proomt

Search

Search posts, papers, and topics

All posts

Hacker News front pageEthan Hawksley3 min readintermediate

I don't like passkeys

Read on hawksley.devHN 832·803 commentsLobsters 70

Summary

Passkeys improve phishing resistance but introduce higher lock‑out risk for individuals. Hardware keys have low per‑device account limits and no backup, while synced passkeys tie you to Apple/Google and can be lost if the provider bans you. Third‑party managers are still immature. For most users, a strong password + TOTP combo remains safer than current passkey ecosystems.

  • Passkeys are asymmetric and phishing‑proof, but recovery still depends on weak channels (SMS, email).
  • Hardware security keys cannot be backed up; each key supports only ~25‑100 accounts (up to 300 on premium models).
  • Apple/Google synced passkeys centralize control—if the provider disables your account you lose all passkeys.
  • Third‑party password‑manager integration (e.g., Bitwarden, KeePassXC) is fragmented and lacks mature autofill UX.

Engineers building authentication flows need to understand the practical limits of passkey deployment—especially backup, device loss, and cross‑platform UX—so they can design fallback mechanisms that don’t lock users out.

5/10
securityauthenticationwebauthnpasskeyshardware keyspassword managers

Related reading

  1. WebAuthn Passkey Recovery: Building Account Fallbacks and Backup Codes in Node.js

    A step‑by‑step tutorial for building a zero‑trust WebAuthn passkey recovery flow in Node.js/TypeScript. It covers generating 128‑bit backup codes, hashing them with Argon2id, rate‑limited verification, time‑boxed JWT recovery sessions, and orchestrating new credential registration with @simplewebauthn/server while revoking lost credentials and rotating codes.

    SitePointsitepoint.com19 min

  2. Enabling secure, productive work on personal devices

    Databricks outlines a four‑layer BYOD mobile security model—MDM enrollment (account‑driven user enrollment), identity‑based access with contextual signals, continuous zero‑trust posture checks via per‑app VPN, and managed‑app controls—while emphasizing employee privacy and transparent communication to drive adoption.

    Databricksdatabricks.com7 min

  3. Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation

    The authors show that the classic trusting‑trust attack is not limited to compilers: by tampering with GNU strip they can inject a payload that propagates through NixOS's bootstrap and ends up in almost every binary of the final system. The attack succeeds on a real nixpkgs revision, building a full graphical installer while backdooring the majority of its binaries.

    arXiv cs.SE (Software Engineering)arxiv.org1 minpaperHN24159

  4. Kit vs. Mailchimp: Which is best? [2026]

    Kit (formerly ConvertKit) targets creators with built‑in monetization tools and a generous free tier, while Mailchimp offers a broader marketing suite and more powerful automation for small businesses. The choice hinges on whether you need creator‑centric revenue features or an all‑in‑one multi‑channel platform.

    Zapier Engineeringzapier.com14 min

  5. When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

    Cloudflare’s Page Shield uses a graph‑neural‑network (GNN) to model JavaScript as a syntax‑tree graph, followed by a lightweight LLM for second‑opinion triage and an ensemble of frontier models for deep analysis. This pipeline caught eight malicious payloads across four distinct affiliate‑theft and backdoor techniques that traditional scanners missed, demonstrating the need for runtime, behavior‑…

    Cloudflarecloudflare.com21 minHN2

  6. Optimize Your Identity Flows with Auth0 Identity Conversion Suite

    Auth0 announced the early‑access Identity Conversion Suite, which adds two features—Anonymous Sessions (tracking a user before they log in via OAuth‑compatible tokens) and Experiment Center (feature‑flag‑driven A/B testing of auth flows). The post explains the intended use cases (guest checkout, secure anonymous API access, passwordless sign‑up, MFA sizing) but provides no implementation details,…

    Auth0auth0.com7 min