices in packs of 3, upload same cert to all, hide the other, burry the third.

The fundamental blind spot engineers have had with every authentication protocol for 30 years is forgetting that trust must be mutual. The lone exception has been phishing prevention with user-selected avatars, and that didn't last long.

Every advancement in "security" has assumed the service needs to more strictly identify the customer, without caring about the customer's trust for the service, or experience with performing the identification ritual.

So when your bank asks you for a code or your mom's maiden name, they never offer anything to verify they are who they say they are. whenever I ask they say "of course we're from chase, we just called you", without realizing how absurd that is.

Now Passkeys suffer an even worse dilemma. Now the customer has 4 dimensions of tools to record & use in order to log in. Did I use email, google, facebook, apple ID to log in? Did I save this code via phone, text, authenticator app (which one, there are multiple incompatible ones)? Did I use a passkey ? where is that passkey located? my phone, my browser storage, my authentication extension.

We started with a single dimension of email + password to log in. Now it's an entire decision tree that has to be recorded. How do you even record this?

  disqus :  credential = email, password = "see bitwarden", 2fa = microsoft authenticator, passkey = "on iphone in icloud"

  viator: credential = google sso, password = same, 2fa = symantec, passkey = "edge on windows 11 laptop in office" 

I thought engineers were tested for scaling during the interview process. This protocol doesn't even scale to a single site.

> Imagine you’re a boomer and you just figured out how to store your passwords

i'm gonna stop you right there

[dead]

[dead]

My tinfoil hat take is that there's significant interest to keep everything digital, always-online and connected to the major providers, so it can easily be snooped by five eyes using their omnipresent backdoors.

Passkey biometrics also allow you to confirm certain person is holding the device right in this very moment, and not receiving a TOTP via walkie-talkie. Especially important for kinetic sanctions.

If you check out their Terramare group of companies those guys are still using typewriters. Unless you're US/UK millionaire I recommend to stay as analog as possible with physical password book and TOTP/yubikey.

Same with the push for "post-quantum crypto" and elliptic curves. I feel my systems get significantly more attention when using 8k RSA than any of its modern replacements. While I love wireguard the transition to ED25519 felt way too smooth..

I think there are probably sinister motives behind some of the push to pass keys, but you'd think that if that were true, they would make it really quite easy to add one and to use.

That is not the case. The entire setup/enrollment/add a passkey to your account processing is DMV inspired.

I don’t understand this point at all. I think the author has himself confused with the average consumer. For the first time in a decade or so you can buy a PHYSICAL key and use it to sign into websites. I can explain this to any grandma out there. Likewise, I’m an Apple user. Once you’re in Apple universe passkeys are extremely easy. Tap your thumb on the scanner, done. Now we can put on the tinfoil hat and say how this fosters vendor lock in yadda yadda but the last thing I would say is that it has terrible user ergonomics. LOL

At Caution we -exclusively- allow passkeys. The entire database is user ids and public keys. If it leaks, it would only be mildly annoying.

If you are confused about digital passkeys, you can use a physical yubikey or nitrokey and tap it when it blinks. You can treat them like a credit card or house keys.

Asking people to keep up with and remember passwords is and always has been the thing that was invented with zero understanding of the consumer brain.

Consumer passkeys are just an extension of the OMB Policy Memorandum M-19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access Management (dated May 21, 2019). It is ultimately part of anti terrorism efforts with regard to banking and fraud. Think of this as consumer computer version of the scene in the movie The Baader Meinhof Complex when the cops are discussing a proposal for electronic data processing. "According to a poll by the Allensbach Institute, one in four Germans under 30 sympathizes with the RAF. That's nearly 7 million people. That amounts to an enormous pool of sympathizers, which makes the search for perpetrators extremely difficult." It signals the end of publicly available general computing. This was always inevitable, the mob cannot be trusted with weapons of mass destruction. Computers = Guns

Passkeys are a mitigation against users being bad at password hygiene and phishing being a real issue to users.

You can't phish a passkey, and you don't rely on the user providing you 'hunter2' on every site.

As for vendor lock in? No. The specs are open. You can run the code on a microcontroller, or, you can keep it in your arm with something like the Vivokey Apex. Note that the FIDO2 for the Apex is an open source Javacard applet.

The UX on the other hand is not great. If you have a password manager, your OS may prompt you which target to store the passkey with.

I will never understand how a small group of tech savvy people are heavily confused and against a simple and more secure system.

You want anecdotes? Ok. I’ve had elderly adult relatives who aren’t good with their devices tell me unprompted they’re using them and like them when I mentioned the word out loud to myself using my phone around them.

These are people who don’t know the difference between apps and the web. Who have 200 tabs open because they don’t know what tabs are so a new one just gets opened automatically all the time. Can’t tell some websites apart. Who change their passwords on every login to some sites because they can’t get sign in right.

Yeah if you want to write them down or refuse to save passwords outside text files or demand they live on a security key on your keychain you’ll have a hard time. You’re being 0.0000001% of the user population. You’re not representative.

They are a MASSIVE UX win. A MASSIVE security win.

I’ve logged into my work computer with a passkey on my personal phone, no issue. It’s fine. They’re backed up locally. It’s fine.

The biggest problem, which is getting better and somewhat a transition problem, is sites using terrible UX to trigger the workflow. Those that follow the suggestions or close to it are great.

I love passkeys. I just don’t get the confusion.