5 ms·

It sounds like you're arguing against passkeys, two-factor authentication, and password managers. Do you use single, easy-to-remember plain-text passwords for

It sounds like you're arguing against passkeys, two-factor authentication, and password managers. Do you use single, easy-to-remember plain-text passwords for all of your accounts and services? If not, you need to understand what the recovery process is when your passkey/2FA/pw-manager is unavailable or lost.

BadHumans 2y ago
I use easy to remember plain text passwords for services that are low risk. It's a spectrum. I'm not concerned about someone hacking into my Hacker News account for example but I am very concerned about someone breaching my bank.
zamadatix 2y ago
GP doesn't seem to mention password managers. The nice thing about password managers vs passkeys is they need not be locked to a particular device or platform. I can sync the same database of credentials between my phone, pc, and laptop without worrying if they are from the same vendor. I can export backups. I can access it through my personal website on any device (assuming I also remember my personal website login too) if desperate. The problem with passkeys isn't the concept, it's the lack of flexibility in implementation.
- jazzyjackson 2y ago
  Seems to be a common misconception, passkeys need not be tied to a device, they can be saved to a password manager and synchronized.
  - josteink 2y ago
    I in fact do this with Bitwarden on a daily basis. It works ok!
  - zamadatix 2y ago
    This prompted me to read more about it as I was quite certain this was the reason I had stopped using them. It seems the initial wave of complaints fed into some change about a year after the initial launch. Android 14 (Oct 2023) via the new Credential Manager API and iOS 17 (September 2023) when 3rd parties could actually be a registered passkey provider. https://developer.android.com/about/versions/14/features#credential-manager https://developer.android.com/about/versions/14/features#cre... https://www.dashlane.com/blog/dashlane-passkey-support-ios#:~:text=introduced%20third%2Dparty%20passkey%20support https://www.dashlane.com/blog/dashlane-passkey-support-ios#:... Perhaps passkeys are more viable now with these changes? I'll need to give it another go and see. Thanks for the tip!
    - jazzyjackson 2y ago
      It surprised me too since I thought the whole point of passkeys is that you're using a thing-you-own to authenticate, but really the whole point is that the security credential is never transmitted to the service doing the auth.
      - lxgr 2y ago
        That’s not the (entire) point of passkeys/WebAuthN at all! It’s a pretty powerful/complex spec allowing various use cases, from a modern way to store SSH keys on hardware credentials to a more usable and less phishable password replacement backed entirely by software.
    - jerf 2y ago
      I've been using them with my BitWarden/VaultWarden setup now for a while. I was also extremely crabby about the idea of tying my accounts to hardware to the point of being unwilling to use them, but this problem is resolved. The resulting user experience is now the best of any login methodology and I remain in full control of my passkeys, up to and including the ability to back them up. I think it sometimes takes a "Never Offer Me Passkeys" from the browser sometime, just like they default to trying to get me to save my passwords into their vaults (and I always have to look up the magic setting to tell them to stop doing that on a new install), but it hasn't been that hard to make work. I think I've heard that the passkeys providers have an option to force it to be hardware, but I've yet to encounter that, and it would also make me quite cross without a very good reason. I, personally, do not want my accounts tied to any particular bit of hardware, I want it tied to the single (very!) strong password I use for everything. Edit: Browsing through the rest of this HN conversation it seems the password managers have some PR to do. Many HNers are not aware that password managers, even perhaps the one they are already using, have the ability to store passkeys in them. If HNers don't know, certainly outside of the HN bubble it must be even less well known.
      - recursive 2y ago
        The passkey pitch needs to incorporate this. Last time I paid attention, which was a long time ago, passkeys were non-portable. This is a deal breaker for me, so I wrote the whole thing off. I guess they fixed it.
  - Sophira 2y ago
    Synchronized using what service? What's the authentication mechanism that would allow you to download your passkeys from this service?
    - jazzyjackson 2y ago
      Various password managers. They're just private keys. Optionally you can use a private key that is kept in a secure enclave on-device, these would not be synchronizable.
  - jp191919 2y ago
    KeepassXC works great for this.
  - nottorp 2y ago
    And how do you protect the password manager, with a passkey that needs to be stored in another password manager, or with a password with all the security risks that come with it?
    - lxgr 2y ago
      A hardware security key, or ideally three, one of which securely stored somewhere, can be a good choice here

BadHumans 2y ago

I use easy to remember plain text passwords for services that are low risk. It's a spectrum. I'm not concerned about someone hacking into my Hacker News account for example but I am very concerned about someone breaching my bank.

zamadatix 2y ago

GP doesn't seem to mention password managers. The nice thing about password managers vs passkeys is they need not be locked to a particular device or platform. I can sync the same database of credentials between my phone, pc, and laptop without worrying if they are from the same vendor. I can export backups. I can access it through my personal website on any device (assuming I also remember my personal website login too) if desperate. The problem with passkeys isn't the concept, it's the lack of flexibility in implementation.

jazzyjackson 2y ago
Seems to be a common misconception, passkeys need not be tied to a device, they can be saved to a password manager and synchronized.
- josteink 2y ago
  I in fact do this with Bitwarden on a daily basis. It works ok!
- zamadatix 2y ago
  This prompted me to read more about it as I was quite certain this was the reason I had stopped using them. It seems the initial wave of complaints fed into some change about a year after the initial launch. Android 14 (Oct 2023) via the new Credential Manager API and iOS 17 (September 2023) when 3rd parties could actually be a registered passkey provider. https://developer.android.com/about/versions/14/features#credential-manager https://developer.android.com/about/versions/14/features#cre... https://www.dashlane.com/blog/dashlane-passkey-support-ios#:~:text=introduced%20third%2Dparty%20passkey%20support https://www.dashlane.com/blog/dashlane-passkey-support-ios#:... Perhaps passkeys are more viable now with these changes? I'll need to give it another go and see. Thanks for the tip!
  - jazzyjackson 2y ago
    It surprised me too since I thought the whole point of passkeys is that you're using a thing-you-own to authenticate, but really the whole point is that the security credential is never transmitted to the service doing the auth.
    - lxgr 2y ago
      That’s not the (entire) point of passkeys/WebAuthN at all! It’s a pretty powerful/complex spec allowing various use cases, from a modern way to store SSH keys on hardware credentials to a more usable and less phishable password replacement backed entirely by software.
  - jerf 2y ago
    I've been using them with my BitWarden/VaultWarden setup now for a while. I was also extremely crabby about the idea of tying my accounts to hardware to the point of being unwilling to use them, but this problem is resolved. The resulting user experience is now the best of any login methodology and I remain in full control of my passkeys, up to and including the ability to back them up. I think it sometimes takes a "Never Offer Me Passkeys" from the browser sometime, just like they default to trying to get me to save my passwords into their vaults (and I always have to look up the magic setting to tell them to stop doing that on a new install), but it hasn't been that hard to make work. I think I've heard that the passkeys providers have an option to force it to be hardware, but I've yet to encounter that, and it would also make me quite cross without a very good reason. I, personally, do not want my accounts tied to any particular bit of hardware, I want it tied to the single (very!) strong password I use for everything. Edit: Browsing through the rest of this HN conversation it seems the password managers have some PR to do. Many HNers are not aware that password managers, even perhaps the one they are already using, have the ability to store passkeys in them. If HNers don't know, certainly outside of the HN bubble it must be even less well known.
    - recursive 2y ago
      The passkey pitch needs to incorporate this. Last time I paid attention, which was a long time ago, passkeys were non-portable. This is a deal breaker for me, so I wrote the whole thing off. I guess they fixed it.
- Sophira 2y ago
  Synchronized using what service? What's the authentication mechanism that would allow you to download your passkeys from this service?
  - jazzyjackson 2y ago
    Various password managers. They're just private keys. Optionally you can use a private key that is kept in a secure enclave on-device, these would not be synchronizable.
- jp191919 2y ago
  KeepassXC works great for this.
- nottorp 2y ago
  And how do you protect the password manager, with a passkey that needs to be stored in another password manager, or with a password with all the security risks that come with it?
  - lxgr 2y ago
    A hardware security key, or ideally three, one of which securely stored somewhere, can be a good choice here