Amazon Passkeys Launched: Response to Consumer Demand with Poor Implementation

https://www.corbado.com/blog/amazon-passkeys-launch

by vdelitz • 3 years ago

62 69 3 years ago

Recognizing the increasing demand by consumers to enhance security and in particular user convenience, Amazon rolls out passkeys widely across most devices and browsers. This underlines Amazon’s commitment to bend to consumer demand.

Which consumer base has demanded enhanced security and convenience (for which passkeys are the proclaimed answer)? The non-tech crowd has no idea what it is and is probably just hearing about it. The tech crowd on a forum like HN seems to be mostly against it because of issues with account recovery and cross-device use that passwords don’t pose.

From what I understand, it seems like passkeys may ultimately rely on SMS OTP or similar mechanisms for account recovery. The other likely result would be losing the account forever, especially if the user is a single device one (there are billions of such people around the world).

I’m going to wait it out a little longer to see how the interoperability factors play out in reality and learn from those who are braver than me.

lxgr7• 3 years ago

to enhance security and in particular user convenience

What convenience? Amazon's implementation saves me exactly one thing. "Typing my password" (i.e. pressing my password manager's autofill key combination).

The annoying part is having to enter my OTP over and over and over again, with the non-functional "don't ask again on this browser" box below serving as a little mocking statement to show that they have indeed thought about this use case – they just haven't bothered to actually implement it.

circuit10• 3 years ago

I haven’t read the article so I don’t know if this is the same thing as passkeys but most password managers should support TOTP authentication

BakaRakuda• 3 years ago

Which consumer base has demanded enhanced security and convenience (for which passkeys are the proclaimed answer)? The non-tech crowd has no idea what it is and is probably just hearing about it. The tech crowd on a forum like HN seems to be mostly against it because of issues with account recovery and cross-device use that passwords don’t pose.

Yeah it's going to be mostly the tech crowd at this point, and it will filter down to non-tech people. And we will all be better off when we are all using passkeys. Looking at my girlfriend's computer her password situation is a nightmare of potentially compromised passwords, reuse of weak passwords, among other issues. Even after spending hours trying to clean it up there are still tons.

If we were in a passkey only world then no more weak passwords for her to reuse, no chance of phishing said password from her. Even if the server gets hacked there is no password to get pwned.

I really don't care what the contingent of passkey haters on here say. A lot of the discourse here isn't what it used to be. Little better than Reddit for techies.

From what I understand, it seems like passkeys may ultimately rely on SMS OTP or similar mechanisms for account recovery. The other likely result would be losing the account forever, especially if the user is a single device one (there are billions of such people around the world).

That's not as I understand it. Why would SMS OTP be used? 100% of accounts today will already have a password, that's how you would login if you lose your only passkey device.

If/When passwords are not a thing anymore then why wouldn't the recovery use a "lost password" type flow that happens is facilitated via the account email?

I’m going to wait it out a little longer to see how the interoperability factors play out in reality and learn from those who are braver than me.

Fair enough, but you can add a passkey to an account and your password will still work. So it's not like it will cause any harm to try it. You can even remove passkeys from an account if you really don't want to use it.

The worst thing about passkey support on Amazon is they didn't embrace it completely so you still have to go through all of the login form bullshit instead of being a one step biometric unlock that passkeys can enable.

stavros2• 3 years ago

You're right about the level of discourse, and it's become especially obvious to me whenever there's a discussion about passkeys. Everyone keeps repeating the same debunked arguments over and over, with only maybe one argument (attestation) holding some water.

It's too bad, I'm really excited about passkeys increasing authentication usability (and security second, for me), but most people here seem to want to hold on to passwords, as if they aren't both terrible UX and terrible security.

kalleboo• 3 years ago

That's not as I understand it. Why would SMS OTP be used? 100% of accounts today will already have a password, that's how you would login if you lose your only passkey device.

I've been using passkeys on yahoo.co.jp for a while now after they prompted me to set it up.

It works fine on my Mac, but for whatever reason it won't see the passkey on my phone - it just pops up a QR code dialog and says to scan it on another device (my only other device is my Mac which won't scan QR codes). iCloud Keychain is syncing fine - regular passwords on other sites work.

Once that fails it drops back to SMS OTP. There is no option to log in with a password.

So as far as I see it, Passkeys are still an experimental technology. Passwords suck so I hope one day they figure out how to get it working.

michaelt• 3 years ago

Why would SMS OTP be used? 100% of accounts today will already have a password, that's how you would login if you lose your only passkey device.
If/When passwords are not a thing anymore then why wouldn't the recovery use a "lost password" type flow that happens is facilitated via the account email?

Well, passkeys are descended from FIDO/U2F keys, which have traditionally been used for "two factor authentication" - by confirming both 'something you have' and 'something you know' your account is protected if someone has shoulder-surfed your password, or stolen your phone, or hacked your e-mail, or whatever.

And FIDO/U2F keys kinda a hassle, so they're only used by the most security-conscious people in the most security-critical situations.

For these people, a recovery mechanism that falls back to a single factor (password-only login, e-mail only login) is a big weakness, security-wise.

danShumway13• 3 years ago

I really don't care what the contingent of passkey haters on here say.

I think what a lot of passkey advocates misunderstand is that this isn't a debate about what passkeys should look like once everyone has adopted them. It's a discussion about whether passkeys will ever get adopted.

Ordinary users are not going to use passkeys until these problems are solved. You're envisioning a world where everyone says, "there are tradeoffs, but we all made the switch and the security is better so tough luck." The reality is that fixing the tradeoffs are a precondition for passkeys to be a replacement for passwords.

The same industry that was incapable of teaching people how to use real 2FA tokens is not going to be able to teach them how to clone passkeys across devices. The discussion around passkey problems is not a discussion about how many people will grumble when passkeys eventually break into the mainstream. It is a discussion about whether passkeys are ever going to break into the mainstream at all.

----

Note that passkeys themselves are a response to this reality: it used to be that everyone talked about how cloud synchronization within an ecosystem was just too insecure and critics were going to have to get over the fact that it wasn't supported. This was a common debate on HN.

That changed, because it became obvious that passkeys were not going to happen without cloud sync and that roaming passkeys were a requirement, even if they made the standard slightly less secure. Now the same people are out saying that portability and better standardization among services is not the FIDO Alliance's problem to solve and people are just going to have to get over it.

And I don't think y'all understand how standards get adopted. Ordinary users are not going to get over it, they're going to refuse to use the standard. The first time they use passkeys and run into Amazon telling them that they can't log in from Firefox, they're going to walk away from passkeys forever.

beej713• 3 years ago

That's not as I understand it. Why would SMS OTP be used? 100% of accounts today will already have a password, that's how you would login if you lose your only passkey device.

If we continue to do this, don't we then still just have all the same problems with passwords?

lll-o-lll• 3 years ago

The tech crowd on a forum like HN seems to be mostly against it because of issues with account recovery and cross-device use that passwords don’t pose.

Because of an embarrassing amount of ignorance. Own an android phone? An iPhone? Congratulations, your passkeys are on your password manager.

You can recover your passwords when you lose your phone right? Exact same mechanism. (Now, if we want to talk about how solid the protection is for apple/google at keeping these private keys safe in their clouds, and how secure something is when one magic password is enough to unlock literally everything, or how confident we can be that the govs won’t be able to get their paws on them, that’s a more nuanced topic).

mekoka• 3 years ago

You obviously don't travel. Lose your phone while abroad. Good luck!

Double_a_923• 3 years ago

"Normal" people usually have an incredibly hard time managing accounts and their logins. They constantly have to restore account passwords, or just straight up create new accounts.

A passkey which is backupped to their Apple or Google accounts will make things easier.

lxgr7• 3 years ago

Sorry to be so bitter about this, but at this point, "Amazon botches UX design for feature X" isn't news – "Amazon delivers useable UX" would be.

Passkeys are complicated enough, but even as somebody having spent hours looking into WebAuthN and setting up my own smartcard-based NFC authenticator, it took me a while to understand what's going on with Amazon's implementation.

- "If you want to add a passkey, use a different cloud service account (example: Apple ID or Google account). Each cloud service account can only have one passkey for Amazon." is what I see in Firefox, for example – what on earth does that mean? Firefox doesn't synchronize passkeys with either of these accounts. The issue is that they don't support platform authenticators on macOS. That error message does not make sense!

- Ok, I get it now, so Firefox does not support passkeys, hence the button is greyed out, fair enough. But, wait... 1Password does provide passkey support through their Firefox extension. It works on every other WebAuthN/passkey-supporting site. And 1Password's passkeys do work on Amazon using Chrome! Do they just sniff the user agent here and grey out the button on Firefox? What's going on?

- The only option to manage passkeys in my Amazon account is to... delete ALL of them. I guess adding a list of passkeys and the dates they were added, like almost every other service I know supports, was just too much to ask from Amazon.

- "If you didn't set up this passkey, please go to your account settings to delete the passkey.". – Oh, right, let me quickly go through the literal dozens of options in my Amazon account page. I get that Amazon does not want to train users to click links from emails (although that ship has arguably sailed, which is why we are getting WebAuthN in the first place: It's phishing-resistant!). But Is it too much to ask to simply reference the path there, i.e. "Your Account -> Login & security -> Passkey" in that message?

On the other hand, this is completely in line with my user experience on any Amazon site or product. I wonder if Amazon is even aware of the mere concept of UI/UX design as something other than a half-day task any backend engineer is just expected to do as part of the feature they're shipping.

danShumway13• 3 years ago

Each cloud service account can only have one passkey for Amazon

Assuming that this error message is correct and isn't just badly worded nonsense -- if the FIDO Alliance had any sense at all this would be barred from the spec and Amazon would have to either support correct behavior or skip getting certified and getting an official stamp of approval. I cannot believe that I'm being told by advocates that attestation for roaming providers won't be a problem when they can't even get websites to allow unlimited keys to be linked to an account.

"Websites wouldn't block an authenticator, they'd just be cutting off users", I am reassured while I watch Amazon sniff browser user agents so that it can block specific browsers from logging in. I'm glad that iOS is zeroing out authentication requests voluntarily, but if that error message is to be believed, that's apparently not good enough. It needs to be part of the spec.

lxgr7• 3 years ago

I'm glad that iOS is zeroing out authentication requests voluntarily

Do you mean attestation? If so, I believe that’s mostly out of the picture already, since it does not even make any sense anymore with “cloud-resident” passkeys.

It can’t be what Amazon uses in any case, since I can use 1Password on Chrome, but not Firefox.

jatins• 3 years ago

Sorry to be so bitter about this, but at this point, "Amazon botches UX design for feature X" isn't news – "Amazon delivers useable UX" would be.

(Tangential) I keep saying this: if any other company without a business model as strong as Amazon was run like Amazon they'd be dead.

But for some reason execs see Amazon and think "if they can ship and utterly mediocre product and win, so can we"

My brother in Christ first build a distribution network that can deliver a million products to my place within 1 day, then you earn the right to ship an eyesore app.

another-dave• 3 years ago

Sorry to be so bitter about this, but at this point, "Amazon botches UX design for feature X" isn't news – "Amazon delivers useable UX" would be.

It's a bit like reading a blog on cocacola.com — "People disappointed by Pepsi, say they prefer other soft drinks". Passkey integration is this company's main (only?) product, and the submitter to HN is the company co-founder.

I appreciate that the blog post itself wasn't overly sales-y, but maybe it'd be good to have a [Advertorial] tag or something for when people want to promote their own product. That, or have OPs do a disclosure in a comment if they're submitting something through a personal account that's on behalf of their own company.

danShumway13• 3 years ago

Passkey transfer across ecosystems is still an unsolved problem, Linux support is lacking, Bitwarden's implementation hasn't launched yet, and there are host of ecosystem issues and caveats that people keep telling me will be ironed out in the future but haven't been ironed out yet. Meanwhile, Amazon botching its rollout is a symptom of the specification not requiring standardized implementations. It's a symptom of the FIDO Alliance just assuming companies will do a good job and won't break everything.

Ideally, this would be the point where the Alliance would step in and say, "okay clearly we need to standardize a lot more because y'all can't handle this much leeway in how you implement the standard." Ideally it would give the Alliance pause about other parts of the standard like attestation where they're also being painfully naive about how corporate implementations will go. But instead, the industry seems intent on barrelling forward with passkeys in their current state anyway.

Passkeys aren't ready to recommend to normal consumers yet. We still have yet to see any proof that the portability and lock-out problems are actually going to be addressed. Words are cheap, talk to me when there is an official spec for transferring passkeys between ecosystems and when adherence to that spec and allowing export is a requirement for certification. Talk to me when the services that allow only linking one passkey are barred from official certification until they fix the problem.

And people say fixes are coming, but nobody in the industry is waiting for them to come. It's not a priority for them. The major companies are showing that they are perfectly willing to recommend a product to consumers in a half-finished state at a point where there is literally no major implementation that allows transferring passkeys between ecosystems and where there serious caveats around linking passkeys to accounts. So what trust am I supposed to have in that? Don't tell me the FIDO Alliance cares about portability or ease of access; the companies involved do not consider lack of portability and access to be a blocker.

I consider it irresponsible to recommend passkeys in their current state and irresponsible for companies to be rolling out wide support based on the current state of the ecosystem. I've lost a ton of faith in the entire standard because of how advocates have glossed over issues and because of how the industry is currently showing that actual universal access and universal support and real Open implementations are not a requirement and that they're willing to try pushing consumers onto passkeys before those critical problems are fixed. The whole thing up to this point has felt dishonest and pushy and weird.

If the intent from advocates was to build support by papering over the problems, the effect has been the opposite. I'm still aware of the problems, but now I also don't trust the advocates to be honest when talking about the problems. At some point I need to sit down and write up something more detailed about what the timeline has looked like, because I really feel like the conversation around passkeys and the way companies have moved forward with them is a really good example of how to just completely kill consumer trust in a standard that could have theoretically been good.

lxgr7• 3 years ago

Unfortunately, I largely have to agree.

I was really excited about WebAuthN, but even as somebody having read the specification several times and having done a lot of experimentation, it's now more or less a mystery to me when I can add which type of passkey to a given website.

Sometimes I get 1Password jumping in; as of lately, Chrome sometimes realizes that I have a native passkey stored in iCloud(!); until recently, there was also Chrome's local/non-synchronized passkeys on macOS; very often, nothing happens and I realize I'm just on the wrong browser for any of it to work (e.g. Firefox on macOS).

I can't realistically recommend this to non-technical friends and family at this point.

danShumway13• 3 years ago

I was so excited about WebAuthN. Part of my irritation about passkeys is that I want to like them. It's a cool idea and they could in a parallel universe somewhere be really good. I wish the people working on them weren't systematically undermining my trust in the entire concept.

ngrilly5• 3 years ago

I just replaced all my OTPs stored in Authy by passkeys stored in iCloud Keychain. It works perfectly fine with both Safari and Chrome 118, and is synced between my Mac and iPhone with end-to-end encryption.

I’m using it with Google, GitHub, Facebook, Gandi, Fastmail, and Stripe. On some of these websites, the passkey is still seen as security key for 2FA instead of a “real” passkey not requiring a password at all.

Apple and Google are putting a lot of effort in making this work well and it shows.

croes• 3 years ago

What happens if you switch to Android and Windows?

Double_a_923• 3 years ago

Ok now imagine that you would wan't to use an Android or Windows device in the future. How do you easily access your iCloud Keychain. Or that for some reason Apple blocks your account?

danShumway13• 3 years ago

Apple and Google are putting a lot of effort in making this work well and it shows.

They're not putting in enough effort. Both platforms still have serious caveats that mean that passkeys are not ready for ordinary users and both platforms are still willing to push this technology on ordinary users before those caveats are solved. That makes me trust them less because if they tell me the technology is ready, I don't know if they're actually using me as a guinea pig or not.

The big caveat (but by no means the only one) is still that passkeys can not be imported and exported across ecosystems (and no, 1Password does not solve this problem, 1Password keys also can not be imported and exported across ecosystems).

And what we're seeing above from Amazon is that even if Apple and Google step up and allow export the ecosystem is still going to be fragmented and overcomplicated as long as the FIDO Alliance refuses to take responsibility for pushing companies to make good decisions about their implementations. The Alliance's deliberate hands-off approach to these problems is why the ecosystem is a fragmented disaster. I don't want to rely on the good will of Google, that's not good enough. These fixes have to be part of the standard itself.

On some of these websites, the passkey is still seen as security key for 2FA instead of a “real” passkey not requiring a password at all.

This is exactly what I'm talking about, passkeys are designed to be an alternative to passwords, it is a weakness of the spec that they are being used by services as a 2FA token. That's not a positive place for the ecosystem to be, it's mixed messaging about what passkeys are supposed to be.

It makes passkeys less accessible to ordinary people if companies are not even aligned on what passkeys definitionally are supposed to be.

solatic• 3 years ago

portability, transfer, export

It's a good thing that these are not possible. I want private keys to be non-exportable. This is why HSMs and Yubikeys are so secure, because there is no API to access the private key itself. It prevents hackers from leveraging other exploits to extract private keys.

The only "transfer" process I want is one where I can use the passkey on one hardware device to authorize in real-time the login on a new device, so that I can then set up a separate passkey on that device. This is fundamentally an application concern and not part of the WebAuthn standard, because there needs to be something to push to the device with the pre-existing passkey to ask for authorization.

danShumway13• 3 years ago

It's a good thing that these are not possible. I want private keys to be non-exportable.

Cool, I guess, but they are never going to be a replacement for passwords as long as that's the case. Ordinary non-techie users are never going to be OK with that.

We couldn't get ordinary users to use real 2FA tokens. You think security people are going to convince them to build a backup system across multiple devices where they duplicate their keys? It's not going to happen.

The only "transfer" process I want is one where I can use the passkey on one hardware device to authorize in real-time the login on a new device, so that I can then set up a separate passkey on that device. This is fundamentally an application concern and not part of the WebAuthn standard

This is absolutely something that concerns the WebAuthn standard, because a nontrivial number of providers don't support this.

I'm tired of the passkey advocates saying "backup works, you just have to authorize new devices" at the same time they're saying, "it's not our responsibility to ensure that it's possible to authorize new devices." Okay, it's not your responsibility, but then don't pretend that backup works even under the narrow criteria of cloning keys on multiple devices, because even that doesn't actually work.

Amazon above is spitting out an error code that claims it will only support adding one passkey per-provider. If so, that's the FIDO Alliance's problem to solve if the FIDO Alliance is interested in anyone actually using their spec, because my takeaway from Amazon's messaging is that cross-device registration isn't guaranteed to work.

snvzz• 3 years ago

As long as I can still use passwords.

I strongly prefer to keep each account independent, so that there's no single point of failure outside of myself.

ngrilly5• 3 years ago

A passkey for one account is independent from a passkey for another account, by design, unlike passwords that can be shared across multiple accounts.

tehbeard• 3 years ago

The issue they state isn't password reuse.

All the bits and such to generate those passkeys originate on one device... And it's specifically designed for it's security, to not allow the key material be removable from that one device...

A device that may end up in the bottom of a canal in Venice...

It's then a case of how do you bootstrap back up to having access?

- Did you remember to spend money on an additional passkey device? - Did you ensure you don't need the passkey device you lost to access the other device which the passkey syncs with (for the iOS keychain/google whatever options) - Did you remember at each. and. every. account. you. have. to enroll both your primary and secondary passkeys?

vs.

- You can remember enough to get into email for resets, or there's a note or a thumb drive kept in a drawer that has enough password info (itself possibly password protected) to get you back on your digital feet.

I understand the need for not being able to export from a passkey device... but it massively shifts the paradigm of how users need to operate. And puts all the trust in devices.

8note• 3 years ago

Website security was recently lampooned by Ryan George: https://youtu.be/5t15a0im-_4

freitasm• 3 years ago

Just setup passkeys on my Amazon account.

1. Asking for OTP after using a passkey is redundant and annoying 2. Not listing the keys individually makes management hard - I can't remove a single Yubikey, or Windows Hello or my phone. If anything is replaced it will just keep accumulating in my account. It should list each passkey individually and allow me to give a name to each one.

vdelitz4• 3 years ago

I think they are still in some kind of learning phase / silent rollout and hopefully will fix this soon. I already can see that many users who are not that tech-savvy will also have big issues once it comes to managing their passkeys.

Shank• 3 years ago

especially for those using browsers like Chrome on Mac, where a QR code was shown instead of explaining that a passkey is not available or just skipping passkeys (QR codes still being a major struggle for most consumers)

Chrome on macOS supports passkeys in icloud keychain as of M118. Hiding passkeys because users “struggle” with QR codes is, frankly, stupid.

_cenw• 3 years ago

I'm more upset it sets up a resident key, but then doesn't take advantage of not even asking me for my email. Waste of a slot if you use a hardware token.

vdelitz4• 3 years ago

I think this might change in a future update or later stage of the rollout. Making use of the "usernameless" behavior is a potential that Amazon currently left on the road.

Amazon Passkeys Launched: Response to Consumer Demand with Poor Implementation

Related Stories