Hacker News Reader

Comment by andrewmcwatters | Hacker News Reader

Passwords and password managers seem good enough to me, and TOTP support is everywhere now.

Passkeys just feel like a standard written by large tech companies as a flywheel technology to keep me locked into whatever hardware and software ecosystem I'm already in since seemingly no one besides maybe Bitwarden supports exporting them. Which seems pointless, because I don't know of any platform that supports importing them.

I am also getting tired of corporate white knight nerds defending trillion dollar companies telling me that portability isn't a concern.

View on HN

Password/TOTP does not protect you against phishing. The phishing site can forward the password and TOTP you type into the real system, gaining your access.

FIDO/WebAuthn/Passkeys protect you against phishing, because of the origin binding mentioned in the article. On the phishing site, the required credential cannot be generated, and so no matter how convincing it is you can't accidentally give them a credential to forward.

Phishing is what these systems were trying to defend against.

Now if you were to say that the move from plain FIDO tied to a hardware key to passkeys tied to a Google account was a lock-in ploy ---- then I might be more inclined to agree.

> The phishing site can forward the password and TOTP you type into the real system, gaining your access.

To me this seems harder to pull off than a fraudulent password reset (either via social engineering, or a hacked email account). My TOTP fell in the drink a few years back, and some accounts very hard to reset and others were too easy.

If you're targeting a particular person, social engineering is probably easier. If you just want to illicitly harvest some accounts, and aren't too worried about which ones, blasting out emails linking to hacked websites that fake the login & TOTP flow is very easy.

Considering there's an entire portion of the software industry built on accepting a user's credentials and also prompting them for their TOTP, I don't think this really matters.

It's not an acceptable trade-off. And the answer isn't, "Those third-parties shouldn't be asking for your password and TOTP," because that's not a realistic premise.

A couple years ago there were several posts here about not using PassKeys, and I went along with that for a bit. But I’ve fallen in love with them. They’re so nice to use with 1Password.

I suppose I might want to stop using 1Password someday, but it still has all my passwords as well so I can just fallback to those. And, honestly, only a fraction of the sites I have in 1Password have PassKeys available.

What I hate much more is sites that don’t have passwords and require you to log in via email every time. It drives me NUTS.

I get the security behind email-only sign in, but waiting on mail servers is so slow!

Passkeys are honestly the most frictionless system. No more waiting for 2FA codes and having to type them in. No more getting locked out of your accounts if you lose your phone.

With Bitwarden the 2FA codes are copied automatically to the clipboard, being thus just a "ctrl+v" away.

Passkeys are fantastic! I encourage my family and friends to utilize them as an alternative to passwords whenever possible.

Compared to everything else, they are so much of a nicer experience. I despise the "click the link we just emailed you" so much. And MFA is a pain, and still has security issues: https://blog.talosintelligence.com/state-of-the-art-phishing...

I really don't get all the hate for Passkeys on HN...

> I really don't get all the hate for Passkeys on HN...

It feels like the first step in a vendor lock-in strategy. Basically boils down to that. That's essentially my issue anyway.

I love being able to use my Yubikey instead of a password. And I don't feel I'm locked in then...

> What I hate much more is sites that don’t have passwords and require you to log in via email every time. It drives me NUTS.

This is crazy and should be outlawed. Honestly, it's so annoying...

Passkeys are an API that requires the use of a password manager. It doesn’t lock you into any hardware any more than your password manager does already.

You can’t copy a passkey to a different password manager, but you can create a new one for the same account, which is usually just as good.

I use Yubikeys as my passkeys, and in terms of security it's strictly superior to passwords.

> seemingly no one besides maybe Bitwarden supports exporting them. Which seems pointless, because I don't know of any platform that supports importing them

That may still change in the future :-). The thing is that the technology allows it, which is good, right?

Reply on news.ycombinator.com