I don’t know if it’s productive for me to talk about how a headline is off-putting, but I’m going to mention it because, well, it’s a headline, and a headline is a strong first impression.

Is the audience of this article the kind of people who are already using passkeys and like them? Because, if so, we’re starting at a deficit here. The author is out to get my beloved passkeys that have saved me so much time and pain.

Are passkeys perfect? No. Are they even very good for no-technical users? Absolutely not…they’re incredibly confusing for that kind of person if you ask me.

However, for my workflow, I’ll take them over a password+2FA type of situation where logging in is such an annoyance. The security part of the discussion is very interesting and a lot of the things in this article are stuff that I didn’t know before reading it.

The issue is that, putting on my user hat, I just don’t care. As long as my accounts are reasonably secure I’m much more concerned about ease of use and workflow.

▲

throwawayffffas 4 hours ago | parent | next [-]

You don't care, until you use the wrong apple pay card and apple nukes your account and you can no longer login to anywhere because all your keys are in your now remotely bricked iphone.

Substitute apple with google, pay card with youtube comment and iphone with android for the "open" experience.

▲

3 hours ago | parent | next [-]

[deleted]

▲

rogerrogerr 3 hours ago | parent | prev [-]

> the wrong apple pay card

Expand on this? Haven't heard of this failure mode.

	▲	throwawayffffas 3 hours ago \| parent [-]
		Read: https://hey.paris/posts/appleid/ tldr from memory: Guy used 2 legitimately purchased gift cards that had been tampered and their codes were used by someone else. His account was locked with no recurse. I think he could still use his phone, but all the online stuff were locked down. He only managed to get it back after his case reached this website(hn) and senior Apple people stepped in.

▲

nonfunctional 5 hours ago | parent | prev [-]

The intended audience is people who are not yet using passkeys, or have just started (due to all the websites demanding them now) but don't really know what they are.

I apologize that the headline is provocative. I thought for a long time about how to appeal to both people who are barely aware of what passkeys are but also not put off people who like them. I considered calling them a "Trojan Horse" in the headline as I do in the body (i.e. legitimately lovely, but with a terrible and unobvious problem) but "trojan" has another connotation in computer security.

Nonetheless, I said what I meant. Convenience is how they get you. This convenience didn't have to come with a trap, but thanks to the way it was designed, it does.

▲

Grombobulous 5 hours ago | parent | next [-]

Sure, I think your logic makes sense, and I don’t want to overemphasize complaints about headlines.

Regarding how I feel about passkeys after reading your article, logically I am reading what you wrote and conceptually understand the trap, it’s just hard to wrap my head around what kind of situation would cause this trap to “catch” me so to speak.

I.e., the upside is real and immediate, the downside is theoretical and tied to future uncertainty.

	▲	nonfunctional 5 hours ago \| parent [-]
		You're right, I didn't explain in much detail the motivation that will push websites to start requiring the remote attestation flag to be set. I will try to cover that in a future article. But as for how it could "catch" you: if you use FOSS devices that are unattestable (as is the case for the LineageOS phone and Linux laptop I exclusively use), you may one day find you can't use many websites.

▲

MBCook 5 hours ago | parent | prev [-]

You know what’s a great way to get me to not read something? Shitting on it immediately and making it seem like the articles just going to be another pointless rant.

The title put me off completely.

I’m tired of people shitting on everything. Especially without offering any advice on how to improve things. It’s exhausting to read. And apparently it’s not even the point of the article. So why is it the title?

Very very strange choice.

▲

tavavex 2 hours ago | parent | next [-]

I really can't comprehend what the actual issue is here. The title isn't "shitting" on anything, it doesn't say "If you use passkeys, you are a horrible person". It literally is a summary of the article's point - Passkeys are a trap. It even offers a solution you long for - Do not use them, a perfectly fine recourse on an individual level unless you expect OP to overpower a massive tech alliance.

The tone hair-splitting makes it seem like you weren't going to be that receptive to the point anyway, no matter how many layers of subtext are inserted to abstract away the actual point, that being - Passkeys are a trap. Do not use them.

▲

9x39 4 hours ago | parent | prev [-]

>Especially without offering any advice on how to improve things. >And apparently it’s not even the point of the article.

It wasn't a pointless rant, you're seemingly primed for something that didn't happen here.

It's a good argument that passkeys are a trap while TOTPs offer the security you need but avoid the absolute control passkeys may hand over, so stick with those.

▲

qlte 2 hours ago | parent [-]

TOTP/SMS 2FA is a gigantic pain, I've probably lost multiple 24 hour days worth of time added up from entering TOTP and SMS 2FA codes dozens of times per day on websites that mandate it despite having nothing meaningful worth securing.

With passkeys I click once and I'm in like the golden age of using the web with a password manager in 2012. It's a huge quality of life improvement. If people want to avoid passkeys for whatever reason, that's fine but not interested in reading the same slippery slope argument that gets reposted every week.

A recurring issue with these critiques is how they seemingly presuppose passkeys are an all or nothing thing, and losing your passkey means losing access entirely. Which isn't how it works basically anywhere. It's just another auth method, if you can't use a passkey you fall back to whatever recovery method is offered. If passkeys became some user hostile trap overnight I'd just unenroll them and use TOTP, SMS 2FA, email 2FA, or whatever else is supported.

	▲	MBCook an hour ago \| parent [-]
		So true. And every critic always attacks this same thing. TOTP isn’t so bad, my password manager can do it. 2FA is fine it’s automatically pulled from my phone. It’s still phishable. The password is still sent. You haven’t solved anything, you just piled more complexity on top to make it harder. People can still use the same password at 12 websites. Passkeys never get transmitted. If you hack into a server and steal my credentials, all you get is a public key. You can’t use it at another website. A bad developer can store my password or TOTP secret in a way that makes it useful to a thief. That’s not possible with Passkeys. No one ever offers an alternative other than saying it’s irrelevant. Despite practical experience showing otherwise. Passkeys work and make my life better. These constant rants remind me of seeing people argue that the GUIs are a waste of time and no one will ever use them and it’s a fad that will go away and the only reason everyone’s talking about them is companies want to sell graphics cards and mice.