Yep, Passkeys Still Have Problems

No, passkeys haven't added a new general lockout issue, because Apple, Google, etc. don't allow you to create an account where you can only login via passkey with no external authentication factor. They require you have something outside the Google account, whether that's a password, a hardware key, etc.

People keep falsely imagining that Google is setting people up with passkey-only accounts, with no way to backup their login credentials. Gosh, wouldn't that be terrible?

That would be like 1Password letting you create a passkey-only account with no password, storing the only passkey in 1Password. The whole idea makes no sense. 1Password doesn't do that, and neither does Apple, Google, Microsoft, etc. (We can all imagine them doing something that stupid, but, it turns out, they don't.)

Pre-passkeys, the most common lost-credential scenario was creating a fresh Gmail address on a new device (an Android phone) with a password and forgetting both your Google password and your password for your cellular-phone carrier (AT&T, T-Mobile, etc). Your Google password would be stored locally on your phone and in Google's cloud, but when you lose your phone and forget your passwords, no backups remain.

At that point, you're pretty much screwed. Google can't email you a reset-password link, because Gmail is your email. Google can't you send a 2FA SMS until you get a new phone with the same number, but you can't convince AT&T to do that, because they want to send a reset-password link to your email, which you don't have, or SMS to your phone, which you don't have.

(The cellular carriers don't even allow you to show government ID at a physical store. They don't allow you to take over a phone number that way, because people could then threaten/bribe a T-Mobile store representative to falsely claim that you presented valid government ID, taking over other people's accounts. If you walk into a store, they'll just put you on the phone with customer service, where they'll insist that you provide your AT&T password, or reset your password via email or SMS. If you've lost your email and your phone and all your passwords, you're completely out of luck.)

If Google allowed you to create a passkey-only account, with no SMS 2FA and no way to backup your passkey, that would be even worse.

But, luckily for all of us, they don't even allow that, and they're certainly not pushing it unilaterally on billions of people.

> unlike passwords, there is no good provider migration story

I'm curious what the "good provider migration story" you're referring to here for passwords is?

Password managers by-and-large haven't agreed on a standardised interchange format for import/export - a few of them have some compatibility helpers for importing from specific popular competitors but they're all in different formats, no consistent formats.

The above goes for passkeys as it does passwords - import/export will include your passkeys - so I don't see much difference in the provider migration story.

On the other hand, the FIDO Credential Exchange Format does solve the above problem (if/when providers choose to adopt it), so passkeys are at least further along the path of creating a "good provider migration story" than passwords ever were.

Yes. People have complained about the difficulty of Google or Facebook account recovery and how they need to make it easier and more accurate for ages. You could search hn for "password reset" or "lost password" and you'll find tons.

For those you add recovery e-mails. You can easily have a Google, Microsoft and Yahoo e-mail so having access to at least one means you can recover the rest. Yes, this increases your attack surface, but the chances remain miniscule.

it's just a further step whittling away of browsers being a "user client".

a key based approach is great. Knowing (the passphrase) and Having (the key) is a good way to authenticate.

> The passkey vendors state that the goal was to make phishing not just difficult but impossible. This means plaintext access to your credentials is forbidden forever, regardless of your level of expertise, and regardless of the complexity of the process to export/import them.

Care to cite this statement?

> As an Apple Mac user, what annoys me the most is that the use of passkeys in Safari requires iCloud Keychain, which of course requires iCloud and an Apple Account. You can't do local-only passkeys, not even if you take responsibility for backing up your own Mac.

You can use any credential manager you choose. You don't have to use Apple Passwords / iCloud Keychain.

It's an open protocol, you don't need to use any of the vendors. My Yubikey is a "passkey", so is my Flipper Zero. Keepass provides passkey support.

For the general public, they already rely on either Google or Apple for pretty much all of their digital life. Nothing wrong with extending this to passkeys, it's convenient and makes sense for them.

> passkeys in Safari requires iCloud Keychain

This is not true - browsers including Safari support passkeys managed by third-party password managers.

I'm using 1Password with browser extensions for Safari and Chrome on macOS and iOS and it works seamlessly with my passkeys, which are not stored in iCloud Keychain.

This is obviously kicking the can down the road, but I "solve" this problem by storing passkeys in a third-party credential manager that supports them. That way I can use them on any device that I've installed the client app or browser extension on. I have this working on Fedora, macOS, Windows, and iOS.

But again, kicking the can down the road.

> what annoys me the most is that the use of passkeys in Safari requires iCloud Keychain

Completely untrue, Safari on both Mac and iOS supports third-party password managers for both traditional passwords and passkeys.

> The purpose of the so-called "secure credential exchange" is once again to prevent you from directly accessing your credentials.

I’ll accept that the attestation parts of the protocol may have had some ulterior motives (though I’m skeptical), but not having to reveal your credential to the verifying party is the entire benefit of passkeys and hugely important to stop phishing. I think it’s disingenuous to argue that this is somehow unnecessary.

It’s “illegal” in the sense that you could write whatever you want in your will but it wouldn’t be binding. You cannot force a party into a legal obligation they do not agree to.

The government can, though. I’m not sure if there’s any existing laws pertaining to transfer of or access to general accounts after death (as opposed to bank accounts which I’m pretty sure there are laws about).

My will says that my executor can access my accounts which alleviates Apple from legal risk if they do grant access but I’m pretty sure they are not obligated to do so.

Only if they're not backing up their phone, which seems insane in this day and age.

And even if they're not, if they have a computer or tablet, the passkey will still be available there assuming they share an account.

You can also recover your iCloud Keychain via a designated/trusted Recovery Contact (e.g. spouse, who presumably hasn't destroyed their phone at the exact same time), or via iCloud Keychain escrow.

https://support.apple.com/guide/iphone/passwords-devices-iph...

Android syncs them to your Google account and iPhone to your iCloud account by default. Which isn't a perfect solution but, again, is pretty good for most people.

>with no good way to get back in.

which is why at the very least your email provider gives you a recovery kit to print out (the equivalent of the notebook) and if you can get back into that account you'll likely be able to get into whatever else you signed up for.

There's no difference here between passkeys and any other central storage be it a password manager or a physical notebook. If you lose that access, well you're screwed. But it always beats having hotdog123 as your password for 70 different sites.

Your credential manager provides this sync and backup capability. There are dozens of credential managers available that work on all platforms. You don't have to use the default one on any given platform.

Bitwarden is my personal choice.

iCloud Keychain (or whatever the Google equivalent is). And as I said, it's a fantastic solution for the vast majority of the population (which, coincidentally, are also not Hacker News readers).

Google Password Manager, Bitwarden, 1Password among many others.

It's a beautifully simple experience for Apple users across all their devices.

I can't speak for other platforms; I stopped helping ${EXTENDED_FAMILY} with non-Apple questions because the crap I had to diagnose, debug and deal with for Windows and Android was worse than ${DAY_JOB}.