Hacker News Reader

Comment by joelthelion | Hacker News Reader

Are passkeys seeing any traction?

I've got no overall stats but they are very well integrated in to iOS. You could end up using them without really even knowing what passkeys are. Websites and apps just prompt you with "add a passkey" and if you hit accept you get one and it gets synced to all your other Apple devices and just works.

At the moment, I'm going to avoid them as long as I can. It's not that I don't like the concept, but I think that a strong password + 2FA is already "enough" and I don't need to add complexity to my setup. No, I don't really fear phishing.

Passkeys reduce complexity, at least in my experience. A single click versus entering credentials then finding the 2FA pin on your phone or something.

By "complexity" I meant that they are "opaque" to me and somewhat not tied to and identity (be it email or username). Maybe it's me being inept, but I used them once or twice just for fun in Bitwarden and now I can't find them anywhere in my vault.

https://community.bitwarden.com/t/special-vault-search-keywo...

Maybe it's just a Bitwarden issue.

The 2FA issue isn't such for me. As I explained in a different comment, 2FA pins are copied automatically and are thus just a "ctrl+v" away.

Perhaps a Bitwarden issue. I had them in 1Password and used them without any problems, then moved them out and into my Apple Keychain to separate those concerns a bit better. Both solutions work pretty well.

Having to pull my phone out or go and find/fetch it to grab a pin is pretty annoying for me, since I also don't keep them in my password manager.

I did for a long time but figured that if my password manager was compromised I would be royally screwed since they'd have my 2FA there to, meaning the password manager is actually a weak point.

I don't use them much because I don't have a good way to register them and use them across device ecosystems. I use all three OSes regularly.

1Password and BitWarden both support Passkey sync across all three OSes. Though if you are using Android regularly enough that may imply you trust Google implicitly enough that you probably could also just get away with Chrome Passkey sync which I'm told also works on all three OSes today.

Or treat it as an opportunity to try to avoid "vendor lock-in"/increase redundancy by using all three to have 3+ passkeys in every service. Windows 11 can act as useful a bridge for bootstrapping all of your keys into a service: register for a site first on iOS or Android, use Windows 11 bluetooth to login via the first passkey, add a Windows passkey, and use Windows 11 bluetooth again to add the third. (Or some combo of that with the Windows iCloud Passwords app and/or Chrome.)

I guess I'm partially just stubborn because I don't want to pay for what should be a cross platform standard.

KeepassXC is a good client that lets you handle your data how you want. I wrote a pro-Passkey blog post here[1] that explains how to do your own syncing, though I later discovered Passkeys are explicitly built to support proprietary software vendor lock in and had to revoke my support. If you are concerned about being able to control your own data outside of the big tech ecosystem, I strongly recommend avoiding passkeys entirely. It is possible for now, but they are not built for that and the spec authors are actively hostile to you managing your own data.

[1] https://www.smokingonabike.com/2025/01/04/passkey-marketing-...

That is what I've noticed as well. The thread regarding KeePassXC is crazy... straight up threatening negative PR because KeePassXC allows people to store their private key, demanding that they instead take away user choice and modify their app to hide & prevent users from doing things. Passkeys appear to me to be nothing more than a corporate gimmick, and to be honest, I personally think in many instances they actually make you less secure... getting a fingerprint is way easier than making someone tell you their password. Now days the intelligence agencies likely already have your fingerprints as well.

They're a great technology that the FIDO Alliance is trying their best to cripple.

I also meant to mention that many Keepass clients support Passkeys already today. Strongbox on iOS and macOS has similar or better integration to 1Password/BitWarden. Windows you probably want KeepassXC for now as it isn't fully baked in mainline Keepass. I don't know what you'd use on Android today, but I'm sure there's at least one and probably more on the way.

Bitwarden is free, and if you are concerned about these terms changing, the excellent self-hosted open source server implementation "vaultwarden" [1] supports passkeys as well.

[1] https://github.com/dani-garcia/vaultwarden

The Google / Chrome sync is free

Free != standard.

I've used them across Chrome, Firefox, and Safari on Linux, macOS, and Windows (10 and 11) for large websites. I've used them for Github, as 2FA on various services, and as the primary login for some websites, such as the local grocery store (Albert Heijn). I also use them for authenticating to my personal Keycloak server which acts as a guard for a whole bunch of services in my network.

Support is far from universal, but it's definitely getting better. Unfortunately, protocols such as CTAP2 don't seem to have been implemented on Linux, so it lacks the "log in using your phone" prompt that makes them super useful on proprietary operating systems (like fingerprint/touch ID, but without needing to add every device manually).

They are still not implemented in major browsers and operating systems (e.g. Linux Chrome), so not likely much traction.

This is a straight up lie. They've been in Linux Chrome for quite some time now.

This is a straight up lie. Here's a screenshot from my PC: https://0x0.st/8v8T.png

Not implemented.

Google documentation states in multiple places that passkeys are supported in chrome Linux via google password manager. I haven't tried myself, are you saying that is incorrect?

I was wrong and I'm sorry about it. Turned out, I disabled one setting in my Google Chrome password manager, which apparently also disabled passkey creation functionality.

https://issues.chromium.org/issues/417941069 more here.

For my excuse I should note, that this passkey support is relatively recent (end of 2024) and error message was really unhelpful to understand the issue. I was trying to use passkeys on my Linux computer like every few months since they started to appear on various websites and was frustrated by lack of support in Linux.

Thanks for pushing me into right direction, so at least I can now use them.

I hope 1Password release passkey unlock for vaults soon. Then I'll never have to enter the passphrase to unlock again, and my "passphrase" will be essentially the unlock code for my phone.

You can already unlock 1Password using biometrics in your Apple devices. they do ask you for your password every 2 weeks though. But I think that's a great balance.

...Unless I misunderstood what you're talking about. When I put in a passkey, 1p just asks me to press a button, not re-unlock.

With a passkey you would have one in keychain that unlocks 1p. So you will only be asked for your phone password/unlock code whenever iOS asks, but it will be used to unlock 1P. Never need to enter your 1P passphrase.

I still don’t follow. So instead of 1 password that you remember, there would now be a passkey?

I feel that is too risky. Where would you store that passkey? And what if you lose it?

I suppose the 1p emergency kit could print out a QR code or something.

The passkey is stored in the secure enclave which is protected by your unlock code & biometrics (for fast unlock), or whatever the equivalent is for Google. You're not replacing your secret key / passphrase, it's just a different way to authenticate and decrypt vaults.

It's really more a convenience on a handheld device where entering a passphrase (mine is 20 characters) is a pain in the arse. Though, if it were available for macOS, I would use it there too.

Yes/no. I have a few passkeys in my vault but several are for different accounts with the same company (e.g. Amazon, Google). I expect adoption to continue but will take years.

Yep

Reply on news.ycombinator.com