Hacker News Reader

Comment by isykt | Hacker News Reader

Why is a pin more secure than a password?

The PIN (or biometric) is not used to replace your Google account password. The PIN (or biometric) is used to authenticate to your device that holds your Passkeys, which in turn will authenticate you to your Google account (or any account that supports Passkey-based sign-in).

The PIN is checked by the local device. It never goes over the network, and the device can limit the number of PIN attempts to a very small number, because the only way to try PINs is to have access to the device.

It isn't, and this isn't authentication with a pin.

Passkeys also requires the device. Using a pin with this is 2-factor. Pin + hardware token.

So why not just have a password that then unlocks the passkey? I already have a password manager.

Sure, PINs can be long and alphanumeric on most phones these days.

How is that different from a password? PIN stands for Personal Identification Number. Words change meaning all the time, of course, but in this case there’s no reason to call it a PIN when there’s already another word for it.

The important difference is that it is stored on the local device, not the remote server.

Since the things stored on the remote server have been called “passwords” for decades, it seems helpful to call the local thing a “PIN” to help more easily distinguish it.

IMO it’s not more silly than calling a hand-held computer a “phone.”

The standards group that was behind Fido/U2F has been taken over by people who want to push a new product. That new product is "Log in with your phone" and phone lock screens allow biometrics and pins.

Password managers are not relevant, as you don't use a password manager to unlock your phone.

The people behind the takeover don't really give a shit about Yubikey-style tokens (which haven't achieved much market penetration anyway) but they've left them in to make the takeover less blatent.

More like the other way around -- the existing FIDO/U2F crowd was a bunch of businesses that made money selling keys. And that's why adoption was a rounding error, it was infinitely more expensive than a free password, so few implemented it. This is the obvious solution -- we're already carrying devices with a secure enclave, just use that, it's free.

If you already have a password manager it might already or might soon natively support passkeys as well (1Password already does as an example)

You can have that by storing passkeys in your password manager, if it has support for that. Currently 1Password does, and BitWarden either does or is suppose to soon. I haven't looked at any others.

You should be able to use your password manager to handle passkeys. Enter your master password in 1Password, use passkey. And Bitwarden support is coming.

Reply on news.ycombinator.com