IdeaWell

Project ideas from Hacker News discussions.

Passkeys are not a trap

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

1. Vendor Lock-in Concerns

Many users fear passkeys will trap them in specific ecosystems (Apple/Google/Microsoft), removing software freedom.

"These are very damning. Pretty straightforward about removing all software freedoms in favour of some sense of security." (mik1998) "Passkeys are a trap" appears repeatedly as a central criticism of the technology's direction.

2. Portability and Migration Difficulties

Users consistently report difficulty moving passkeys between platforms or password managers.

"What happens when I go to the same site on a different platform?" (bonzog) "But you can’t simply switch to Android without recreating every single passkey. Sounds like vendor lock-in to me" (croes) Concerns about limited export options: "The problem is that they determine the other apps that are supported. There is no 'generic' export." (secabeen)

3. Security Benefits vs. Usability Trade-offs

Debate continues over whether passkeys' phishing resistance justifies their complexity and reduced user control.

"Passkeys provide perfect protection from phishing attacks, since it's impossible to send a passkey to the wrong domain." (varenc) "Unique strong passwords for all practical purposes are just as good as passkeys and keep you as the user in control." (aeternum) "Passkeys also make things harder for the legitimate user though, and there's a very real question of whether the protection they offer is worth the trouble." (GlibMonkeyDeath)

4. Attestation as a Lock-in Mechanism

Specific concern that attestation could be used to restrict which authenticators/services work with passkeys.

"This implementation is not spec compliant and has the potential to be blocked by relying parties." (KeepassXC issue referenced) "Proponents keep trying to hand wave away the attestation lock-in problem as some vague faraway threat that we may never encounter. It isn't. It's the actual plan." (undersuit) "Remote attestation is never to your advantage. To do it at all, they have to restrict you to a specific set of device manufacturers and yours may not be on the list." (AnthonyMouse)

5. Work vs. Personal Password Manager Separation

Discussion about risks of using employer-provided password managers and available solutions for separation.

"The idea of keeping my passwords in my work-sponsored password manager just sounds absurd. Who thinks that's a good idea? What happens when you leave the job?" (jjice) "most will come with free personal accounts for employees, if they want and choose to set them up. those are separate, and have smooth offboarding for the no-longer-employee." (john_strinlai) "wastewastewaste: eh the companies account for that. for example 1password basically gives you a 'free' extra personal account if you enroll into a work account."

6. Biometrics and Government Compulsion

Worries that passkeys increase vulnerability to biometric compulsion by governments or employers.

"verdverm: Biometrics is my main concern around this, and in that the government can compel you to provide them for device unlock, unlike a pin or password." "Until we change our laws in the US on this front, I will continue to use passwords and hardware keys separate from my phone box." (verdverm) "NoidFonsense: you will eventually be compelled to, which is enabled by attestation" - linking biometric concerns to attestation risks.

🚀 Project Ideas

OpenPass Vault

Summary

  • An open‑source, local‑first passkey manager that stores passkeys encrypted on device and allows encrypted export/import for backup and migration.
  • Core value proposition: gives users full control over their passkeys without vendor lock‑in, addressing concerns raised by users who fear losing access when switching ecosystems (e.g., calgoo: “I know that its coming, but until i can export to something like… keepass and not a commercial entity then i don't consider it ready.”).

Details

Key Value
Target Audience Privacy‑conscious developers, power users, and anyone wary of cloud‑based passkey sync
Core Feature End‑to‑end encrypted vault with support for Credential Exchange Format (CXF/CXP) and optional encrypted JSON export; cross‑platform (desktop, mobile, browser extension)
Tech Stack Rust (core), Tauri for desktop, Flutter for mobile, WebAssembly for browser extension, libsodium for encryption
Difficulty Medium
Monetization Hobby

Notes

  • HN commenters repeatedly asked for a way to export passkeys in a readable, encrypted form (e.g., alterom: “You can't be serious… go do it, find out, and come back here to tell us about it.”) and lamented the difficulty of moving passkeys between platforms. This tool directly satisfies that need.
  • Provides a concrete alternative to relying on Apple/Google/iCloud Keychain, reducing vendor lock‑in while preserving phishing resistance.

PassKeySync Server

Summary

  • A self‑hosted sync service (similar to Vaultwarden) that stores users’ passkeys encrypted end‑to‑end and makes them available via WebDAV, SFTP, or a lightweight REST API.
  • Core value proposition: lets users keep their passkeys in their own infrastructure, eliminating reliance on proprietary cloud sync and addressing the “cloud lock‑in” fear expressed by many commenters.

Details

Key Value
Target Audience Sysadmins, privacy advocates, and teams that already self‑host password managers (e.g., Vaultwarden, Nextcloud)
Core Feature Encrypted sync endpoint for passkeys; supports CXF/CXP for app‑to‑app transfers; optional audit logging
Tech Stack Go (backend), SQLite (metadata), libsodium (encryption), Docker for deployment
Difficulty Medium
Monetization Hobby

Notes

  • Users like alterom warned about being “locked into that cloud” and asked “What ensures the ability to move the keys out of the cloud?” A self‑hosted sync server answers that.
  • Enables discussion about decentralized identity and can be integrated with existing self‑hosted password managers, a topic that received positive notes (e.g., OkCompute64: “As a Bitwarden (and Vaultwarden) user… I have had zero issues with passkeys.”).

PassKey Migrator CLI

Summary

  • A command‑line tool that automates migration of passkeys between different password managers (iCloud Keychain ↔ Google Password Manager ↔ 1Password ↔ Bitwarden ↔ KeePassXC) using the Credential Exchange Format.
  • Core value proposition: removes the manual, error‑prone process of moving passkeys, directly addressing the pain point of platform fragmentation highlighted by users (e.g., joshnstrlai: “What happens when I go to the same site on a different platform?”).

Details

Key Value
Target Audience Power users, IT administrators, and anyone managing multiple devices or evaluating password‑manager switches
Core Feature Unified CLI that reads passkeys from source manager’s export/API, encrypts them, and writes to target manager via CXF/CXP; supports dry‑run and verification
Tech Stack Python (core), platform‑specific bindings (Apple Security, Android Keystore, Windows Credential Manager), cryptography library
Difficulty Medium
Monetization Hobby

Notes

  • Commenters noted the confusion of passkeys ending up in different stores depending on device (e.g., “depending on the device I happen to be using at the time it could end up going to Google password manager, Samsung password manager, iCloud Keychain, or Windows somethingorother.”). This tool unifies that experience.
  • Enables practical utility: users can test migration safely, fostering discussion about interoperability standards.

Attestation Policy Studio

Summary

  • A web‑based GUI for enterprises to define, test, and deploy passkey attestation policies without locking users into a single vendor; includes a simulator to see which authenticators are allowed/blocked.
  • Core value proposition: gives organizations control over attestation while preserving user choice, mitigating the “trap” fears about attestation being used for vendor lock‑in (e.g., anthonymouse: “The objection here isn't to something that uses public keys instead of TOTP. It's that they added support for remote attestation to passkeys…”).

Details

Key Value
Target Audience Security teams, compliance officers, and IT departments deploying passkeys at scale
Core Feature Policy editor (allow/deny lists based on AAGUID, vendor, firmware version), test harness with simulated authenticators, export to JSON/YAML for IdP or MDM integration
Tech Stack React frontend, Node.js backend, OpenAPI spec for policy format, WebAuthn library for simulation
Difficulty High
Monetization Revenue-ready: SaaS tiered pricing (free for community, paid for enterprise support & audit logs)

Notes

  • HN discussion highlighted concerns that attestation could become a tool for lock‑in (e.g., “If you can get attestation without those restrictions, 'sure, why not', and a Yubikey seems like a way to do that which could avoid those restrictions.”). This tool lets enterprises attest transparently.
  • Encourages debate about balancing security and user freedom, a recurring theme in the thread.

SecurePasskey Backup

Summary

  • An open‑source app that creates encrypted, sharded backups of passkeys (using Shamir’s Secret Sharing) and stores them on user‑chosen media (USB stick, personal NAS, or encrypted cloud bucket) without relying on a single provider.
  • Core value proposition: solves the “loss of device = loss of accounts” nightmare described by users who worry about being locked out if their phone or laptop is stolen (e.g., alterom: “One more thing to worry about losing, yay.”).

Details

Key Value
Target Audience Travelers, remote workers, and anyone concerned about physical theft or device failure
Core Feature Generate m‑of‑n shards of the passkey vault encryption key; each shard saved to a different location; recovery UI to reconstruct vault from any m shards
Tech Stack Rust (core), libsodium for encryption, Shamir library, Qt for cross‑platform GUI
Difficulty Medium
Monetization Hobby

Notes

  • Users repeatedly asked for a way to recover passkeys without trusting a cloud (e.g., “What ensures the ability to move the keys out of the cloud?” and “What protection does the passkey ecosystem offer for physical threat to the user?”). This directly answers those questions.
  • Provides a tangible backup strategy that can be discussed alongside existing solutions like YubiKey recovery codes.

Passkey‑Aware Phishing Simulator

Summary

  • A training platform that simulates passkey‑based login flows and phishing attempts, teaching users how passkeys resist phishing while highlighting remaining risks (e.g., malicious enrollment).
  • Core value proposition: educates both end‑users and developers about the true security properties of passkeys, addressing the debate over whether passkeys are genuinely phishing‑resistant or merely shift the attack surface (e.g., mixdup: “Passkeys can be, and have been, stolen and hijacked…”).

Details

Key Value
Target Audience Security awareness trainers, developers building passkey‑enabled sites, and enterprise HR/security teams
Core Feature Interactive scenarios: legitimate passkey login, phishing site attempting to capture passkey, malicious enrollment attack; feedback and metrics on user decisions
Tech Stack Svelte frontend, Express.js backend, WebAuthn API simulation, optional WebExtension for real‑browser testing
Difficulty Low
Monetization Hobby

Notes

  • Many commenters debated the real‑world phishing resistance of passkeys (e.g., “Passkeys provide perfect protection from phishing attacks…” vs. “Passkeys can be, and have been, stolen and hijacked.”). A simulator lets users see the difference in practice.
  • Generates practical utility for organizations rolling out passkeys and fuels discussion about usability vs. security trade‑offs.

Read Later