Discussion
Edit: got some more details that make this look less bad; see the replies.
I’m not anti-passkey, but I got caught really off guard by a site automatically creating a passkey for me with zero user input. Imagine if I’d logged in on a shared device and now the device owner gets passwordless access to my eBay account!
@misty that’s wild, have never seen this
@philnelson Apparently automatic passkey upgrade is a standard webauthn feature, but I have no idea which browsers support it.
@misty @philnelson AFAIK just Apple Passwords (anything that apple passwords can touch) and Google Passwords in Chrome. I'm not aware of anything else that's implemented that part of the spec.
Granted it's been a bit since I checked so I should do another sweep.
This is I think my biggest problem with the passkey ecosystem. It’s very poorly explained and yet every site is very eager to get me to switch to passkeys without making sure the user knows anything about what’s going on or the implications of any of it.
@misty Absolutely. There are dozens of different *types* of passkeys too. Copyable passkeys, Non-Copyable passkeys. User-Verified, Non-User-Verified, Hardware-Backed, Software-Backed... and unlike TOTP (and passwords), the standard (called "WebAuthn") supports remote attestation, meaning sites can reject your passkeys if they're not satisfied with your passkey provider -- or your operating system.
"Sorry, your Netflix passkey is *cryptographically impossible* to be shared with your spouse."
Okay, update: I’ve been told that the automatic passkey upgrade is only meant to create a passkey in the same password manager the password came from, so it shouldn’t grant persistent access to the credentials to someone who didn’t have access to the password. The fact I may have gotten a passkey in a password manager that I don’t normally use looks like a bug, not how this is meant to work.
@misty what passkey manager was this?
@misty A big problem is if you're the kind of person who uses software by building up a mental model of it, and then you catch it even once doing an "underhanded" thing like this, even if it's a *benign* or positive underhanded thing suddenly everything breaks, because your mental model is gone, anything could happen, and now you're afraid to do anything in case you hit one of the hidden "underhanded" behaviors again.
@mcc That is, for sure, the big problem. I’ve noticed in general that people I know are much less willing to try new things with technology than they were a decade ago - people who once had the confidence to explore and try things out are now no longer willing to go even slightly outside their comfort zone.
RE: https://hachyderm.io/@inthehands/117129965997668260
That, and also this fact:
The median software user’s experience in my country (the US) is, beyond a doubt: software is terrible. And not just in an “it’s ugly/hard to understand” sort of way. It’s regularly unfit for purpose, extractive and exploitative, rarely if ever respectful of users’ choices and preferences, does not acknowledge the need for affirmative consent to do things a user really does not like (or even genuinely needs to *not happen*), and brittle to the point that minor errors of usage can translate into serious problems for the end user.
The problem has existed ever since there were computers, but it’s gotten visibly worse in the last few years.
When software fails or acts strangely, it often does so in ways that are *harmful*, not merely inconvenient, even if the harm is hard to measure in ways that techbros can comprehend.
That in it of itself makes non-experts (which is *all of us* in some domains) less willing to try something that “might go wrong”. When “it went wrong” means an important bill goes unpaid silently, of an important email/chat message doesn’t reach the intended recipient, or some other silent but consequential problem occurs, “just try it out” is a much less viable option.
Good thread from someone else who’s written a lot on the topic: https://c.im/@inthehands@hachyderm.io/117129966082285244
@mcc I do feel like there’s something to the idea that users no longer have a mental model of what software will do when they try anything, and have responded by retreating more deeply into the comfort zone of the things they *do* still think they can predict.
@misty @mcc this is exactly the case with my mother, who was a fluent word processor, web browser, and email client user back in 2010. then she had to deal with Windows 10, then a Chromebook, and now she is terrified that pressing the wrong key or clicking the wrong button will randomly delete her files. something horrible has happened and nobody is addressing it
@lunalapin @mcc Yeah, it really feels like the elephant in the room! I suspect that a lot of usability research is focused on short-term gains, but has not looked into the bigger picture of what these kinds of changes have done to user confidence and learning methods.
It has a lot to do with all the evergreen applications today. If the features and UI are always changing with no warning, it creates insecurity on users, especially the elderly.
Good UX helps, but the basic issue is still there: stability breeds confidence. Continuous updates breed chaos.
And disabling updates is frequently not an option, especially for browsers, banking, social apps...
@misty It also always seems to end up costing me more clicks to log in with a pass key than just a normal password manager login :/
@misty Amazon perchance? I only ever noticed bc Bitwarden swallowed the attempt and asked me where to store it (?)
@misty Yeah I am not anti-passkey (it seems like a good idea, though maybe more useful for industry than average end users) but poorly implemented. I have seen many novice tech users at my library wind up with passkeys b/c it's often harder to go through a login sequence and NOT get a passkey. These are people who are often device-insecure who should really not be getting passkeys w/o fully understanding them. I think more people would happily adopt if you made it a choice, not a coercive move.
@misty feel like the poor explanation extends to a lot of people recommending passkeys, too. or did for a while.
like, at first, it just seemed like the pitch was "let google do it for you instead of using a password". and when I tried to discuss that or see what the actual pitch was, all I heard was "well it's better than insecure passwords". which wasn't particularly compelling when 1) it's google 2) I've been using a password manager for a decade.
Install bonfire.cafe
Get the full app experience
@misty Yeah, I like the idea of passkeys a *lot*, for specific threat models they're a threat eliminator for entire families of attacks, utterly brilliant.
But their implementation? Hot dogshit, once again by companies trying to trap you into an ecosystem instead of providing something useful.