IdeaWell

Project ideas from Hacker News discussions.

I don't like passkeys

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

5 Most Prevalent Themes in Passkeys Discussion

1. Usability and Complexity Issues

Users consistently report passkeys are confusing and poorly explained for average people, requiring technical knowledge to understand basic concepts like storage and recovery.

"Passkeys have a marketing problem where no one is able to describe simply what it is without having to use technical jargon." (kenrick95) "People around here really ought to stop thinking users are complete idiots." (kskdkwkdkwk) "The biggest issue with passkeys is that since most USB tokens that support them don't allow syncing the private key to a backup device you have to enroll ALL of them to every site that supports passkeys." (UltraSane)

2. Device Dependency and Recovery Concerns

Significant worry exists about losing access to accounts if a device is lost, stolen, or broken, with no clear recovery path for non-technical users.

"My bigger problem with passkeys is how there's no universal way to register more than one device (in case the first one is lost)." (ryan-duve) "So if I drop my phone to the toilet, I will forever lose access to everything? Since the vault is on my phone." (mystifyingpoi) "What happens if I lose my phone?" (cpburns2009)

3. Platform Lock-in and Ecosystem Concerns

Repeated criticism that passkeys tie users to specific tech ecosystems (Apple/Google), reducing freedom and creating single points of failure.

"While the technology itself may be great [...] it has been co-opted by the tech conglomerates as another form of isolating and walling off users into their ecosystems." (elteto) "Both Apple and Google want your identity anchored to their operating systems." (pamcake) "Passkeys could be the savior of all security problems worldwide [...] and tech companies would still ruin it by trying to force ways it pushes you into their ecosystem" (zamadatix)

4. Implementation and Inconsistency Problems

Frequent complaints about inconsistent implementation across websites and platforms, including nagging prompts and poor integration with password managers.

"Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser." (hannasanarion) "The worst offender for me is the Costco mobile app. It's handy because it allows you to enter the store by scanning the QR code [...] however it also nags you to create a passkey." (dboreham) "Sites didn't need to do anything special for this use case with passwords so it is a passkey problem." (account42)

5. Security Trade-offs and Benefits Debate

Ongoing discussion about whether passkeys genuinely improve security versus introducing new risks, with disagreement on their net value.

"Passkeys do marginally improve security against MITM and phishing attacks, but they are primarily for protecting the lowest common denominator from themselves" (drtz) "Passkeys have made my life very easy. Especially using Proton Vault." (blackdahlia313) "Passkeys lock you into a third-party provider ecosystem that you really should be trying hard to avoid getting locked into. They also add a quantum safety risk." (OutOfHere)

🚀 Project Ideas

Passkey Onboarding Coach

Summary

  • An interactive, step‑by‑step web guide that explains passkeys in plain language, walks users through creating and storing passkeys on their devices, and generates a personalized backup/recovery checklist.
  • Core value proposition: demystifies passkeys for non‑technical users and reduces accidental lockouts by making the setup process transparent and repeatable.

Details

Key Value
Target Audience Everyday users confused by passkey prompts (e.g., Amazon, PayPal)
Core Feature Guided tutorial with device‑specific screenshots, plain‑language FAQs, and a printable backup plan
Tech Stack React + TypeScript frontend, static hosting (Vercel/Netlify), optional localStorage for progress
Difficulty Low
Monetization Hobby

Notes

  • HN users complained that “no one is able to describe simply what it is” (kenrick95) and that explanations are “atrociously unclear” (Al‑Khwarizmi); this guide directly addresses that gap.
  • Provides a concrete reference that commenters could link to when others ask “how do passkeys work?” – encouraging discussion and practical adoption.

Universal Passkey Sync & Backup Service

Summary

  • A self‑hostable, end‑to‑end encrypted service that lets users export passkeys from any OS keychain or password manager and import them into another, enabling true cross‑platform portability and secure offline backups.
  • Core value proposition: gives users control over where their passkeys live, eliminating vendor lock‑in and the fear of losing access when a device dies.

Details

Key Value
Target Audience Power users and privacy‑conscious individuals who use multiple devices/OSes
Core Feature Export/import passkeys via encrypted JSON (or CBOR) with optional Shamir backup; supports Apple Keychain, Android Keystore, Bitwarden, KeePassXC, YubiKey
Tech Stack Go backend (libsodium for crypto), React admin UI, Docker‑compose deployment
Difficulty Medium
Monetization Revenue‑ready: Hosted SaaS tier ($5/mo) + free self‑hosted open‑source core

Notes

  • Commenters noted the lack of a “universal way to register more than one device” (malfist) and the pain of being locked into Apple/Google ecosystems (pamcake, redwood); this service offers a neutral middle ground.
  • Enables the “digital key” analogy to hold true: users can back up their key like a physical token, satisfying the desire expressed by iamnothere and UltraSane.

Passkey QR Login Relay

Summary

  • A tiny proxy service (runnable on a Raspberry Pi or cloud VM) that displays a QR code on any computer; scanning it with a trusted phone performs a WebAuthn ceremony via Bluetooth/NFC, logging the user in without requiring the computer to have passkey support.
  • Core value proposition: solves the “how do I log in on a device I don’t own?” problem for public/library/kiosk computers, making passkeys usable everywhere.

Details

Key Value
Target Audience Users who need to access accounts from shared or borrowed computers (students, travelers)
Core Feature QR‑code login relay that forwards the challenge to the user’s phone and returns the signature to the browser
Tech Stack Node.js + Express, WebAuthn library, optional Bluetooth/NFC via web‑serial
Difficulty Medium
Monetization Hobby (can be self‑hosted for free)

Notes

  • Many commenters lamented the absence of QR fallback on sites (judge2020, limagnolia) and the impossibility of using passkeys on devices without Bluetooth (201984); this relay fills that gap.
  • Provides a practical tool that could be deployed in libraries, hotels, or workplaces, sparking discussion about improving public‑access authentication.

Hardware Passkey Token with Secure Backup

Summary

  • A USB/NFC hardware token that stores resident passkeys and also includes a secure backup mode: users can encrypt the token’s master seed to a second token or to a paper seed phrase (using BIP39‑style mnemonic), enabling recovery if the token is lost or damaged.
  • Core value proposition: gives passkeys the same backup flexibility as physical keys while retaining phishing resistance.

Details

Key Value
Target Audience Security‑savvy users who want hardware‑based passkeys but fear loss (e.g., YubiKey owners)
Core Feature Token firmware that supports FIDO2 passkeys, backup/restore via encrypted seed, and LED/audio feedback for operations
Tech Stack ARM Cortex‑M microcontroller, C firmware, WebUSB/WebNFC host app (React Native)
Difficulty High
Monetization Revenue‑ready: Token sale ($35) + optional premium backup service ($2/yr)

Notes

  • HN discussion highlighted that “passkeys deliberately are not copyable” (cpburns2009) and the desire for a “digital key you can back up” (iamnothere); this token offers a controllable backup path.
  • Addresses the fear of losing everything if a phone dies (mystifyingpoi, faust201) by providing a recoverable hardware root.

Passkey Manager Plugin for Password Vaults

Summary

  • An open‑source plugin for Bitwarden, KeePassXC, and 1Password that adds a dedicated Passkey vault, shows where each passkey is stored (OS keychain vs. vault), allows one‑click migration between stores, and provides clear recovery instructions.
  • Core value proposition: eliminates confusion about passkey location and reduces duplicate prompts by giving users a single place to manage and understand their passkeys.

Details

Key Value
Target Audience Password‑manager users who are frustrated by multiple passkey prompts and unclear storage
Core Feature Unified UI listing all passkeys, storage source, export/import, and “move to vault” action
Tech Stack Browser extension (WebExtension) + native messaging host (Rust) for vault access
Difficulty Low
Monetization Hobby (can be sponsored via Open Collective)

Notes

  • Users complained about “fighting the platform” when storing passkeys in Bitwarden/KeePass (przemub, jasonjayr) and not knowing where passkeys live (rcxdude); this plugin gives transparency.
  • Directly tackles the “multiple prompts” annoyance (joshstrange, OutOfHere) by letting users designate a preferred store, reducing friction and encouraging broader passkey adoption.

Read Later