timmyc123
Re:Why I Still Shun Passkeys
on Friday October 16, 2026 @01:26PM (#50121468)
iCloud Keychain is required on macOS to create passkeys in Apple Passwords (which uses iCloud Keychain to securely sync them). Apple Passwords is the default credential manager in macOS (similar to Google Password Manager on most Android devices). If you want to save to another credential manager (app) on your Mac, you need to install it and enable it. If you don't have another credential manager on your Mac, that is why you can't save a passkey on your Mac and are given the option to save to another device.
Re:Passkeys Are Not a Trap
on Thursday October 15, 2026 @04:33PM (#50109817)
You can. Choose a credential manager that offers that feature.
I just don't think that's a good idea for most users. Imagine an older relative being coaxed into exporting all their passkeys in plaintext and uploading them to a website.
Re:Passkeys Are Not a Trap
on Thursday October 15, 2026 @09:17AM (#50103232)
> It's notable that several of the claims on that page conflict with the other info in both the OP article and the follow-on.
Create GH issues or use the feedback form if you believe there are issues with the content!
Re:Passkeys Are Not a Trap
on Thursday October 15, 2026 @09:16AM (#50103222)
You wont' typically see a setting in your browser, because credential managers are designed to operate at the system level, so that your credentials aren't "stuck" in your browser. This is why you don't see an option in Chrome settings. You can, however, disable Google Password Manager in Chrome settings, as it is a Chrome feature.
macOS: Settings > General > Autofill & Passwords. Turn on 1Password. https://support.1password.com/macos-autofill/
Re:Passkeys Are Not a Trap
on Wednesday October 14, 2026 @12:29PM (#50090376)
Many credential managers support migration. See https://whatarepasskeys.info.
Re:Passkeys Are Not a Trap
on Wednesday October 14, 2026 @12:29PM (#50090362)
AAGUIDs are not unique to authenticators. Hundreds of millions of people using the same product have the same AAGUID.
Re:Passkeys Are Not a Trap
on Wednesday October 14, 2026 @12:25PM (#50090290)
> OS-supplied keychain management
That is your choice as the user. You can use the default credential manager that is offered out of box, or you can use your own.
Re:Passkeys Are Not a Trap
on Wednesday October 14, 2026 @12:20PM (#50090170)
maybe read the whole issue?
Re:Passkeys Are Not a Trap
on Wednesday October 14, 2026 @12:15PM (#50090068)
Microsoft Entra is a workforce product. An employer always decides how you authenticate to your work account. It's not your account.
Re:Passkeys Are Not a Trap
on Wednesday October 14, 2026 @12:14PM (#50090044)
Lot's of additional great information for consumers and prosumers at whatarepasskeys.info. Many of the questions that are constantly discussed in these comments are answered in the FAQ and content.
Contributions and feedback are welcome! GitHub link is at the bottom of the page.
Re:Passkeys Are Not a Trap
on Wednesday October 14, 2026 @12:13PM (#50090025)
The primary reason 2FA exists is because passwords are phishable. If you remove passwords, the need for 2FA largely disappears.
Re:Passkeys Are Not a Trap
on Wednesday October 14, 2026 @12:08PM (#50089903)
Asking that services require you to encrypt your backup file by default to protect against local malware or malicious access is certainly not "The people behind passkeys do not like...allowing you to export your passkeys".
Re:What are passkeys? A simple guide for friends and family
on Wednesday September 23, 2026 @04:21PM (#49821963)
Hey Hacker News! Over the past few years, most posts about passkeys have spiraled into endless debates with hundreds (and in some cases thousands) of comments. I've ventured into many of these trying to provide some context from the development of passkeys and some ecosystem perspectives. Two big observations were that there aren't any vendor neutral resources for regular users to help understand passkeys, and many sites/apps which use passkeys don't provide a lot of guidance or education to users.
A few of us from the passkey developer community have teamed up to create a new consumer-friendly site about passkeys, with easy to understand explanations and illustrations, frequently asked questions, and some details on picking a good credential manager. There's also an advanced toggle which adds some technical details to each section (and in the future some more technical FAQs and sections). Much of the content is based on questions and comments from this community as well as Bluesky, the Fediverse, Reddit, and direct user engagement.
The goal is for this to be a living site, with constant tweaks based on community feedback. You can create issues and/or PRs on GitHub or just submit general feedback via the web form (both are linked at the bottom of the site). The site has no corporate backing or influence, and all feedback is welcome. Scathing critiques or praise. Just please be respectful.
We're also eagerly looking for non-native English speakers to review translations for the current future localized versions of the site.
If you run a site that offers passkeys, please consider adding a link to your docs, and even your passkey enrollment screens.
Re:Passkeys were invented by engineers with zero understanding of cons...
on Wednesday July 22, 2026 @06:32PM (#49014382)
Still taking feedback and questions for an upcoming consumer centric "What's a passkey?" site.
https://forms.gle/wmaydkzmUp2eKfJG7
Original post: https://news.ycombinator.com/item?id=47852849
Re:Passkeys were invented by engineers with zero understanding of cons...
on Wednesday July 22, 2026 @05:38PM (#49013802)
You can use any credential manager you choose for Microsoft Account passkey.
Re:Passkeys were invented by engineers with zero understanding of cons...
on Wednesday July 22, 2026 @05:27PM (#49013692)
Re:
on Tuesday April 21, 2026 @02:50PM (#47852850)
We’re building an interactive resource to demystify passkeys for both the general public and more technical users.
We’re aggregating questions to ensure our FAQ and interactive guides cover "how do I use this?" type questions from non-technical users as well as the real-world edge cases that more technical people care about.
Some prompts:
• What questions do you get from friends and family?
• What are the biggest hurdles you've faced when using them?
• What are your technical "how does this actually work"-type questions?
We’d love your input. Any and all feedback is welcome!
Please submit your questions via this form: https://forms.gle/wmaydkzmUp2eKfJG7
Re:Don't use passkeys for encrypting user data
on Monday March 02, 2026 @12:24PM (#47221011)
> The essay has a condescending attitude towards the normie computer user who can't possibly be expected to know, but it's precisely the normie computer user who would never get the stupid idea of "cleaning up" their passkeys in the first place -- that's something only a nerd with a neurotic attitude to their computer would do.
Thanks for the feedback. That certainly wasn't the intention. It was more about the average user not remembering specific details about their passkeys. Which I do stand by. If you have some suggested text to help clarify that, happy to update the post.
Re:Don't use passkeys for encrypting user data
on Monday March 02, 2026 @12:20PM (#47220949)
You can use any credential manager you choose. It is an open ecosystem. If you don't want to use a cloud service, don't. You can self-host many credential managers. There are also many solutions that just use a local database.
Re:Don't use passkeys for encrypting user data
on Monday March 02, 2026 @12:14PM (#47220872)
Hey
I'm the guy you're talking about. Always easy to crap on people when you selectively quote what they said. The core pieces you left out are:
> I don't quite understand why requiring file protection/encryption can't be a temporary minimum bar here.
> or at a minimum require file protection/encryption.
If you think helping users to be safe online (which includes putting basic safeguards in place, like not leaving hundreds of unencrypted private keys on someone's desktop in plain text) isn't an important part of designing solutions for global scale, then we think about things very differently.
Re:Don't use passkeys for encrypting user data
on Monday March 02, 2026 @12:07PM (#47220785)
> Too bad the spec is stupid and requires password managers to be identifiable so servers can deny the "insecure ones".
There is no requirement that credential managers identify themselves. Please stop spreading misinformation.
Re:Please, please, please stop using passkeys for encrypting user data
on Friday February 27, 2026 @01:44PM (#47183983)
Not sure what you mean. In most cases, passkeys sync across your devices.
Please, please, please stop using passkeys for encrypting user data
Re:Yep, Passkeys Still Have Problems
on Thursday December 18, 2025 @08:32AM (#46312405)
> stored on a YubiKey/Secure Enclave/TPM and that was what made them resident.
Stored in an authenticator/credential manager in general, not specific to a security key, secure enclave, or TPM.
Re:Yep, Passkeys Still Have Problems
on Wednesday December 17, 2025 @09:37PM (#46308356)
Not really. The attestation model defined for workforce (enterprise) credential managers/authenticators doesn't really work in practice for consumer credential managers.
Re:Yep, Passkeys Still Have Problems
on Wednesday December 17, 2025 @07:29PM (#46307525)
A passkey is a discoverable credential (aka resident key) in spec terminology. But the type of credential has no relationship to attestation (which is not used in the consumer passkey ecosystem).
Re:Yep, Passkeys Still Have Problems
on Wednesday December 17, 2025 @07:27PM (#46307507)
The dialog provided by the browser or OS usually tells you where the passkey is saved.
Re:Yep, Passkeys Still Have Problems
on Wednesday December 17, 2025 @07:25PM (#46307499)
Copy and paste in clear text? Yes, I don't think that's a good idea.
Download to disk in clear text? Yes, I don't think that's a good idea.
Years and years of security incidents with consumer data show that this is a really bad idea.
At minimum, a credential manager distributed for wide use should encrypt exported/copied keys with a user selected secret or user generated key.
Re:Yep, Passkeys Still Have Problems
on Wednesday December 17, 2025 @07:20PM (#46307468)
If a website were to attempt to do this, you (or your credential manager) could simply change the AAGUID to match another credential manager.