Hacker News Reader

Comment by fmajid | Hacker News Reader

This is compounded by the fact most 2FA implementations are security theater not phishing-resistant, the sole exception being FIDO2/Webauthn (e.g. Yubikeys), and Passkeys, but passkeys are really single-factor authentication. Both FIDO and passkeys have serious usability challenges, though.

What's worse, the most common scheme, SMS-based authentication can lead to denial of service, e.g. you are roaming and do not have access to texts, or have your account SIM-jacked as this seems to be very popular way to steal people's cryptocurrencies.

View on HN

This. In theory, passkeys should be great. Sort of an SSH-for-the-masses.

Unfortunately, the industry has mangled the implementation, making them basically useless.

I mean they're not totally useless, in the current implementation they just can't replace passwords. I have a bunch of passkeys in my Bitwarden and they function as a "log in bypassing the 2FA screen" button. I get to skip the "we sent a code to your phone/email/butthole" flow.

Funny how that always happens. Passkeys were supposed to be great and what you ended up with is platform players abusing their position to push lock in to their own passkey solutions over fair access to arbitrary 3rd party providers.

When they do work smoothly they aren’t useless though.

Android has been surprisingly awesome with cross-platform passkeys (i.e. google lets you use BitWarden/1Password/etc pretty transparently).

Anything Apple related is another story...

There's some good movement in the linux desktop space I'm excited about: https://github.com/linux-credentials/linux-webauthn-platform...

I'm using iOS and Passkeys from 1Password work there too. No problems with any browser on macOS either.

On iOS I can even see a list of password & passkey providers, so I can ensure that the Apple one is toggled off (as well as MS Authenticator which can also provide those it seems)

Apple have been the best in my experience. On apple devices all 3rd party passkey providers are shown at the same time in the same UX where you’d choose iCloud (their native provider)

Google Android may be good, but Chrome is not doing right yet. Chrome still tries to get you to use itself i stead of delegating to the platform selection box.

Why are they useless? I log into GitHub, Google and Discord using passkeys, and it's very convenient being a single mouse click.

Passkeys can't always protect an account against phishing either (https://cyberpress.org/passkeys-with-aitm-phishing-attacks/) they just make it more difficult for scammers.

The article agrees passkeys can't be phished. They acknowledge they just push users to go through an unnecessary account recovery and then phish those other credentials.

>you are roaming and do not have access to texts

I truly despise this. It effectively disenfranchises people for living outside of areas with good mobile coverage. Banks or utility payments or parking meters(!) or whatever should not be gated behind cellphone reception. Nevermind people who can't use a phone at all ...

I don’t have an international phone plan. When I travel overseas I cannot access my bank account and my primary credit card randomly asks for a phone number verification that I cannot update.

I tried buying an sms number from twilio so that I could receive 2fa while out of the country but my bank (PNC) would not accept any phone number unless it was from one of the 4 major carriers in the US!

My credit card (capital one) seems to have a phone number on file from Mastercard. If I change my phone number in capital one, whenever I get into the Mastercard extra verification, it does not use the updated number. I have no idea how to get Mastercard to update it. I just ended up using a different credit card!

I moved from the US to the UK. I ported my US mobile number to Twilio, but that service is incredibly unreliable even for basic things like forwarding a call or a SMS. I had another number on Google Voice, and moved all my US accounts to it whenever possible.

The great thing about Google Voice is that since Google doesn't believe in humans providing customer service (or more generally in providing customer service, period), there are no gullible CSRs that can be conned or bribed into SIM-swapping you unlike the mobile carriers.

The bad thing about Google Voice is if Google closes your account then you're screwed.

Reply on news.ycombinator.com