Passkeys were invented by engineers with zero understanding of consumer brain

Join the discussion

• Hacker News
• Throwing my hat in the ring, I think passkeys were also invented by engineers with zero understanding of the average developer: https://etodd.io/2026/04/06/passkeys-are-too-hard/
  by et1337
• I mostly love passkeys to be honest even though I use multiple browsers across multiple devices and OSes (iOS, Chromebook, Linux, macOS, Xbox, etc). Bitwarden’s support is (finally) pretty good.

  My problem is that I manage a lot of accounts for my family which makes passkeys a nightmare. If I’m out and a kid gets chucked into a login flow that happens to require a passkey, I can’t text a password and TOTP code to the adult with them. I know that’s terrible opsec but the reality is people share accounts and passkeys are designed to thwart that.

  by schmichael
• I think portability is very confusing: they rolled out passkeys with no device portability (device-bound) and only recently added it (CXP). So for anyone with multiple devices it was a relative disaster - why should my Windows PC hold a device-bound passkey to anything? How do I login on Linux or macOS? Picking a password manager to do portability also means another kind of lockin, though maybe you can live with that kind if you really trust the company. Even so, the password managers all seem to be competing to have relaxed security, so that vault and account passwords are the same, or you are asked to type your master password into a webpage - surely we didn't replace per-site passwords with this?
  by herf
• UX is not the problem with Passkeys. Passkeys were designed to align with the interests of BigTech, who are bent on stopping the abomination that is general computing devices in the hands of consumers and forcing them into their walled gardens. The language that is used for taking away freedoms is the same as always, safety. Where we ended up with Passkeys is an operating model that is suitable for corporate devices, i.e. the user can only do what the owners of the device allow them to. Suboptimal UX is downstream from that problem.
  by c7b
• Passkeys work just fine with Bitwarden, LastPass, KeepassXC, physical keys, several software tokens, and TPM storage.

  So far only Nintendo has been absolute assholes about requiring specific passkeys, but that's maybe the least assholish thing Nintendo has done.

  by jeroenhd
• It seems to me like those who like passkeys/consider them simple are those who entrust all their credentials to proprietary cloud software vendors that sync them to all their devices.

  Those of us who are not comfortable with that and want to keep our credentials offline and sync/backup them ourselves have questions about how the registration/backup/sharing flows work exactly.

  I see this as part of a trend together with remote attestation, age verification, CSAM scanning, restricting sideloading, etc that will lead to most interactions over the internet only being allowed if big tech and/or government can verify the participants, the contents, and the hardware and software used.

  Even among techies, many support these developments, so it is just a matter of time before we have no choice but to join the former group.

  by 66fm472tjy7
• You can use passkeys with any password manager, including selfhosted ones like keepass.
  by Gander5739
• I do love the cloud version of passkeys, but I also have a backup YubiKey. I could do two backup YubiKeys, drop the cloud, and keep one YubiKey in a safe deposit box and one elsewhere, but I haven't had much reason to yet.

  A passkey doesn't give up anything compared to a password, and is in fact much much easier to handle, IMHO. I have kept all of my private SSH keys in secure hardware for a decade, so perhaps I'm more used to carrying a physical key than others, but IMHO it's all better, all around.

  We should eliminate passwords, and that has nothing to do with remote attestation, age verification, or anything like that.

  For 20 years, I've only known two to three passwords at any time, and those are login passwords for separate boxes or corporate/home accounts. Beyond that, hardware access should solve everything, and I shouldn't have to type any passwords anywhere. Every account needs granular credentials, not shared credentials, but no user should have to memorize passwords beyond one per work domain.

  by epistasis
• The website for my HSA required me to set up a passkey last time I logged in. I set it up on my work laptop and my work password manager, which means I can now no longer access my account from my personal computer. This is fantastic, just what I wanted
  by ranger207
• I think the irony here is missed.
  by rdsubhas
• Click the "lost password" button. Passkeys aren't magic, they're just a funky password.

  If the website didn't implement a "lost password" button then that says a lot more about the website than it says about passkeys.

  by jeroenhd
• Are you also using HealthEquity for your HSA? I'm the same boat, they're forcing passkeys on me. I can still login using my employer's SSO but I've been putting off setting up the passkey until I have to.
  by sphars
• This is exactly a scenario that worries me. Proponents of passkeys imply you can setup a bunch of passkeys. Evidently that's not always the case.
  by cpburns2009
• And then you call them up, and they allow you in after asking some identity questions, and you learn there's no real security.
  by nitwit005
• With physical U2F key, I could explain to my 78 year-old-parents "this is a physical key needed to access your account. Think of it like the front door key to your house. Don't lose it or lend it to anyone. We should have a couple of backup keys too." And they got completely understood and added it to all of their accounts. This was not hard. People assumed consumers were too stupid to do this without even giving them a chance.
  by exabrial
• I still can't even get a physical key anywhere in person. You can certainly get phones just about anywhere, but you can't get any FIDO keys at brick and mortar, last I checked.

  Until I can tell Grandma to "go down to Walmart and ask the man at the electronics counter for a Yubikey", we still have a few issues.

  (No. Ordering online is *not* a valid option in this scenario. If I want to order a Yubikey to this address at this exact moment in time and space, Amazon won't deliver one to me for at least six days at the earliest, based on their rural delivery estimate. Replacing a key is basically impossible.)

  by kotaKat
• Sure, but i would never want a physical key to something important. Physical keys get lost, so the front door spare is under the flower pot.

  And now I have another thing I need to carry everywhere.

  by xboxnolifes
• And/or maybe the vendors were annoyed that people would lend the keys anyway, refusing to accept that it is normal because that's how delegation of authority works in real life too. House keys are also things you often lend to a third party that you want/need to access your house in your absence, and in fact making extra duplicated for trusted third parties is normal.

  Software vendors continue to refuse to support, or even accept the existence of, this entire class of use cases for regular consumers (they are, however, more than happy to milk enterprises on convoluted implementations of those).

  by TeMPOraL
• > Don't lose it or lend it to anyone. We should have a couple of backup keys too.

  Honestly, this is one of the two things that make me hate passkeys. The key management is a high-friction pain in the ass.

  by JohnFen
• I never found a comfortable way to ensure all of my accounts had more than one U2F key associated with them. I always wished there was a way to have 2 physical U2F keys, one on me, and by adding one to an account, both would work.

  As is, I had to either:

  - Keep both on me, and add both - I am at risk of losing both at the same time

  - Keep one one me, one in a safe - I have to keep track of which device I've added to which service, and periodically take the backup one out of the safe and iterate through the "new" services

  I was never satisfied with either approach, so I ended up with an OTP app with backups.

  by xur17
• FWIW: I find passkeys to be a very simple and easy to use concept.

  Simple: it's like a password that I don't have to type in

  Easy to use: because I use 1Password and just have it installed on everything. On Android, it can be set as the default passkey provider so, even on mobile, I am using passkeys shared across devices.

  Is this "less secure" because I'm sharing the keys through 1Password. I suppose, at some level. But before that, I was simply sharing passwords through 1Password in the exact same way. So, I don't think my security posture has changed any.

  What has changed is the UX and IMO for the better. Now I don't have to generate/fill/copy-paste text strings for user names or passwords. 1Password knows what site I'm on and usually responds automatically when I'm in a passkey context. If I have more than one passkey available, because I have multiple accounts (for something like Google Workspace), it shows me options and I pick the one I want.

  Honestly, it's mostly a "just works" system and I like it a lot better than passwords.

  YMMV, of course.

  by rsyring
• Everything you said is _also_ true if you use a password manager than can interact with the browser (which you're already doing).

  Plus, that doesn't have the negatives/limitations of passkeys.

  by RHSeeger
• This. Honestly, most of the arguments I read against passkeys just sound like “old man yells at cloud.”

  It’s not that difficult. Spend 10 minutes researching the topic and you’re fine. Passkeys are so much more convenient than having to use passwords. When implemented right, it’s literally one click from opening the login page to being signed in. On all of my devices.

  by AndroTux
• This is a big problem I have with "just works". Everyone is used to services only allowing a single password. I know the answer to this, but it's not clear in the marketing or how it's explained to normie end-users: Won't creating a passkey erase my password? How do you sign in on another device? Won't that change the passkey and lock me out from the first device?
  by cpburns2009
• I try to use passkeys when possible as I'm also a 1Password user, but this hardly "just works". Firefox on Windows often triggers the Windows password manager for passkeys (some how this is only on some sites), making it impossible to use 1Password.

  I've seen the same on Android too, and I think there's a difference in how Chrome and Firefox are handling the requests.

  Then you get in to cases like a Microsoft Account. You need to use your account to log in to the device that has the passkeys, so the workflow never works properly and you have to fall back to another method.

  Amazon is another one. If an app like Libby redirects to Amazon, I get a different, passkey-less password prompt, so I need to have a password readily available.

  It's great when it works, but honestly 1password with straight up username/passwords is probably just a better UX in the end.

  by dluxem
• My problem with passkeys is that "don't have to" is actually "don't have to, and couldn't if I wanted to".
  by nlawalker
• OK now say you're on a work/library/friend's computer and you want to look up an account in 1password on your phone so you can type in the password. Passkeys don't support this very basic and common workflow. Meanwhile there's no real security benefit over password manager generated complex and not reused passwords.
  by Tarq0n
• Like some folks already commented here, even as someone who has been working in tech for 20+ years, I find Passkey confusing. I understand the key aspect in computer science term, but I don't know how to use it across devices. Another big worry is that if I tie that to a physical key, then I might lose it (because it's physical) and never get it back.
  by programmertote
• i don't think you really understand how it works. most implementations are secondary implementation alongside login+password.

  how to use cross-device? either use some password manager that supports it (apple/google/1password/keepass/etc support it), or use device that you have on hand most of the time - phone. when the passkey pops up - point your camera and scan the qrcode - you are done. otherwise use dedicated device like yubikey or similar.

  really not sure what is hard about that to understand. i'm using android and chrome, so i can use the password manager in chrome, or my phone to scann the qrcode.

  my country is using similar authorization for government "profile" (mobywatel - poland) that has similar to passkey implementation. you download the app on your phone, login via login+password (or other), download the certificates, and from now on you can point your camera on qrcodes to login to government websites; it requires pin/code or biometric confirmation on the phone - same as passkeys.

  by aPoCoMiLogin
• a big problem with passkeys is that there is a lot of flexibility in how it is rolled out with a given site or app. Some sites ask your browser for a passkey as soon as you hit the login page. Some sites you need to enter your username/email address first before you're prompted. Some sites a passkey satisfies both password + second factor. Some sites you need to enter your password and the passkey is the second factor. Some sites you don't need a password but do need the passkey + a second factor (usually SMS)

  This is on top of the confusion around enrolling passkeys in your device and synchronizing them

  I am a big passkeys fan, and use them on every service I can, but they leave a lot to be desired in terms of user experience. Not sure all of them are solvable, either. The platform vendor side can be fixed: vendors can better integrate with each other to make your passkeys available on every device. But, the issues with how they work across sites and applications is probably not solvable

  by mixdup