Hacker News Reader

Comment by vel0city | Hacker News Reader

If I'm on someone else's computer and I want to use a passkey on my phone, the computer will display a QR code. I scan the QR code with my phone, the phone signs the login request and posts it to the service's callback. Then I'm logged in on that new device.

If my phone's camera is broken but both devices have bluetooth, it can do the handshake over bluetooth.

If I'm on someone else's computer and I want to use a passkey on my authenticator on my keychain, I'll just plug it in and then tap the button on the authenticator.

Meanwhile, if I logged in with the password and the account only has a password then they have a full copy of my entire authenticator to the account. With the passkey, once the session is invalidated the access is gone.

View on HN

This is good in theory but in practice doesn't always work. It isn't just a QR code like I would like it to be, its a QR code and you need bluetooth. Maybe there is a hypothetical world where bluetooth drivers actually work on windows machines and can connect to a mobile device seamlessly but that is not my experience. Across multiple windows machines i often have a problem where windows just decides the machine doesn't have bluetooth, and will refuse to display the QR code without any explanation. It doesn't tell you that bluetooth is the problem it just says "insert a hardware token to authenticate".

I would love for this feature to actually work but every time I've needed it to it hasn't. Literally this week I only had a passkey on my phone, but at the time I was in Linux with Firefox, and afaict the qr code workflow basically requires either chrome or windows 10.

I use this feature a bunch across dozens of different Windows and Mac devices from various device vendors with multiple Android phones and seemingly never had an issue.

But I'm also a person who generally never experiences the issues some people have with Bluetooth in general. If I ever have an issue with Bluetooth on a computer, I swap out the wireless chipset with an actually good one. Its almost always just bad hardware. I've only had to do that a few times in the last decade though, more modern WiFi/BT chipsets are generally pretty OK. Its the old ones that are near worthless.

Although I will say most of the time I just plug in my USB authenticator. I normally only fall back to the QR code if I don't have my keys on me.

And as an edit, I wasn't aware fully that the QR code is to help assist the BT handshake, I had assumed it was posting a signed request back to the service. My bad, my above comment isn't completely correct. Thanks for cluing me in to the BT requirement for the QR code path.

From what I understand the Bluetooth is required to ensure proximity. It isn’t actually used to transmit anything of vital importance. The QR is doing most of that. It’s just there to prevent scanning the QR through a video call and logging in from elsewhere.

Which I’m sure is great in theory. But IMO just adds even more complexity to a system that already has several moving parts and is more fragile than it should be.

This is the one Bluetooth feature that has always worked for me out of the box on both Windows and macOS. I haven't tried Linux yet to be honest, no idea if anyone has bothered implementing it yet. Usually open source is a couple years late to this sort of thing (except for maybe distros like Android or ChromeOS).

Now, if only Windows, macOS, and Linux can get together and fix whatever needs fixing to get headsets to connect properly automatically, that'd be grand.

this doesn't sound like the passkey is the issue, is the implementation or the missing implementation issue.

in poland we have similar to passkey implementation for government profile, that is then used to login to most/all government websites or to sign government documents. you point the camera on the qrcode, confirm it on the phone and you are done. this same app has your ID, which can be used in most places (shops, banks, police etc).

and btw im using linux (main box), macos, android and ios - no issues so far with really cross device usage

Does the apple passwords app work this way (log in to a public machine by scanning a QR code?)

Passkey on an iPhone, logging into a public-ish terminal by scanning a QR code? Yes.

In fact, if you have your Apple Passwords app set to sync through iCloud, you can:

- Make a passkey on your Mac for a site in the Passwords app

- Go to a different computer (a friend's or whatever)

- Attempt to log in, choose use another device, it'll show the QR code

- Use your iPhone to scan that QR code and sign in, as the iPhone has the passkey synced through iCloud

Note, the same kind of thing is also possible with other password managers as well.

Reply on news.ycombinator.com