7 ms·

Until they are successfully explaining how to use these in a way that 70 year olds on eBay can understand, this should not be forced on users.

josteink 2y ago
«Activate login via FaceID». «OK». Congratulations. You have a passkey. Was that easy enough?
- jedberg 2y ago
  What happens when they lose or break the phone, or switch phones, which my parents do every two or so years?
  - jf 2y ago
    If they have a Google or Apple account on their Android or iOS device, then nothing happens.
    - jedberg 2y ago
      I mean in the interim. How do they get into their email to find their support contract to get another phone if they can't get into email without their phone?
      - jf 2y ago
        For Apple at least, you walk into an Apple Store, buy a new phone, and have them help you log into it again.
        jedberg 2y ago
        What if you're traveling and there is no Apple Store nearby? And now you can't log into your email to get your travel itinerary or your transportation receipt? The greater point is not the specific edge cases, it's that they haven't been worked through. Even a sophisticated user like myself doesn't want to use passkeys exclusively yet because of this very reason. I'm not confident that I won't get completely locked out when it's absolutely critical that I get in.
    - bongodongobob 2y ago
      Except if you switch phone numbers and get a new phone. My iCloud email address is permanently fucked because I set up an iCloud account years ago with a different phone number. Since I no longer have the number or another Apple device synced to that iCloud account, I'm permanently locked out forever.
    - Nathanba 2y ago
      But don't you also get into that account via your passkey? How do you know that the passkey you are using to get into the Google/Apple account isn't the same one that will be lost if you lose your phone? I've actually implemented passkeys on my website and I still don't use passkeys for e.g my own Google account because I don't trust it.
      - vel0city 2y ago
        I actually recently unexpectedly broke my phone. Getting back into my Google account protected by passkeys was pretty simple though, I just logged in to my new phone with a passkey stored on another device. Which is fine, because I've got several different devices with passkeys on them. Same thing with logging into my mail provider which I use passkeys for. A few accounts I did have to go find a backup passphrase for, but none of those accounts are the kind of accounts I'd normally be trying to get into while on vacation or something. I don't travel very far or very long without a couple of different authenticators. If its farther than a bus fare and I'll be gone for a while, I'll probably have at least two, maybe three authenticators on me. For example, my phone, my laptop, and a yubikey. Its only a few dollars for the public transit around me, so if my car explodes on the other side of town with my bag containing my keys and my laptop in it and I had to jump out into the river to avoid the explosion and debris and it broke my phone I'll still be fine to get home with a few dollar bills in my pocket. Or hopefully those other physical security tokens commonly called credit cards will also still work. And there I'll probably have my desktop at home and another yubikey. But honestly that kind of thing doesn't happen to me too often so I'm not too worried.
        Nathanba 2y ago
        All you said is that it worked for you, you even emphasize that your usecase was different because you have several devices. This doesn't relate to my question.
        vel0city 2y ago
        > your usecase was different because you have several devices So we just normalize having multiple devices, and suddenly my use case is the same as everyone else's. Its not like I'm talking about everyone having a dozen $1,000 devices. Several of my authenticators were like $20-30 and have lasted over a decade even getting thrown in the washing machine and getting left in the rain and dropped in the pool. One was on my keys when I was daily driving a motorcycle in a rainy season and still works a decade later. People don't find it weird to have two car keys and those things often cost hundreds of dollars these days to be replaced.
    - stubish 2y ago
      Discussing 70+ year olds here, a decent portion of which will not have a smart phone due to age related visual impairment or motor control issues. Turns out that age related technical difficulties are not so much generational or digital-native nonsense, but physical. As the people pushing smartphone-for-everything will discover when they hit 50 and need reading glasses.
- drawfloat 2y ago
  As he’s 70 he’s using an old desktop PC and doesn’t have a smartphone. He uses the on device pass key system. One day, months down the line, Bluetooth gets switched off for whatever reason. What then.
WorldMaker 2y ago
Ironically I've seen technical users far more confused by passkeys than 70 year olds on eBay. 70 years olds on eBay don't ask how the "Use Apple Face ID to Login to eBay" works and how secure it is, they just just generally trust Apple and eBay and just do it and it generally just works. It's the technical users that want to know all the details of passkeys down to minutia and have too many devices with syncing problems because at least one machine is a Linux machine with no hardware security enclave but "that's fine" because it is locked down to no real "cloud" access but still needs to login to eBay in an ancient Firefox fork that doesn't support passkeys once every couple of days for some hacky shell script bidder they've been running since they downloaded it off mIRC in the 90s…

josteink 2y ago

«Activate login via FaceID». «OK». Congratulations. You have a passkey. Was that easy enough?

jedberg 2y ago
What happens when they lose or break the phone, or switch phones, which my parents do every two or so years?
- jf 2y ago
  If they have a Google or Apple account on their Android or iOS device, then nothing happens.
  - jedberg 2y ago
    I mean in the interim. How do they get into their email to find their support contract to get another phone if they can't get into email without their phone?
    - jf 2y ago
      For Apple at least, you walk into an Apple Store, buy a new phone, and have them help you log into it again.
      - jedberg 2y ago
        What if you're traveling and there is no Apple Store nearby? And now you can't log into your email to get your travel itinerary or your transportation receipt? The greater point is not the specific edge cases, it's that they haven't been worked through. Even a sophisticated user like myself doesn't want to use passkeys exclusively yet because of this very reason. I'm not confident that I won't get completely locked out when it's absolutely critical that I get in.
  - bongodongobob 2y ago
    Except if you switch phone numbers and get a new phone. My iCloud email address is permanently fucked because I set up an iCloud account years ago with a different phone number. Since I no longer have the number or another Apple device synced to that iCloud account, I'm permanently locked out forever.
  - Nathanba 2y ago
    But don't you also get into that account via your passkey? How do you know that the passkey you are using to get into the Google/Apple account isn't the same one that will be lost if you lose your phone? I've actually implemented passkeys on my website and I still don't use passkeys for e.g my own Google account because I don't trust it.
    - vel0city 2y ago
      I actually recently unexpectedly broke my phone. Getting back into my Google account protected by passkeys was pretty simple though, I just logged in to my new phone with a passkey stored on another device. Which is fine, because I've got several different devices with passkeys on them. Same thing with logging into my mail provider which I use passkeys for. A few accounts I did have to go find a backup passphrase for, but none of those accounts are the kind of accounts I'd normally be trying to get into while on vacation or something. I don't travel very far or very long without a couple of different authenticators. If its farther than a bus fare and I'll be gone for a while, I'll probably have at least two, maybe three authenticators on me. For example, my phone, my laptop, and a yubikey. Its only a few dollars for the public transit around me, so if my car explodes on the other side of town with my bag containing my keys and my laptop in it and I had to jump out into the river to avoid the explosion and debris and it broke my phone I'll still be fine to get home with a few dollar bills in my pocket. Or hopefully those other physical security tokens commonly called credit cards will also still work. And there I'll probably have my desktop at home and another yubikey. But honestly that kind of thing doesn't happen to me too often so I'm not too worried.
      - Nathanba 2y ago
        All you said is that it worked for you, you even emphasize that your usecase was different because you have several devices. This doesn't relate to my question.
        vel0city 2y ago
        > your usecase was different because you have several devices So we just normalize having multiple devices, and suddenly my use case is the same as everyone else's. Its not like I'm talking about everyone having a dozen $1,000 devices. Several of my authenticators were like $20-30 and have lasted over a decade even getting thrown in the washing machine and getting left in the rain and dropped in the pool. One was on my keys when I was daily driving a motorcycle in a rainy season and still works a decade later. People don't find it weird to have two car keys and those things often cost hundreds of dollars these days to be replaced.
  - stubish 2y ago
    Discussing 70+ year olds here, a decent portion of which will not have a smart phone due to age related visual impairment or motor control issues. Turns out that age related technical difficulties are not so much generational or digital-native nonsense, but physical. As the people pushing smartphone-for-everything will discover when they hit 50 and need reading glasses.
drawfloat 2y ago
As he’s 70 he’s using an old desktop PC and doesn’t have a smartphone. He uses the on device pass key system. One day, months down the line, Bluetooth gets switched off for whatever reason. What then.

WorldMaker 2y ago

Ironically I've seen technical users far more confused by passkeys than 70 year olds on eBay. 70 years olds on eBay don't ask how the "Use Apple Face ID to Login to eBay" works and how secure it is, they just just generally trust Apple and eBay and just do it and it generally just works. It's the technical users that want to know all the details of passkeys down to minutia and have too many devices with syncing problems because at least one machine is a Linux machine with no hardware security enclave but "that's fine" because it is locked down to no real "cloud" access but still needs to login to eBay in an ancient Firefox fork that doesn't support passkeys once every couple of days for some hacky shell script bidder they've been running since they downloaded it off mIRC in the 90s…