Hacker News Reader

Comment by jeroenhd | Hacker News Reader

Websites can't choose for cloud passkeys. That's your OS or your browser.

They can request you store the passkey in something non-exportable, but many software passkey providers simply lie about being super duper secure.

View on HN

My OS (Arch), my browser (Firefox) and my hardware (Yubikey) all work fine with some sites. For example my Google account credentials are on my Yubikey passkey. But half of the sites that claim to support passkeys won't offer me the option to save the passkey on my hardware. Paypal is one such example. Facebook is another. I don't understand why. They seemingly only want to cooperate with cloud based passkey storage. I don't know what mechanics govern this.

Paypal refuses to offer generating a passkey on either Firefox or Chrome on Linux. Spoofing the UA to Firefox on Windows does work, though. Whatever they're doing, it's not normal. I'm surprise you run into it so often.

This is the first time I've seen this issue, very weird. Then again, I had to apply some kind of hack to enable TOTP back in the day (something about faking an RSA key fob), so I'm not surprised Paypal is stil shit.

Paypal's implementation is weird. They have it locked behind some other kind of check so it only seems to prompt to make a passkey sometimes and then it only ever asks for that passkey on that device.

(the UX flows around passkeys are horrendously inconsistent between implementations in general, but even still paypal is a bit of an outlier.)

Reply on news.ycombinator.com