Hacker News Reader

Comment by cco | Hacker News Reader

Oof, the Passkeys ecosystem is incredibly complex. Even as someone that deals with it day in and day out at $CURRENT_CO, it can be a headache.

As an exercise from a developer's perspective, try creating a chart of every device type (mobile, desktop etc), browser, and Passkeys platform provider (Apple, Microsoft etc). Then fill out how each behaves across each combination, it is a nightmare!

I'm hopeful that we'll see more cooperation across Passkey providers to align both the devx and UX to increase adoption where it makes sense. Not holding my breath too much though.

View on HN

I am exploring this now, actually got 2 students doing their thesis on this. It's very complicated and unnecessarily so.

My conclusion so far is that it's a promising technology, but no way as mature as I'd like it to be. Unfortunately we are stuck with emails and passwords for the foreseeable future, at least as a back-up mechanism for credentials recovery, which, funnily, makes the whole thing pretty much pointless.

Noone put any thought into the goals of passkeys and it shows.

You have to beat email/password with optional password manager (syncing, remembering , autofilling) and optional MFA (physical proof)

passkeys cant beat that in any area because they have no goals

Definitely this. I think the worst aspect of Passkeys is that the noble goals (public key crypto! unphisability!) seem to somewhat unavoidably wipe out one of the--in hindsight--really valuable aspects of passwords-in-a-password-manager:

That you can always just copy them out, put them in a different password manager, or write them on a post-it.

That said, I think this is a byproduct of the design space being complex (as you suggest) and not, as the author seems to feel, "thought leaders" or malice.

I've been using Passkeys saved in 1Password, I thought that gave me the power to transfer them, but I just looked and apparently the export feature of 1P doesn't allow exporting the Passkeys, it just tells you you need to create new ones in your new password manager, so that's pretty crappy...

Yeah I agree. I am familiar with crypto and public key authentication and password hashing and so on, and I cannot follow all of the terms and use modes. To the average user it's going to be a complete black box. They won't have a clue what's going on.

With passwords it's fairly obvious. Even if you don't know about password hashing, semantically it is the same as how you would obviously expect. Same with password managers. It's obvious what they're doing.

So I think this would fail even if it didn't have all the problems the author mentioned - it's simply too complicated for normal people to understand and trust.

Reply on news.ycombinator.com