Hacker News Reader

Comment by danpalmer | Hacker News Reader

Passkeys are the consumer implementation of PKI to solve these problems.

There's functionally no alternative for consumer logins, and certainly not one that doesn't require learning what PKI is. "like SSH with PKI" is a bit "draw the rest of the owl".

View on HN

PKI is already in place for domain verification. SSh with PKI is exactly what it sounds like, "passkeys" without attestation, hardware, corporate bullshit.

This is the entire usability/footgun issue with SSH public keys. For the tech savvy being able to copy and paste id_ed25519.pub into their online account settings would be a dream. But who will train the masses to do that? A lot of people would accidentally paste their private key. Just like how journalists learning OpenPGP emailed over their private key compromising it. For low tech savvy people having direct access to key material is an anti-feature. They can lose it. They can leak it or be phished into giving it up. They don't want to manually sync it between devices or generate per device keys and enroll all of them. Then companies exploit this need for user friendly design to create vendor lock in.

My point is your browser, password manager could do just that, all the attestation, hardware keys, required user confirmation etc, authorized clients etc are all a power ploy from FIDO to own peoples authentication.

Cool, why can't I SSH into Netflix? And how should my non-technical parents set up SSH on their phone?

Reply on news.ycombinator.com