HN Reader

My first experience with passkeys was eBay. They implemented them 3-4 years ago, and my password manager, Dashlane picked up on it. They offered to save it and I wouldn’t have to enter a username or password. Great, seemed to work. Until I needed to login on another device and then Dashlane saved that passkey too, but each passkey was tied to the specific device… only it wasn’t clear when I logged in which passkey I should choose, and chose the wrong one and it doesn’t work. After having like 6 different passkeys for eBay I gave up. Now I always decline to use passkeys. They don’t work, idk who uses them but as a fairly tech savvy user, without a very complex setup (chrome, with Dashlane installed) if it’s not working for me it’s probably just not working.

I’ll also add. I don’t have a good mental model for what a passkey is or how it works. And again, like most users if I don’t really understand what’s going on I’m just not gonna bother with it. For all the complexity that it takes to implement secure login with a username and password, most of it is hidden from the user, with passkeys it feels like they’re shoving all the complexity front and center, but not explaining any of it.

I have yet to see a compelling argument for passkeys that is strong enough to overpower it's negatives.

- I want to be able to share passwords for accounts with my family (some, but not all of them)

- I want to be able to load up my login information from whatever device I am currently working on; my phone, my home computer, my work computer, my wife's phone, etc

- I don't want to risk my phone breaking and losing access to all my accounts

Something like 1Password or Bitwarden fits all of that perfectly.

And people complain about Apple being paternalistic.

If you’re already saving passwords in an app, you’re being more secure than most users. A forced move to passkeys seems nuts when not all systems support them yet.

I’m also still concerned that passkeys seems more likely to fail the average user when they break or lose a device, compared to a decent password.

For those who may not have read the article fully, Microsoft's existing traditional password management on mobile devices is not becoming unavailable, but is being moved from the Authenticator App to Microsoft Edge.

I had this warning show up in the iOS Authenticator app like last week or something and it guides you through changing your iOS settings to instead use Edge as a password manager. As Edge is my browser of choice on my Windows PC and I already had it installed on iOS, this was a very minor inconvenience for me.

It's worth mentioning that even though I almost exclusively use Safari as a web browser on my iOS device, when filling in passwords on websites it seamlessly allows you to use any iOS configured password manager including Edge.

It's definitely a little weird that you now require Edge to also be installed for essentially the same functionally and Microsoft might be doing it to try push people to install Edge.

This is very bold because passkeys haven't been the smoothest ride so far. There are many inconsistencies in implementations among platforms. For example, many websites use passkeys as an alternative sign-in option, and let you keep your password login. So, you remain susceptible to phishing despite having a passkey on your account. Recovery flows are inconsistent too.

I applaud Microsoft because a big player had to go all-in into passwordless authentication. I'm sure it won't be painless, but it might push others to adopt the approach eventually.

Absolutely bonkers if true. The #2 thing you don’t want a password manager to do (after, of course, leaking your passwords) is deleting your passwords!

Hopefully this will entice people to switch to 1Password, but I’m pessimistic — it will most likely just convince people not to use password managers at all.

The simpler version is that Microsoft Authenticator--a mobile app that provides 2FA--is discontinuing its password autofill feature and the passwords stored/used with that will be wiped in August unless action is taken, as has been communicated for a while now.

More information: https://support.microsoft.com/en-us/account-billing/changes-...

What's their end game here?

What is Microsoft gaining from their push to passkeys? They knew this was going to piss off a lot of people, but they went ahead with it anyway. That makes me believe there's something else at play.

My experience with passkeys has been worse that my Bitwarden password auto complete, so needless to stay I'm sticking with my regular passwords on my Bitwarden (I know Bitwarden has Passkeys support. I don't want to use it)

What I don't understand with the push for passkeys, is that for years we have been told we need at least two factors for secure authentication, something we have and something we know.

Now with passkeys, it seems we are just throwing all those arguments overboard and are saying 1 factor (something you have, e.g. hardware device) is enough. I've not read anywhere a good argument why.

Sometimes people have been arguing that the passkey should still be locked into e.g. another password manager with password, but that doesn't seem to be the case with most implementations, am I missing something?

Besides other inconveniences mentioned here, I'm very concerned about "passkey provider attestation" (see: walled garden). This was already brought up as a threat against KeepassXC because their implementation allowed "too much" user choice: [1].

Does anyone know if this kind of anti-user attestation has been or can be deployed? I really can't understand why anyone would promote passkeys in good faith if that's the case.

[1]: https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

I recently replaced my iPhone with a newer model.

All the Microsoft accounts in my Microsoft Authenticator broke when I restored onto the new iPhone. None of the non-Microsoft accounts stored in the same Authenticator app broke.

No, Microsoft, I don't trust you to manage passkeys for me.

What a terrible article. The text suggests that Microsoft wants to force you to use passkeys, followed by an attempt by the writer to convince you to use passkeys, when the actual news is "you need to install another app to get autofill from Microsoft's password sync service".

You can just install Edge. From what I can tell, you don't even need to browse using Edge to use passwords.

If you don't use Microsoft Authenticator, nothing changes. If you do, probably because IT makes you, you've already seen the warnings about this.

What a dick move. I don't want to use edge, it's a terrible browser. And most sites don't support passkeys.

I'm glad I don't use Microsoft crap but use everything self hosted so I can decide for myself what I want.

I occasionally run into small biz employees running the mandated MS Authenticator (biz O365) on their personal devices. This makes me sad.

I'm trialing Winauth for some remote-only users. So far I'm happy with having the authenticator on Windows desktop.

ref: https://github.com/winauth/winauth

I'm confused. Is this a Windows-exclusive thing? As an iPhone and Mac user is there anything I need to do?

There is an app in the iPhone App Store called "Microsoft Authenticator" - is that what this story is about or is there a Windows feature with a confusingly identical name?

Slightly off topic, but the Microsoft Authenticator app on iOS is - in my opinion - the probably worst designed app by a large corporation. Nothing in there works the way you’d expect it to work.

And my absolutely favorite thing was when it itself came in the way of seeing the 2FA code for a modal entry and you had the option on the screen to hide the modal for 10 seconds in order to remember the number underneath…

See screenshot here: https://ibb.co/5Wh05rsd

Wherever I work, IT departments expect me to install MS Authenticator on my own smartphone. To authenticate myself to MS so they can authenticate me to the organisation that already has seen my passport and my driver's license. No thanks...

What happens if you lose your phone? I can’t find any explanation of passkeys that explains how I recover if my phone dies, gets stolen etc.

If you need a new password manager to keep 2FA codes as well as passwords, Bitwarden is open source (AGPL-3.0/GPL-3.0), and you can self-host the server if you want. Only solution that won't eventually become crappified by a business that doesn't care about you.

Microsoft authenticator is such a travesty. Proprietary 2FA, no standards, can't export the seed.

They just moved the saved password functionality to their browser. Just like Mozilla did.

Wait so are people just going to lose their passwords? That seems like terrible PR for a company that want to shift to services. If you rug people just for marketing reasons like that why should anyone trust you with important business processes. This won't be something people can just ignore, if I lost my (homebrew for exactly this reason) password manager it would probably cause close to 40 hours of time cleaning up the mess spread out of months. We're talking about millions, potentially even billions of dollars worth of destruction depending on how many people were stupid enough (yes that's the appropriate word although it's more obvious now) to trust Microsoft to maintain their secrets for them.

Apple keeps pushing PassKeys to me.

Also, Apple requires at least one AppleID password, that I need to keep entering at random intervals - usually when I update any device, but sometimes randomly when I buy stuff on App Store.

Also I still need a Mac user password, which is a different password, of course.

I am skeptical of passkeys. Not of the technology itself exactly, but people’s implementation of it.

Username/password is much easier to grok (for developers and users) and while it absolutely has downsides, as a user, I can fully protect myself with username/password (unique password per site).

Passkeys might allow for fewer _user_ footguns but I worry there more _developer_ footguns. Also as a “power user”, I don’t want to deal with passkeys when I’m trying to automate something or scape my own data out of a website. It’s just another complication and I worry that anything edge-case-y (even approved methods) will break or have complications if you use passkeys (think app-specific-passwords when 2FA rolled out for gmail access).

Because of this I consistently decline passkey usage until such a time that I feel it’s better understood by the people implementing it.

I do not support - under any conditions - an application which DESTROYS existing secrets.

You can stop supporting new ones, but as soon as you destroy old ones YOU are a vulnerability, Microsoft.

How can I ever trust you to not delete secrets in future?

Microsoft continues its was against its own users.

I never ever succeeded in making a passkey log in after generating one.

Killing autofill and saved passwords in Authenticator is a bold move, especially considering how many non-technical users rely on that feature without even knowing what a passkey is

This will be delayed. Anyone want to bet me?

And more importantly (for them), it's much harder to share a passkey than it is to share a password.

“Why GNU su does not support the `wheel‘ group

Sometimes a few of the users try to hold total power over all the rest. For example, in 1984, a few users at the MIT AI lab decided to seize power by changing the operator password on the Twenex system and keeping it secret from everyone else. (I was able to thwart this coup and give power back to the users by patching the kernel, but I wouldn’t know how to do that in Unix.)

However, occasionally the rulers do tell someone. Under the usual su mechanism, once someone learns the root password who sympathizes with the ordinary users, he or she can tell the rest. The “wheel group” feature would make this impossible, and thus cement the power of the rulers.

I’m on the side of the masses, not that of the rulers. If you are used to supporting the bosses and sysadmins in whatever they do, you might find this idea strange at first.”

https://www.meisterplanet.com/journal/2004/05/09/richard-sta...

It’s also annoying that MS requires a personal account for backing up the Authenticator data to iCloud to ”provide an additional layer of encryption“.

That description makes little sense, and at least they could honor my paid business subscription (and back it up to there if they don’t trust iCloud).

Yes, Microsoft is the worst company ever.

...But this article headline is insanely misleading by not mentioning it's being migrated to Edge. To the point where I'd call it a smear crafted for maximum clickbait shock value. Nothing is being wiped, it's just being moved to a different app. Sure, there's good reasons to not like that app (it's the Internet Explorer sequel after all), but the story here is not as extreme as implied.

I would have thought password management will be quite important for a long while yet. Is MS simply dodging the responsibility? Maybe so they can't be leaned on by government?

This is missing an important piece of information. If I open Authenticator on iOS I see this message front and center:

> Autofill via Authenticator ends in July 2025 You can export your saved info (passwords only) from Authenticator until Autofill ends. Access your passwords and addresses via Microsoft Edge at any time. To keep autofilling your info, turn on Edge or other provider. (Learn more)

not sure the full Android feature set, but MS is moving their iOS autofill provider to the Edge app, which doesn’t mean I have to use Edge to browse, just changes which app hosts the passwords. I can still fill them using the native mechanism for any password manager to provide passwords to any password field.

Microsoft is not forcing anybody to adopt passkeys as far as I can tell. Although overall people should because passwords are quite frankly a broken idea. Almost as broken as the idiotic janky “we just emailed/texted you a code” bullshit that most sites do now instead of TOTP.

This is a very smh facepalm bridgepinch sigh moment, where Microsoft could have taken the high road and gently educated users by restricting insecure passwords instead of blocking their use entirely. A simple bit complexity algorithm like what KeePass uses could determine a threshold beneath which restrictions on adding/using passwords could start to bite.

I only use their app for Microsoft resources, as the 2FA and other security features are stronger through the app than through other 2FA channels. The 2FA itself, for example, is plumped up from 6 to 8 digits. And there is a challenge/response code you can use as well.

But still, IMO this was a massive missed opportunity.

Who trusts Microsoft with their passwords, seriously?

And passkeys are even worse because they're user hostile, dev hostile, and stuck in a walled-garden.

Passwords and 2FA (TOTP or passkeys or something else, with a recovery code mechanism), not just passkeys, or GTFO.

Is this anything to do with them taking passwords without consent? I rarely use windows, and when I do one of the first things I do is switch from edge to chrome. I think I set up edge and used it once to see what it was actually like, but I was pretty careful about the data syncing / sharing settings. I have the Microsoft authenticator app on my phone, I was pretty careful about the privacy settings on that too, but it's been through a couple of phone upgrades. Somehow all of my passwords were making their way into Microsoft authenticator, so I must have missed something somewhere. I can only imagine how many millions of people must have had their passwords unintentionally slurped by Microsoft if they have been that aggressive with it.

If I can't export the private key to my own backup solution, I don't want it.

So what is the recovery mechanism for the passkey?

And they don't expect me to have a different passkey per device, right? Otherwise I still need a password every time I login to a new device.

And so I'll still need a password/passkey manager that stores that.

I don't have a fingerprint scanner on my computer, nor facial recognition.

I do not want any kind of password that relies on my phone, because phones break and can get lost.

So basically this forces me to change from a password to a PIN and this is supposed to be more secure?

All because of advertising. Strong passwords + not tying the account to an email address is the most phishing resistant thing one can do, however nobody is allowed to do this because they need your email address for advertising. Stop welding my identity to an email address and the entire problem becomes an order of magnitude easier to manage and maintain.

> July 2025: You won't be able to use the autofill password function. > August 2025: You'll no longer be able to use saved passwords

There has to be some sort of cost benefits analysis for this as this will certainly piss a ton of people off especially the tech illiterate. Maybe passkeys are extremely simple but saved passwords being disallowed is a huge pain point.

One thing unclear:

While I understand they want to transparently replace passwords with passkeys for websites that support it, what happens with passwords for websites that don't support passkeys?

Also, if someone sleeps over this, they will just lose their passwords to random websites and have to go through account recovery flows?