11 ms·

The software industry has zero concept of how much pain and suffering passkeys are going to cause the average person, almost entirely because the average Americ

by 015a 2y ago

The software industry has zero concept of how much pain and suffering passkeys are going to cause the average person, almost entirely because the average American has an iPhone and a Windows laptop and there's literally nothing built-in to iOS or Windows that will sync passkeys between these two devices. The world's most popular password managers are Excel and Apple Notes, in that order; these apps do not support Passkeys. Passkeys are not going to happen, and its the industry's fault. Its a bad standard that solves some problems the industry itself has, by creating more problems for consumers. If you force consumers to move to only-passkeys, you're going to lose customers, and it might not even be their choice, you're just making the decision to lock people out.

josteink 2y ago
> The software industry has zero concept of how much pain and suffering passkeys are going to cause the average person, almost entirely because the average American has an iPhone and a Windows laptop and there's literally nothing built-in to iOS or Windows that will sync passkeys between these two devices Then you register multiple passkeys for the website, just like you would register several Yubikeys. It’s a 1-click process, and no HW-token required. Most people will be fine.
- spencerflem 2y ago
  How do you log in on the other device to set up the second passkey?
  - growse 2y ago
    Using the "passkey on other device" flow, which usually involves QR codes.
    - hbn 2y ago
      What if my phone irreparably broke?
      - Mindless2112 2y ago
        Then you use the "lost my passkey" process, which should be the same as the "forgot my password" process. Most services should treat passkeys like unphishable passwords. Passkeys do not (and are not intended to) solve the problem of lost credentials.
        nottorp 2y ago
        They're intended to aggravate it instead.
        deleted 2y ago
        [deleted]
- eikenberry 2y ago
  > Then you register multiple passkeys for the website, just like you would register several Yubikeys. So just like Yubikeys, when you lose one of those keys you'll need to go to the 100's of sites where you registered that key and change it. This is not a good plan.
- devsda 2y ago
  > Most people will be fine this assumes majority of population has the means and discipline to purchase, register and maintain multiple pass keys and/or devices. There's a world outside the developed countries where a typical yubikey can cost 10-20% of a family's monthly income. A family where phones are the only tech devices in the household and the phone is typically in a 100-150 USD price range and costs about half of monthly income. By making passkeys mandatory we are asking them to get multiple of yubikeys/phones per person in the family ?! They cannot afford to and will not maintain multiple passkeys or backups. Orgs will have to build a way to help them recover their accounts easily without further costs or just ignore them as "edge cases".
  - josteink 2y ago
    Passkeys are free. You do not need to buy them. They replace passwords, after all.
- 015a 2y ago
  Many services which support passkeys do not support multiple passkeys. The big ones have figured out that we need support for multiple, but sadly just like with Yubikeys not everyone got the message on that. But, its like I said: You have zero concept of the struggle that is already happening and will continue to get worse. That's what I mean when I say that the software industry has zero concept: You think you have the solutions, but you actually haven't even grasped the full scope of the problem.
  - rcxdude 2y ago
    This. Almost no-one's even realised that maybe being able to enroll multiple TOTP tokens would be a good idea. I spent some time recently trying to figure out a good, properly secure, robust authentication method would be for various important accounts both personally and at work, and I've more or less concluded that there isn't one, the best compromise that mostly works is TOTP but manually copying the secret across two hardware keys, which is wayyyyy outside the average user's capabilities, and I'm not even sure I'll be able to make it work in practice. passkeys are not serious until they actually address backups in a way that isn't just "we'll copy the secrets around in our cloud services just like passwords lol" (And it's not like there's no solution here: firstly make it mandatory in the spec to allow enrolling multiple keys, then standardise a means to enroll a device from another device, automatically, across all devices that other device is enrolled in, and then also it would probably be a good idea if that also offered a way to revoke the other keys)
  - vel0city 2y ago
    The only site that uses passkeys I regularly use that doesn't support multiple is PayPal. Pretty much every other site that at one time only supported one now supports multiple. Which common sites still only allow one, other than PayPal?
jf 2y ago
An alternative viewpoint to consider is how much pain and suffering passwords cause large companies or identity providers. One example: Large organizations often spend $1m/yr on password resets alone.
- vorpalhex 2y ago
  "Hello, IT, my toddler accidentally dropped my phone in the ocean. I can't log into anything now. No, I can't restore my iCloud keys onto my Windows laptop. Please help." I suppose corporate gets to overnight you a yubikey in 2-3 days?
  - deleted 2y ago
    [deleted]
  - jesseendahl 2y ago
    >Hello, IT, my toddler accidentally dropped my phone in the ocean. I can't log into anything now. It's clear that you are making assumptions without doing any research... Yes you can. See "Recovery security" section of this article: https://support.apple.com/en-us/102195 https://support.apple.com/en-us/102195 >No, I can't restore my iCloud keys onto my Windows laptop. Yes you can — see this article: https://support.apple.com/guide/icloud-windows/set-up-icloud-passwords-icw2babf5e03/icloud https://support.apple.com/guide/icloud-windows/set-up-icloud...
    - vorpalhex 2y ago
      Read the KB carefully. 1. Your windows pc doesn't have a SecureEnclave (tpm2.0 doesn't count!) so no, you can't do PassKey recovery only password recovery. 2. You can only do iCloud recovery to another Mac/iOS device. In other words, not your windows PC. Hope you have a spare Macbook hiding out.
- 015a 2y ago
  That's why I very specifically said: Passkeys solve problems that corporations have, by moving the problems on to consumers. Our industry was done writing reliable, quality software years ago, so it shouldn't come as any surprise that we want to keep going in that direction. Passwords have such an obvious, fantastic, beautiful quality in how when all else fails you can verbally say out loud "my password is X C J 5 4..." Its the ultimate form of reliability: non-digital, spoken or written language. Passkeys throw that away. I don't care about any of the other arguments. Our industry wants to build less reliable software, so we built passkeys. I don't know why we're obsessed with building things that are less reliable instead of more reliable, but we are. Its sad, its insane, and frankly I'm getting so damn tired of trying to push for reliability every day and instead seeing Microsoft just throw weight around, get hacked, throw weight around again, get hacked again, and somehow still reap respect for their position in matters of security.
mxey 2y ago
Apple‘s password manager is available for Windows, although I don’t know if it supports passkeys. Also, there are mechanisms to use a passkey from another device (over Bluetooth I think?)
- dblitt 2y ago
  Yes, its called "hybrid transport", and its a flow where a laptop presents a QR code to a mobile phone, who then sets up a BLE connection for one time use of the passkey. https://www.corbado.com/blog/webauthn-passkey-qr-code https://www.corbado.com/blog/webauthn-passkey-qr-code (Not sure how the "cloud assisted" part of caBLE works)
  - nottorp 2y ago
    So... you need to carry two electronic devices for this so-called security solution?
    - helloooooooo 2y ago
      No… you can also sync with iCloud Passwords, or use a hardware token, like a Yubikey.
      - nottorp 2y ago
        So a Yubikey is not an electronic device that you need to carry? iCloud Passwords don't run on an iPhone that is an electronic device that you need to carry? Those electronic devices that you mention don't each store the keys in a proprietary format and you can't access them without the vendor's cooperation - i.e. vendor lock in?
        jesseendahl 2y ago
        >Those electronic devices that you mention don't each store the keys in a proprietary format and you can't access them without the vendor's cooperation - i.e. vendor lock in? Passkey portability is being worked on. Here is the draft of the open standard: https://github.com/fido-alliance/credential-exchange-feedback https://github.com/fido-alliance/credential-exchange-feedbac... News article: https://www.theverge.com/2024/10/15/24270875/password-manager-makers-transfer-passkeys-fido-alliance https://www.theverge.com/2024/10/15/24270875/password-manage...
lima 2y ago
It's not quite as bad, your average user with an iPhone or Android phone will be fine. Just scan a QR code on the Windows machine and log in with the phone. The problem is that the UX for this is extra super confusing, and people will end up with passkeys that aren't backed up anywhere and get locked out of their accounts.
- gpm 2y ago
  "Just"? You just added minutes of figuring out where your phone is and how to scan a QR code to a log in process.
  - ylk 2y ago
    Find your phone: https://www.icloud.com/find/ https://www.icloud.com/find/ Scanning a QR code: https://support.apple.com/en-us/102680 https://support.apple.com/en-us/102680 The time investment could even be worth it, since "Signing in with a passkey is three times faster than using a traditional password and eight times faster than a password and traditional MFA", according to the article.
    - doublerabbit 2y ago
      Find your phone: https://www.icloud.com/find/ https://www.icloud.com/find/ -> I have that turned off Scanning a QR code: -> My back-camera lens is shattered. Using the front is dodgy at best. I don't feel like I need fork out for an to upgrade as I use a digital camera if I want to take pictures. What about those don't use smart phones?
      - ylk 2y ago
        Register a passkey on a different device or get a hardware key or whatever. Or call Microsoft support and complain to them. This doesn’t feeling like an honest discussion anymore.
        Prickle 2y ago
WillyWonkaJr 2y ago
Proton Pass does this. It's browser extension will also generate and store passkeys in your Proton account making it accessible to any device.
- Nifty3929 2y ago
  What is a browser extension? Do I need to take a class on that? Where do I buy one? Really, not being snarky here. If I asked my dad to install a browser extension he would drive his laptop to my house and ask me to install it for him. If I wasn't available - then it just wouldn't happen. My mom can't see, so maybe she's okay?
- 015a 2y ago
  Not built in. The number of Windows users who use Proton Pass is a rounding error toward zero.

by 015a 2y ago

josteink 2y ago

> The software industry has zero concept of how much pain and suffering passkeys are going to cause the average person, almost entirely because the average American has an iPhone and a Windows laptop and there's literally nothing built-in to iOS or Windows that will sync passkeys between these two devices Then you register multiple passkeys for the website, just like you would register several Yubikeys. It’s a 1-click process, and no HW-token required. Most people will be fine.

spencerflem 2y ago
How do you log in on the other device to set up the second passkey?
- growse 2y ago
  Using the "passkey on other device" flow, which usually involves QR codes.
  - hbn 2y ago
    What if my phone irreparably broke?
    - Mindless2112 2y ago
      Then you use the "lost my passkey" process, which should be the same as the "forgot my password" process. Most services should treat passkeys like unphishable passwords. Passkeys do not (and are not intended to) solve the problem of lost credentials.
      - nottorp 2y ago
        They're intended to aggravate it instead.
        deleted 2y ago
        [deleted]
eikenberry 2y ago
> Then you register multiple passkeys for the website, just like you would register several Yubikeys. So just like Yubikeys, when you lose one of those keys you'll need to go to the 100's of sites where you registered that key and change it. This is not a good plan.
devsda 2y ago
> Most people will be fine this assumes majority of population has the means and discipline to purchase, register and maintain multiple pass keys and/or devices. There's a world outside the developed countries where a typical yubikey can cost 10-20% of a family's monthly income. A family where phones are the only tech devices in the household and the phone is typically in a 100-150 USD price range and costs about half of monthly income. By making passkeys mandatory we are asking them to get multiple of yubikeys/phones per person in the family ?! They cannot afford to and will not maintain multiple passkeys or backups. Orgs will have to build a way to help them recover their accounts easily without further costs or just ignore them as "edge cases".
- josteink 2y ago
  Passkeys are free. You do not need to buy them. They replace passwords, after all.
015a 2y ago
Many services which support passkeys do not support multiple passkeys. The big ones have figured out that we need support for multiple, but sadly just like with Yubikeys not everyone got the message on that. But, its like I said: You have zero concept of the struggle that is already happening and will continue to get worse. That's what I mean when I say that the software industry has zero concept: You think you have the solutions, but you actually haven't even grasped the full scope of the problem.
- rcxdude 2y ago
  This. Almost no-one's even realised that maybe being able to enroll multiple TOTP tokens would be a good idea. I spent some time recently trying to figure out a good, properly secure, robust authentication method would be for various important accounts both personally and at work, and I've more or less concluded that there isn't one, the best compromise that mostly works is TOTP but manually copying the secret across two hardware keys, which is wayyyyy outside the average user's capabilities, and I'm not even sure I'll be able to make it work in practice. passkeys are not serious until they actually address backups in a way that isn't just "we'll copy the secrets around in our cloud services just like passwords lol" (And it's not like there's no solution here: firstly make it mandatory in the spec to allow enrolling multiple keys, then standardise a means to enroll a device from another device, automatically, across all devices that other device is enrolled in, and then also it would probably be a good idea if that also offered a way to revoke the other keys)
- vel0city 2y ago
  The only site that uses passkeys I regularly use that doesn't support multiple is PayPal. Pretty much every other site that at one time only supported one now supports multiple. Which common sites still only allow one, other than PayPal?

jf 2y ago

An alternative viewpoint to consider is how much pain and suffering passwords cause large companies or identity providers. One example: Large organizations often spend $1m/yr on password resets alone.

vorpalhex 2y ago
"Hello, IT, my toddler accidentally dropped my phone in the ocean. I can't log into anything now. No, I can't restore my iCloud keys onto my Windows laptop. Please help." I suppose corporate gets to overnight you a yubikey in 2-3 days?
- deleted 2y ago
  [deleted]
- jesseendahl 2y ago
  >Hello, IT, my toddler accidentally dropped my phone in the ocean. I can't log into anything now. It's clear that you are making assumptions without doing any research... Yes you can. See "Recovery security" section of this article: https://support.apple.com/en-us/102195 https://support.apple.com/en-us/102195 >No, I can't restore my iCloud keys onto my Windows laptop. Yes you can — see this article: https://support.apple.com/guide/icloud-windows/set-up-icloud-passwords-icw2babf5e03/icloud https://support.apple.com/guide/icloud-windows/set-up-icloud...
  - vorpalhex 2y ago
    Read the KB carefully. 1. Your windows pc doesn't have a SecureEnclave (tpm2.0 doesn't count!) so no, you can't do PassKey recovery only password recovery. 2. You can only do iCloud recovery to another Mac/iOS device. In other words, not your windows PC. Hope you have a spare Macbook hiding out.
015a 2y ago
That's why I very specifically said: Passkeys solve problems that corporations have, by moving the problems on to consumers. Our industry was done writing reliable, quality software years ago, so it shouldn't come as any surprise that we want to keep going in that direction. Passwords have such an obvious, fantastic, beautiful quality in how when all else fails you can verbally say out loud "my password is X C J 5 4..." Its the ultimate form of reliability: non-digital, spoken or written language. Passkeys throw that away. I don't care about any of the other arguments. Our industry wants to build less reliable software, so we built passkeys. I don't know why we're obsessed with building things that are less reliable instead of more reliable, but we are. Its sad, its insane, and frankly I'm getting so damn tired of trying to push for reliability every day and instead seeing Microsoft just throw weight around, get hacked, throw weight around again, get hacked again, and somehow still reap respect for their position in matters of security.

mxey 2y ago

Apple‘s password manager is available for Windows, although I don’t know if it supports passkeys. Also, there are mechanisms to use a passkey from another device (over Bluetooth I think?)

dblitt 2y ago
Yes, its called "hybrid transport", and its a flow where a laptop presents a QR code to a mobile phone, who then sets up a BLE connection for one time use of the passkey. https://www.corbado.com/blog/webauthn-passkey-qr-code https://www.corbado.com/blog/webauthn-passkey-qr-code (Not sure how the "cloud assisted" part of caBLE works)
- nottorp 2y ago
  So... you need to carry two electronic devices for this so-called security solution?
  - helloooooooo 2y ago
    No… you can also sync with iCloud Passwords, or use a hardware token, like a Yubikey.
    - nottorp 2y ago
      So a Yubikey is not an electronic device that you need to carry? iCloud Passwords don't run on an iPhone that is an electronic device that you need to carry? Those electronic devices that you mention don't each store the keys in a proprietary format and you can't access them without the vendor's cooperation - i.e. vendor lock in?
      - jesseendahl 2y ago
        >Those electronic devices that you mention don't each store the keys in a proprietary format and you can't access them without the vendor's cooperation - i.e. vendor lock in? Passkey portability is being worked on. Here is the draft of the open standard: https://github.com/fido-alliance/credential-exchange-feedback https://github.com/fido-alliance/credential-exchange-feedbac... News article: https://www.theverge.com/2024/10/15/24270875/password-manager-makers-transfer-passkeys-fido-alliance https://www.theverge.com/2024/10/15/24270875/password-manage...

lima 2y ago

It's not quite as bad, your average user with an iPhone or Android phone will be fine. Just scan a QR code on the Windows machine and log in with the phone. The problem is that the UX for this is extra super confusing, and people will end up with passkeys that aren't backed up anywhere and get locked out of their accounts.

gpm 2y ago
"Just"? You just added minutes of figuring out where your phone is and how to scan a QR code to a log in process.
- ylk 2y ago
  Find your phone: https://www.icloud.com/find/ https://www.icloud.com/find/ Scanning a QR code: https://support.apple.com/en-us/102680 https://support.apple.com/en-us/102680 The time investment could even be worth it, since "Signing in with a passkey is three times faster than using a traditional password and eight times faster than a password and traditional MFA", according to the article.
  - doublerabbit 2y ago
    Find your phone: https://www.icloud.com/find/ https://www.icloud.com/find/ -> I have that turned off Scanning a QR code: -> My back-camera lens is shattered. Using the front is dodgy at best. I don't feel like I need fork out for an to upgrade as I use a digital camera if I want to take pictures. What about those don't use smart phones?
    - ylk 2y ago
      Register a passkey on a different device or get a hardware key or whatever. Or call Microsoft support and complain to them. This doesn’t feeling like an honest discussion anymore.
      - Prickle 2y ago

WillyWonkaJr 2y ago

Proton Pass does this. It's browser extension will also generate and store passkeys in your Proton account making it accessible to any device.

Nifty3929 2y ago
What is a browser extension? Do I need to take a class on that? Where do I buy one? Really, not being snarky here. If I asked my dad to install a browser extension he would drive his laptop to my house and ask me to install it for him. If I wasn't available - then it just wouldn't happen. My mom can't see, so maybe she's okay?
015a 2y ago
Not built in. The number of Windows users who use Proton Pass is a rounding error toward zero.