skarra

Oh no!

Now I will definitely let you have the last word.

Even Sisyphus wouldn't attempt to convince a HN crowd that not everything in the world is a big tech conspiracy...

Oh no!

I said "more interop" is coming..

There is a significant amount of interop that already exists, that folks are looking past or just already taken for granted (which is actually fine too!). While on a Windows machine using Edge, you can save a passkey for your Google account to your 1Password vault, and use it to sign in to that Google account on Chrome on Mac (if you have signed in to the same 1Password account on the machines). Or you could use a passkey you saved to your iPhone / iCloud to sign in to the Google account on ChromeOS. This is the level of interop that exists today. This did not just happen magically - all these companies (and more) worked hard to make it happen.

Also speaking for Google accounts, passkeys are an additional option for users. Using a passkey is not preventing you from keeping any other sign in method on your account that you feel has less of the lockin risk.

Thanks for your faith. I work on the team shipping passkeys at Google. We are very much hard at work to realize the full potential of passkeys. Platform lockin serves no one. That is no one's intent - independent password managers storing passkeys is already a thing today. More interop will come once relevant standards are blessed.

On account recovery, the user is strictly no worse off with passkeys relative to passwords and arguably actually better off in many cases. This is not what I'd call deliberately ignoring concerns.

Your concern around attestation (mis)use is spot on. I'd say the industry is yet to arrive at an acceptable consensus or compromise on that question.

I work on Google's authentication team. I have mentioned this elsewhere in the thread.

Did you know that Apple allows sharing passkeys via Airdrop?

It is a fair observation. And I can see why users tend to be alarmed about this. Although in my experience users tend to significantly underestimate the real risks of online attacks relative to these more visceral threats.

Let met ask you: has that discovery made you stop using your iPhone, or storing passwords or other critical data in your iCloud? If the answer is "No", then you're strictly better off moving to passkeys stored on iCloud as well.

Passkeys represent the cumulative wisdom and experience (and compromises!) of the whole industry on how to keep users safe online. Appreciate your opinions that these efforts are doomed. It is safe to say, "We'll surely find out!"

Password managers like Dashlane and 1Password have announced support for storing and synching passkeys. As passkeys becomes more popular I expect more providers to step up as well.

Ecosystem lockin is not how we make a new technology like this successful. And all players in the game understand that.

If you are on Apple ecosystem, iCloud can sync. Other password managers like 1Password can also be used to store your passkeys. If none of the above, you can always set up a physical security key and leave it at home.

IMO if you're reading hacker news, you're fully capable of setting one up and leaving it in a safe locale for recovery.

You're spot on. And I work on the Google authentication team right now :)