Hacker News Reader

Comment by hi-v-rocknroll | Hacker News Reader

TOTP is slowly on its way out compared to passkeys and FIDO2. It's still useful as another 2FA choice.

Passkey was a great idea. A brilliant solution which could have solved authentication on the web once and for all. If only Apple, Google and Microsoft had not completely ruined it by tying it to their platforms and using it as another moat

https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt...

"If you really want passkeys, put them in a password manager you control. But don't use a platform controlled passkey store, "

I think this is a good advice in general: if you value your freedom avoid platform controlled services even if they are slightly more convenient.

Btw, the platform authenticator apps are a privacy nightmare. Some are constantly reporting your activities to multiple services. You can verify this easily using an on-device proxy VPN such as NetGuard.

Yup. Don't do Google Authenticator or similar. There are a couple of FOSS ones.

Agreed. Passkeys without QR codes to enclave devices or copy/paste strings to/from an enclave application made them DOA for true barium meal enjoyers.

I don't like passkeys. I'm not sure if I'm using it wrong, but it feels like entering a TOTP is so much faster and easier than using passkeys. It was always easy to enter a 6 digit code and have some back-up codes printed somewhere. Passkeys might be superior in some ways, but feel much harder to use. But then again, I'm also not an average user.

I don't like the idea of passkeys if they cannot be backed-up or are non-portable locked away in a walled garden and possibly on stored on some corporate cloud in some unknown manner. When they can be backed-up, are portable, and have an explicit security policy, then I'll consider them.

For example, Bitwarden is able to act as a passkey provider on iOS and can store the passkey secret key gunk into a password record. I tried it out on a couple of minor services that have username & password login alternatives.

Do you still think it's easier to type in a 6 digit code that is on your mobile while you're browsing with your desktop (compared to Touch ID / Face ID with passkeys)?

No, I also have my passwords synced to me desktop. my phone is usually in a different room when I am on my desktop.

Absolutely, takes me less than 10 seconds. And the process is transparent. Passkeys don't really seem to be faster.

Reply on news.ycombinator.com