logoalt Hacker News

rstuart4133yesterday at 10:05 PM1 replyview on HN

> they're precisely the same difficulties people have moving from the paradigm of "memorizing or writing down all my passwords" to "using a password manager."

Errr, no.

You can transfer a password from one manager to another. Those very same password managers won't let you transfer a passkey they hold.

And if you know the password, you can use it anywhere by just typing it in - no complex technology or protocols involved. But using a passkey involves your secure computer talking to another computer, using a complex protocol that can't go via eyeballs and fingers. If you don't have a way to connect the device holding the passkey to the computer wanting your id - say your USB A Yubikey isn't recognised by your phone, then you are out of luck - you can't use that passkey, even though it's sitting in your hand.

And you can't work around that by copying the passkey to a device that can communicate with the service you're using, because you aren't allowed to copy.

It's an unworkable mess. The mess is not created by passkeys themselves, because, as others have said elsewhere the protocol is pure elegance. The mess is created by vendors choosing lock in over transportability. I'm hoping it's a passing phase.


Replies

tshaddoxtoday at 1:21 AM

That’s a fair point. My thinking was that, once you’re using a password manager, you’ll A) use it to generate random passwords that would be unwieldy to memorize and B) have passwords synced to all your devices such that you will never deal with the plain text password directly.

Of course it is conceivable to want to directly access the plain text password for reasons you mention, although that would be exceedingly rare (at least for me). In those cases I agree that passkeys don’t work, although I might argue that if the average user thinks they need to access the plain text password, there’s a significant chance that they’re being phished!