Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

They don't bring any user-visible benefit over passwords if you use a password manager for your password (so that the password is stored securely on disk behind the password manager's login) *and* the password is unique and large (eg randomly-generated by the password manager) *and* you have the password manager autofill it instead of copy-pasting it manually (because the password manager can reliably check the domain name without falling for lookalikes, homoglyphs, etc).

From a UX perspective, passkeys eliminate user choice about the above matters, so it's easier to railroad users into secure-by-default.

From a technical perspective, a shared secret like a password is generally worse than an asymmetric key like a passkey, especially since stupid websites can save the password directly instead of using a KDF in the usual way and then get breached, but if the secret is unique that matters less.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: