Hacker News Reader

Comment by happymellon | Hacker News Reader

I really don't understand passkeys.

They appear to me to be just a password that is saved to a phone wallet rather than your password manager, with all the terrible side effects of locking stuff to a phone such as blocking you from your bank accounts or communications with other people if you lose your phone.

Now you get to lose access to everything.

Is there a good resource explaining why I would want to adopt this tech?

View on HN

Seems like they're more for the "phishable" and the duplicate password users and obviously the no-password folks.

Seems like its no different from using TouchID as the biometrics to rapidly unlock a vault or account since it stores the real key in the Secure Enclave or whatever and passes it on successfull authentication. Just worse because its probably a randomly generated arbitrary string of numbers and letters that you can't remember at all in case you lose access to them/the device.

That's how I read it as too.

Cheers.

In authentication, we usually look for the following factors to verify the user identity `something I know, something I have, something I am.` In passkey, theoretically, you verify all the factors at once. This user has the phone, and the biometrics said, `something I have.` The `something I know` was verified once to create a continuous of the other factors. If you lose your phone, you need to find an alternative way to verify the other factors, which can be done by various methods that each authentication provider has.

Reply on news.ycombinator.com