Hacker News Reader

Comment by scarab92 | Hacker News Reader

Password managers give you phishing resistance, and most passkey storage is not hardware backed.

In typical scenarios, passkeys offer no advantages over a password manager.

I might not be as thorough as others on here in my password manager setup, but I don't think my password manager setup is as phishing resistant as passkeys.

Fairly frequently, I find myself searching for the password manager entry I want, and copying the username or password.

For a while, I was very consistent in trying to fix the URLs for that password manager entry, every time it happened. But when I'm on mobile, sometimes it's just a pain.

There are quite a few scenarios - I'm logging into an app, and it doesn't use a browser window for authentication, but also logs out after a few weeks, I've been redirected to Microsoft or similar for the login, but I haven't added microsoft.com as a URL for my work login, or GitHub (I could be wrong about this example), etc.

When I list them, these reasons seem like I should have solved them already. I used to try to keep my password manager tidy, but when I'm at 674 entries and it's growing faster than I'm cleaning.

I also think Passkeys are a confusing mess, and I don't mind the idea in addition to a password/TOTP option, but definitely not instead. I do like having it as an option for Google, where I have occasionally encountered a scenario where I login from overseas, and can't login despite having everything they can possibly want (username, password, backup email, etc.). I can't remember the exact details now, so I hope I'm not being uncharitable to Google's login/lockout process, but I doubt it!

> There are quite a few scenarios - I'm logging into an app, and it doesn't use a browser window for authentication, but also logs out after a few weeks, I've been redirected to Microsoft or similar for the login, but I haven't added microsoft.com as a URL for my work login, or GitHub (I could be wrong about this example), etc.

I don't exactly understand what you mean but it seems more like a problem with the auth token.

No. Password managers cannot prevent you from manually copying and entering a password. With passkeys, however, you don’t enter a password; instead, you receive a "challenge" generated by using your passkey public key, which you then solve using your passkey private key. The exact same principle used for SSH keys and with SSH nobody would argue to use password authentication over SSH keys. Of course, this doesn't stop someone from stealing your private key, or from having Claude explain how to export that key from a digital wallet and enter it into a phishing site (and yes, of course there will always be people willing to go to such lengths if it’s the only way to gain access because why wouldn't they). Still, the hurdles are significantly higher than they would be with a standard password. Ideally, you should bind your private key to a hardware security key (such as a YubiKey or Nitrokey) or to an (of course inherently malicious and absolutely despicable) TPM module, which effectively ties the key to a specific PC. In that case, neither you nor an attacker with root privileges would be able to export the key.

They offer advantages but it’s anyone’s guess if the sites you use them with use most of them sanely.

1. In practice everything that saves a passkey requires a biometric to unlock each time, so you SHOULD not be required to use another factor (the secret is “something you have” and the bio is “something you are.” In practice though, now every F—-ing site insists on the damn “we emailed you a code” BS.

2. Passkeys certainly don’t need to be changed every arbitrary period like some idiotic sites (or IT admins) insist for passwords.

3. If one becomes compromised, you can revoke just the one. Unlike a password.

The typical scenario for majority of users unfortunately does not include a password manager, passkeys are a huge step up from that.

For the people already using password managers, it's not a huge step to get a Yubikey and use that for hardware-backed passkeys.

The fact that I can't get passkeys to work like 10% of the time makes me think they're significantly more secure. If I can't use them to access my account, an attacker definitely won't be able to /s

Reply on news.ycombinator.com