Comment by klabb3 | Hacker News Reader

Comment by klabb3 | Hacker News Reader

Parent Full thread

On the contrary, password managers will be more relevant in the future, because they will be more important for people who don't use a pw manager today (most people aren't very good at 256 bit elliptic curve arithmetic).

Even though Apple (and likely a couple more) will provide their proprietary passwordless system with cloud sync, a lot of people don't want to rely on an iCloud account to be your backup in case you lose your phone. Which means that cross platform password managers are in an excellent position to compete in passwordless, since it can span all your devices and browsers. They are already keeping sensitive secrets, integrate with biometrics and device-specific soft-locks, audit logs etc – all they need to do is add some integrations for WebAuthn and certain platform APIs that Apple and friends have to provide.

The main adoption-risk with password-less is fallback for when the user's browser isn't fully integrated with a pw-manager. Not that it's impossible, but if you need a backup you now have a multimodal and more complicated system, and if that burden is shifted to individual web/app developers it will certainly delay or even stop the transition.

> Even though Apple (and likely a couple more) will provide their proprietary passwordless system with cloud sync, a lot of people don't want to rely on an iCloud account to be your backup in case you lose your phone.

This is the big one for me. The user story for logging in to a site on Windows with an iOS passkey is to scan a QR code with your phone, which sounds obnoxious.

I'd rather just have 1Password be the private key repository and those keys will sync to Mac/Windows/Phones through it instead of them being locked into iCloud Keychain, and it can handle logins just like normal.

Yeah that's why I think pw managers will be central to this story. Apple will try though, and they might have an edge and push the initial adoption, but eventually they'll come around. Their hubris usually calms down when their lock-in plans go further than they can handle.

I like Bitwarden more personally, but if the important aspects are standardized it shouldn't really make a difference.

Apple already has excellent external password manager support in iOS and macOS, why do you think they will try to lock that down?

Indeed, and Apple's pw manager is, as is typical, just a baseline implementation. I really need a full featured one so I can fix misfires (e.g. sign up on web, but the associated app doesn't set its domain properly), look for duplicates, get the info out for sites that can't auto entry (grr, js validation character-by-character) etc.

The calendar is another good example: adequate for many people, but trivially supplanted by a third party app (I use busycal) that apple treats as first class.

>The user story for logging in to a site on Windows with an iOS passkey is to scan a QR code with your phone, which sounds obnoxious.

I've found this flow rather acceptable actually. I usually use it for Discord/Steam.

It’s alright but it requires dismissing Windows Hello/FIDO2 every time and relies on establishing a BLE connection every time. (There’s no lasting BLE connection right now) So it’s also currently unusable on my desktop due to lack of Bluetooth.

I’d rather Windows Hello maintain a BLE connection itself and implement this (or the password manager suggestion).

That's a once type thing, the website is supposed to prompt you after that QR login whether you'd like to enroll your local authenticator (Chrome, Edge, Firefox,etc) after you login so you don't need to keep using the QR code.

The concept is that many people will frequently have multiple passkeys, thus not be 'locked in' to any one sync ecosystem.

From https://github.com/w3c/webauthn/wiki/Explainer:-broadening-t...

> When signing in on a different computer, either the credential will already be locally present (if the computer is using the same sync fabric as the phone) and suggested by autocomplete, or else the user’s phone can be used to transmit the assertion to the computer. In the latter case, the service may invite the user to enroll a local platform authenticator for easier sign-in in the future. (Now the newly registered credential may be part of a different sync fabric, and thus enable local sign-in on other devices.)

That does help a bit, but I'd still rather have all my keys in one spot instead of some in iCloud, some in Chrome, some in Firefox, etc.

I think you're underestimating the threat. 1pass saw it and is acquiring a company in that space to figure out how to continue to add value in a password less environment that justifies their annual fees. Not a surprising move. I view 1pass is a secret manager and so it makes sense they add password less to their portfolio.

We'll see how things play out.

Reply on news.ycombinator.com