Hacker News Reader

Comment by WorldMaker | Hacker News Reader

This "use a passcode from another device such as my phone" tech mentioned above is just Bluetooth LTE. Every phone and most laptops and desktops in the last decade or so has Bluetooth LTE support. Hardware support is very good.

Passkeys are built on Webauthn (and ultimately sort of synonymous with it) and that has always been the web standard for all physical key support such as Yubikey and is basically the same as it has been for decades when dealing with Passkeys only with updated UX on top. Hardware support here is pretty good, too.

View on HN

Since you made this mistake a few times:

Its Bluetooth LE, not LTE!

LTE is 4g, LE is a Bluetooth spec (literally means Low Energy).

Bluetooth is very hard to use. This just isn't about hardware support, it's about "how long does it actually take the average person to do a Bluetooth-mediated workflow, how consistent is it between devices, if someone is trying it with a new device, what is the learning curve?" If someone can't figure out how it's supposed to work between their iPhone and their Windows laptop, there might theoretically be support. Practically speaking it's broken most of the time.

The deeper problem is that the default behavior is storing a passkey directly on a specific device and hardware-locking it to that device. That's great if you're an enterprise or whatever and you've got SSO set up well. For the average person, "I lose my iPhone and it effectively resets all my passwords" is a hopelessly unusable workflow.

That is a hopelessly unusable workflow which is why the default behavior on iOS is storing Passkeys in iCloud Passwords and having cloud sync between devices and cloud backup/restore.

On Windows you can use Apple's iCloud Passwords app for Passkeys now directly, in supported browsers because for whatever reason Apple's engineers didn't want to build a Windows plugin for it (yet?) or you can use the Bluetooth option. Windows 11 makes it very easy to use the Bluetooth option and for better/worse some of the requirements that made Windows 11 stop supporting older hardware were also those making sure that Bluetooth LTE is reliable especially for Passkeys.

In the Bluetooth flow the "only" user facing mediation step is the QR code. Some of Microsoft, Apple, and Google's finest all worked together to make sure that UX is about as simple as it can be with just about no learning curve. If someone is used to pulling up a QR code in the camera app and clicking the default app it wants to pop up, "it just works".

If you hear Bluetooth and think of complex pairing dances, that is nothing like how Passkey signings over Bluetooth work. The devices don't need to be "joined" or "paired", they just need clear enough radios for a quick couple of messages, which a QR code kicks off.

I'm not sure I see the difference between a complex pairing dance and needing to install the iCloud Passwords app on Windows (I've used iTunes for Windows.) Writing down a password is much more reliable than expecting any of that to work.

I'm just trying to point out that you seem to be fighting strawmen and yelling about last decade's apps and technology as if that was the current state.

Writing down a password is simpler, but it is also stopped being reliable for the vast majority of users because it stopped being adequate security for the average user. Passwords are too easily stolen. Passwords are too easily reused because human memory is quite fallible. Passwords are too easily caught by a man-in-the-middle attack or a social engineering attack. Passwords are too easily leaked in a database breach. Even when properly hashed and salted, password hashes still are weak to rainbow tables and other such attacks.

Passkeys trade off a bit of supposed simplicity (if you ignore modern advice like use different passwords for everything and always use a password manager because you will never remember all your passwords, it's not humanly possible if they are also all secure enough passwords). But the tech is already at a very usable level of simplicity for average users. It's just like learning a password manager. For some average users it is even easier than learning a password manager the standards and standardized user flows have simplified a lot of the hard edges of the password manager, including the above mentioned "use a QR code to provide temporary access on some other device to your Passkey without syncing your full Password Manager".

Most people don't use password managers. I am not even sure that password managers really qualify as a reasonable amount of complexity for the average person. There's a cost/benefit and I think passwords + SMS 2-step-auth is a reasonable balance between usability and security for most people.

Obviously, I use a password manager and I use MFA where possible, but even that I find to be a little questionable from an availability standpoint because I have a hard time ensuring that I have multiple MFA devices located in different buildings, so a fire or a flood or something could totally lock me out of all my accounts, some of them possibly permanently, which is the thing that scares me more than getting hacked.

Passkeys (combined with full-disk-encryption by default) scare me because they make the assumption that most people would prefer to lose access to their photo library than risk someone breaking in and getting them, and I actually think most people would prefer the converse. If a burglar breaks into my house they can steal my TV, I can live without it, but please don't steal my photo albums (problem is they're the same thing.)

I store passkeys in a 3rd party password manager which has an app on my phone, so I'm only relying on Apple to handle the bluetooth mediation and they do that very well.

I maybe lucky, but outside of headphones bluetooth has never failed to work for me.

Now with a 3rd party password manager, I can install it on any device and all my passwords work there too. However, with Apple, it stores it on keychain so if you have an internet connection, your passwords are backed up.

If you don't have an internet connection, you're not the average person.

Reply on news.ycombinator.com