Hacker News Reader

Comment by tgma | Hacker News Reader

Hard disagree. Phishing is a major problem. Passwords+OTP are phishable[1]--passkeys are not (the signature is bound to the domain and cannot be forwarded). That alone makes passkeys worthwhile for the vast vast majority of consumers. This is not a theoretical threat model. You simply cannot realistically expect even a savvy consumer to be able to save themselves from phishing all the time. One mistake and they are fucked.

If you write a long article about the merit of passkeys and there is no occurrence of the string "phish" in your article, I am afraid I cannot take your rant seriously.

Again, this stuff is not merely theoretical. YubiKeys have been a thing at Google and other major tech companies for almost two decades now and the effects are well-studied.

[1]: I have found for some weird reason, this is often overlooked and misunderstood in the industry. People even know about SIM swaps and stuff like that, but don't realize OTP is not phishing-proof.

View on HN

Phishing is a major problem, but it happens less than you think. Password managers are also checking the domain before supplying a saved password. A user who relies on autofilling the password every time will notice when their password manager suddenly does not autofill.

Yubikeys are a great second factor honestly. But do you want to use a Yubikey as a passkey? Sorry you are likely dissatisfied. Many websites and apps (especially apps) support passkeys but would prohibit using your Yubikey as a passkey.

> Phishing is a major problem, but it happens less than you think.

Bullshit. Literally number one attack vector.

> Password managers are also checking the domain before supplying a saved password.

Password managers are not anywhere as ubiquitously used as you'd think. Even if you rely on password managers, you encounter scenarios where the website relies on a different domain that's not paired appropriately. Some "legitimate" mofos like Plaid used to ask password for third party website. Consumers don't see a password manager failure to fill out a password as a security issue. They see it as a routine password manager failure.

> Literally number one attack vector.

That’s an out-of-date view. The number one attack vector these days is cookie stealing. The prevalence of 2FA even weak ones like SMS-based 2FA has made plain old phishing so much less effective.

That's not correct - more than 1/3 of initial access is by phishing at present, according to Cisco Talos (and others major security publications largely agree with this). Ref: https://blog.talosintelligence.com/ir-trends-q1-2026/

What you may be confusing with is the number of incidents involving token theft, which is often facilitated by phishing.

That publication is talking about phishing as a threat to workers inside corporations and government agencies and public administrations. It’s not a thing for regular consumers. Passkeys aren’t usually used in corporate environments with an IT department anyways.

    YubiKeys have been a thing at Google and other major tech companies for almost two decades now and the effects are well-studied.

My experience is that yubikeys have a tendency to get lost, get cleared, get mixed up (which of my 4 identical yubikeys has the right passkey?), stop working reliably from random USB issues, etc. And worse, yubikeys are awful to use. Like am I seriously supposed to take off my phone case every time I want to plug in a yubikey to the USB-C port (which may or may not be working depending on whether moisture has condensed in the port) so I can use the one mobile browser that supports them to retrieve a passkey every time I want to log in?

No, fuck that. Just let me use an SSH cert at that point. The existence of phishing is a comparatively minor evil.

Your "SSH cert" option, in a consumer package, is effectively the passkey.

SSH doesn't prevent key sharing (and hence, phishing), so it's fundamentally different in the context of this discussion.

> ...sharing (and hence, phishing)

Sharing and phishing are on two different axes. You can have shareable credentials that are phishing-resistant when used.

You can have hardware-backed SSH keys that are not cloneable. You would need the browser to prevent phishing while still using SSH agent as its underlying signature mechanism (implied by my "in a consumer package").

Right, which is why Passkeys are consumer-minded enhancement to SSH keys in that browsers are asked to require that every domain gets a different passkey. I've seen SSH agents with that requirement, but yes very few users of SSH use more than one public key per device at a time, and many even use the same private key across multiple devices rather than enroll multiple SSH public keys.

Note that YubiKeys are not passkeys. But they are a great alternative to passkeys that are just as secure if not moreso.

Reply on news.ycombinator.com