Are Passkeys the beginning of the end of passwords? I hope not

https://unixsheikh.com/articles/are-passkeys-really-the-beginning-of-the-end-of-passwords-i-certainly-hope-not.html

by cratermoon • 3 years ago

39 103 3 years ago

I'm in on anything that prevents the "best practice" of entering new passwords that have esoteric standards of "strength", twice, BLIND, on a crap cellphone "keyboard".

The dots/stars for "password" type input fields might have prevented shoulder surfing in the days of wide-field-of-vision CRT monitors, and typing passwords twice on a real keyboard might have helped decrease people typing something they didn't mean, but it's all irrelevant in the age of narrow field LED cellphones held close to the face, using much smaller fonts.

sonicanatidae2• 3 years ago

The dots are a legacy thing now. I agree 100%.

Yes, they protect you from shoulder surfing, all twice in your life, where that may have been a factor. Otherwise, they are just an implement to the user, at this point.

JohnFen4• 3 years ago

I agree entirely. Obscuring the text was largely pointless even before smart phones became common.

hooverd3• 3 years ago

Decent websites will at least make it toggleable.

Animats• 3 years ago

The dot thing is actually a holdover from the days of printing terminals, where, if something wasn't done to hide them, passwords would be on paper in a trash can.

bediger40002• 3 years ago

Them I'm glad Unix login programs just didn't print any password characters.

But it shows how a best practice isn't appropriate for all circumstances, and that they outlive their usefulness.

jclulow• 3 years ago

If you're going to drop secret masking, it at least needs to be optionally still available. Modern cameras can capture quite a lot od what's on today's bright, high contrast, high resolution, wide viewing angle screens from surprisingly far away.

Unless we're going to use a dark cloth on our phones as if they were an old view camera, I think secret masking still serves a purpose on phones.

nullindividual• 3 years ago

The only reason why Big Tech have hyped up Passkeys this much

I can't think of any other reason Big Tech (and small tech, and medium tech, government, and the list goes on) would want to eliminate passwords, an insecure concept, to replace them with a form of proof of ownership.

[not pasting full quote because ...] "And developers and users... ― Google" No, they do not! - Author

Certainly, many developers hate all of the reasons outlined by the quote from the ethereal identity known as the "Google". Many users hate them for the same reason, too, but for some reason the author doesn't believe that developers or users dislike the UX, security, or liability of passwords (the Author, here, is apparently speaking for upwards of 8 billion individuals -- as one of them, I can certainly make up my own mind, thanks).

Passkeys also makes you more vulnerable to seizures of electronics and keys.

This is why it is important for devices, like the iPhone, have a quick way of putting themselves into a 'locked, require pin/pass' mode. Or just don't enable Face ID/similar biometrics for a 'master' password.

And when it happens to you, Google will let you know that they reserve the right to terminate your account for any reason or no reason at all.

The ethereal Google can look at you funny and decide they will lock your account without any reason. I'm not sure what makes this situation any different. People commonly use their Chrome account, or Microsoft account, etc. in conjunction with the OS/browser's password manager. With passkeys, they're effectively in a _no worse_ state than they are today. If you want to argue about backups, these are likely the same individuals who wouldn't know why you'd need a backup to begin with.

FWIW, I agree that there shouldn't be vendor lock-in with any form of identity, but there doesn't seem to be a challenger that is willing to bring something forward that eliminates both the security nightmares that are passwords as well as being highly portable with no vendor tie-in which finally, is easy to use. Big Tech found "secure" and "easy to use" which is what users are going to flock to.

hooverd3• 3 years ago

I think Passkeys are a great idea utterly ruined by vendors licking their chops over locking users in and creeping remote attestation.

CharlesW2• 3 years ago

How am I “locked in” when I can use a different passkey manager whenever I want, just like I can use a different password manager whenever I want?

How does a passkey differ from a password from an attestation POV?

Ridj48dhsnsh2• 3 years ago

I could not disagree more strongly. Giving large corporations (and governments effectively) the power to control my access to 3rd party resources is totally unacceptable.

growse8• 3 years ago

So don't use them. Buy a yubikey and use that instead (or whatever). Passkeys are just webauthn, with more standardised flows around them.

sonicanatidae2• 3 years ago

Costs.

There are many reasons to secure logins with passkeys, but all of those reasons seem to be beaten by the costs of rolling it out. After all, breaches are someone else's problem. The company? They get a pittance fine, then carry on. The people responsible? they get bonuses.

JohnFen4• 3 years ago

Passkeys do not fit my use cases very well and in some cases introduce an unacceptable amount of friction. I don't plan on using them for that reason.

snailmailman3• 3 years ago

I’ve been using a password manager for all my passwords for years. Moving from “store a password” to “store a passkey” isn’t that big of a difference. The main thing for me seems to be that you can scan a qr code to authenticate another device, a workflow that I will probably end up using. It’s certainly easier and more secure than manually typing a 20+ character password into an untrusted device.

Yeah im sure people will use googles passkey storage, or apples passkey storage, but that was already happening with passwords too. Passkeys isn’t going to change that. Third party password managers are already adding support for passkeys. And OS support for third party passkeys is already there on mobile.

Personally I’m looking forward to passkeys. Just going to make my life a little bit easier. I’m going to continue using a self hosted vaultwarden instance. It already supports passkeys on desktop, and I’m eagerly awaiting mobile support for autofilling them. Hopefully that comes soon.

timr4• 3 years ago

The big problem I have with passkeys is that, as currently implemented by ~everyone, they eliminate true second-factor authentication. I haven't seen an implementation yet that allows me to have something I know, and something I possess.

That, to me, is less secure.

whatshisface3• 3 years ago

The ability to send SMSes or authenticate from your phone are both things you know.

marcosdumay• 3 years ago

You can usually password-protect your keys. That's 2 factors by itself.

That "usually" may exclude the two implementations that most people will use (but I doubt it), but it's a quite standard feature.

the_snooze4• 3 years ago

Passkeys are effectively SSH keys under the hood. All implementions I've seen are two-factor as far as the user is concerned: the server challenges the client to prove they own a private key, and the private key is encrypted client-side under a password, PIN, or biometric.

cchance3• 3 years ago

All the implementations i've seen do both, you "HAVE" your phone, and you "ARE" yourself because touchid, faceid, passkey was used to unlock the key on the phone/bitwarden/whatever your using the passkey on, you still have to unlock the vault on the device you have to use the passkey

snailmailman3• 3 years ago

The “something you know” is what handicaps passwords into being weak - they have to be easy to remember. And they have to be unique per service- because the website has to know the password too and websites get hacked. Because of this people basically have to use password managers. Because otherwise they set every password to “cat123” or “spring2024” etc.

And if people are generating good passwords and storing them anyway- we may as well store digital keys instead.

My password manager is still protected by a good password + 2FA. Passkeys will be protected by this as well. On my phone there is biometric that can replace the password as well.

How secure your passkeys are comes down to how protect them. But it’s definitely an improvement over passwords.

ezfe• 3 years ago

I've used it a bunch already, very useful for signing into my Apple ID on non-personal devices

perryizgr83• 3 years ago

The only reason pass keys are being pushed so heavily is because they are another step in the direction of the customer/user having absolutely zero control over the hardware they own, and the software they use. If you doubt this, ask yourself why there's no way to look at your passkey in android? I haven't checked ios but I'll be surprised if it let's you just look at your own passkey.

growse8• 3 years ago

I can't look at the secret material in my solo usb key either. That's a feature. Do I have "zero control" over it?

perryizgr83• 3 years ago

Yes, pretty much. As the owner you should be able to look at the secret, copy it, publish it, whatever you want. At least with USB keys it is opt in. With passkey I'll be forced to give up my ownership because there are literally no viable options other than Google and Apple for smartphones.

gerwim2• 3 years ago

What is this post ranting about? Pushing your keys to big tech? There is no difference if you use Chrome’s password manager for passwords or passkeys.

You can save passkeys on your own network if you use Bitwarden or if you want, write your own solution.

For 99% of the internet users, passkeys are much better than passwords.

echohack52• 3 years ago

Here's a workflow:

1. Normally I run everything on my own devices, use 1Password, 2FA, etc, but rarely I need to use a locked down device and manually and painstakingly enter 100+ character passwords and 2FA keys. Installing anything on the device is out of the question, but I need to use a web browser and auth using these credentials. Copy and paste and externally using any devices to connect with the system is prohibited.

How does doing a FIDO2 dance work in this scenario?

konha2• 3 years ago

Copy and paste and externally using any devices to connect with the system is prohibited.

Like a keyboard? In which case: How do you enter your password?

Is that a common scenario? Where you can use a (presumably) usb attached keyboard but you cannot insert your security key?

barkingcat• 3 years ago

why does this need a technical solution? Just type in the password. Presumably if the system is important enough to be airgapped and needs a 100+ character randomized password (without copy paste and without hardware keys), it is important enough for you to spend the time to memorize and type in the passwords.

Otherwise, it is just security theatre if you won't even spend the time to make absolutely sure that 1) you are typing into an authorized device that won't log your key strokes, and 2) that using any other "assistance" mechanisms represents a breach in the security of this system.

Just friggin memorize it and type it in. For me, I memorize my bank password and PIN even though it's very complicated. This information is important enough for me to commit the time and not cheapen out by "relying on a tool". Of course, I keep it in my password manager as a record, but in daily use I absolutely do not say to the teller: oh I need to look it up. I recite to the bank my passphrase and other id confirmation by memorization, I know it even better than my own phone number.

If you need multiple people to log in, each person should have a different password, only memorized by that person alone.

If the person can't memorize it, I would say either change the design of the system or fire this person because "they had one job: to memorize and type in this password".

heliostatic• 3 years ago

This is covered by the cross-platform scenario. It's not super elegant, although I'd say it's easier than typing 100+ random characters (and also trusting that the locked down device doesn't have any key logging?). Lots of providers have their own FAQ, but here's one: https://www.corbado.com/passkeys/faq#:~:text=Passkeys%20have....

bonton89• 3 years ago

You can save passkeys on your own network if you use Bitwarden or if you want, write your own solution.

And then google or whoever will block login because your device attestation flag (part of the spec) doesn't say the right version of Chrome or Android. Maybe the website just won't let you login with firefox anymore "because hackers use it".

Don't worry, Apple zeroes out their flag (for now) so you'll just have to pretend to be an Apple device to get in (for now). Assuming the service in question doesn't have an axe to grind with Apple anyway.

psanford• 3 years ago

Android passkeys return `fmt:none` as well if you ask for an attestation certificate.

Its pretty weird to claim that this is a big lock-in risk when both of the major players are not supporting attestation certificates for consumer use cases.

And the one well known site (vanguard) that was requiring an attestation certificate no longer does.

aftbit3• 3 years ago

How exactly does this work? I have Bitwarden and Firefox on Linux. I have been unable to get Passkeys to work at all, using either Bitwarden or my YubiKey. Is Firefox just not supported?

gerwim2• 3 years ago

You need version 2023.10 (or higher) for both extension and server for it to work.

apitman• 3 years ago

I run a free, open source login provider[0] and have been keeping a close eye on passkeys. I think this article gets a bit too much into FUD territory. While big tech control over passkeys is certainly something that should be watched closely as we move forward, all signs currently are that the system will be relatively open to third party developers, including open source solutions.

That said, I have other concerns, especially when it comes to decentralized and self-hosted apps. The main problem is that passkeys don't offer any sort of an identity handle to use for granting access to someone who doesn't already have a passkey registered with your system. For example, if I have a self-hosted photo server, and I want to give a friend access to an album, I can simply grant access to friend@example.com. As long as they can prove they own that email address they can access the album. I'm not aware of any way to do this with passkeys. But big tech won't be equally affected. Google photos for example ties your passkey to your gmail address, so their users still get the convenience of semi-global user search and the extra security of passkeys.

IMO we need something more like Mozilla Persona that ties a global identifier such as an email address to a key pair. I'm curious if we could build a protocol around OpenPubkey[1] for this purpose. There may be a way to add this to passkeys but I suspect not given how tightly each passkey is tied to the domain it's created for.

[0] https://lastlogin.io/

[1] https://www.bastionzero.com/openpubkey

cratermoon• 3 years ago

the system will be relatively open to third party developers, including open source solutions.

Yes, it will be. Right up until it isn't. See e.g. RedHat, HashiCorp Terraform

dmd• 3 years ago

Side comment: "The ASCII ribbon campaign was an Internet phenomenon started in 1998 advocating that email be sent only in plain text"

When people say "plain text", they really mean "American English". When you rephrase it like that, it sounds a bit racist ... because it is.

hedora7• 3 years ago

Claiming the ASCII ribbon campaign was racist is neither technically correct nor practically correct.

There weren't any machines that supported ASCII directly that late in the game. Instead, everything supported DOS code pages. Those are supersets of ASCII, and those supported localization. This was often called "ASCII", since that's pronounced with fewer syllables.

On top of that, by 1998, mainstream systems were starting to support UTF-8, and, as a superset of ASCII, it was treated like "just another" plain-text format / extended ASCII code page by software user interfaces of the time.

Practically speaking, the campaign was against sending HTML (or, god forbid, RTF) emails. That doesn't preclude localization at all.

currymj• 3 years ago

the "ASCII ribbon" referred to a ribbon drawn as ASCII art, not an insistence that people use exclusively ASCII characters. Unicode is still plain text and supports any language you can think of, and also most languages you can't think of.

JohnFen4• 3 years ago

When people say "plain text", they really mean "American English"

No, when people say "plain text", they mean not HTML.

cchance3• 3 years ago

I mean... bitwarden has passkey support already, so your not really beholden to google/microsoft etc for storing and generating keys as well so your not just stuck to using the MS Windows or Apple storage :S

hedora7• 3 years ago

Bitwarden won't let you back up your passkeys though.

That's a second, equally fundamental, problem with passkeys (and it is their entire reason for existing; the whole concept of passkeys is flawed).

I wonder if the open source re-implementation of the vault protocol can export / import passkeys.

alyandon• 3 years ago

You can self-host Bitwarden via an open source implementation of the backend API called Vaultwarden and backup the data as often as you like.

snailmailman3• 3 years ago

They don’t currently but they say the feature is coming. All the passkey features in Bitwarden are very much half-baked at the moment as it is brand new.

On mobile you can’t even use the passkeys yet. They show up on mobile but no way to use them.

I hope Bitwarden finishes the features soon.

growse8• 3 years ago

Genuinely curious: what's the use case that's solved by being able to back up a passkey?

Why is it not solved by simply registering multiple passkeys for your account context? Is it just friction of having to set it up multiple times per account?

efitz• 3 years ago

I use a password manager that supports passkeys so overall I don’t care.

However, I have two gripes with passkeys: (1) the workflow for getting a passkey is all over the place; I wish it was more uniform, and (2) diagnosability is crap. The QR-code-approve-on-your-phone workflow has never once worked for me (Brave on MacOS + iPhone)

tptacek5• 3 years ago

This article states clearly the case for Passkeys: passwords are vulnerable to phishing attacks. Phishing attacks are effective, anti-phishing training doesn't work (even for technically savvy users), and hardware tokens are too cumbersome; meanwhile, people already have a capable second factor device they carry around, and it's silly not to use it.

I don't know how much HTML email really has to do with phishing (successful phishing attacks are multimodal and tend to exploit browser chrome as much as anything else), but regardless: it isn't going anywhere, and even if it were the primary cause of phishing, the engineering failure would still be in the authentication system, not in the email presentation system; being able to control a layout on a screen simply shouldn't result in account takeover.

Passwords are obsolete.

Lendal• 3 years ago

What? Just because passwords are flawed doesn't make passkeys the answer. The article does not say passwords are perfect. It says the current implementation of passkeys that has been created so far is worse.

lapcat5• 3 years ago

Phishing attacks are effective, anti-phishing training doesn't work (even for technically savvy users)

This is overstating the case. I've never been successfully phished. Many people have never been successfully phished. Yes, phishing exists, but it's not an excuse for big tech companies to take away all user freedom. "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."

I think passkeys are fine in concept — replacing passwords with site-specific cryptographic keypairs — but the demands of the big tech companies go too far above and beyond the basic concept. For example, here are statements from the person in charge of passkeys at Apple:

If you can drop a single device in a lake and lose your credential, it’s not a passkey. Passkeys are backed up and synced across your devices to deliver a great and safe user experience, while also eliminating phishing. If it’s device-bound, it’s not a passkey. :) https://hachyderm.io/@rmondello/111188643228872151
A reminder to attendees of Authenticate and people everywhere that “device-bound passkey” is an oxymoron. Passkeys are a phishing-resistant password replacement, usable by people of all levels of technical sophistication, built in to smartphones. If a credential is not resilient to device loss, and it doesn’t sync across devices, calling it a passkey will confuse your users who will expect a durable, resilient credential. https://hachyderm.io/@rmondello/111252067006418583

To me, these statements are both paternalistic and frightening. You have to understand what they mean by "synced" and "phishing-resistant". The big tech companies are taking these superfluous requirements to extreme. In essence, the attitude is that users can't be trusted with anything, and so users can't be given any control. This attitude is anathema to me.

All of my passwords are SSH keys are regularly backed up to multiple storage locations, including offsite. However, I take care of backups myself, manually. I don't use any cloud syncing service. I don't trust them, for a number of reasons, I don't want to use them at all. If I have to use a cloud sync service with my credentials, that's a nonstarter.

Moreover, as far as I can tell, when the big tech companies say "phishing-resistant", what they actually mean is that it should be impossible for the user to manually export and examine the private keys, because that would theoretically allow phishing. To my knowledge, FIDO still hasn't agreed on export/import methods, and it's very telling to me that they were willing to ship passkeys without this feature, which I would consider essential. My suspicion is that the "solution" they eventually come up with is some sort of "trusted" list of service providers, who can export/import between themselves without giving users direct access to the keys.

There are much bigger problems in the world than phishing. We can harm ourselves in so many ways: driving a car, riding a bike, crossing the street, smoking cigarettes, drinking alcohol, eating bad food, using a chainsaw, opening the front door for strangers, or any combination of the aforementioned. Thank god that cars aren't locked down yet, though I expect that "security professionals" will demand that it be done someday for our own good. Freedom is dangerous. Yes, freedom means that users can be phished. And it means that passwords can be lost. But the absence of freedom is even more dangerous, and I'll fight to the death to preserve my freedom.

tptacek5• 3 years ago

It is not overstating the case, I don't think. Large security teams have done population-level studies on this. You feel like "freedom means users can be phished". That's fine, private companies are going to make different choices on the freedom/security spectrum than you'd prefer.

throwawa14223• 3 years ago

The update at the bottom of the article is the most damning in my opinion. You can host your own, but unlike a password there is no promise that your self-hosted version will be compatible with a service.

0xjmp• 3 years ago

Hang on a sec.

Users don't have the same life experience as security people and sometimes a user simply do not know how to verify a link on e.g. his iPhone.

Later...

My password is mine. I control my password. I own my password. I am not dependent upon some third party closed proprietary operating system or device to handle my security. I would rather have a piece of paper with all my passwords written down, stored in a drawer at home

So the general public apparently lacks the ability to verify the url in an email, but _do not_ lack the ability to safely control their password? You completely ignore the ability of the site administrator to safely control your password by the way.

Altruistic as it may be to be anti-Big Tech, they are pushing the needle forward on cybersecurity. Looking at Apple, they invested millions into a special biometric device that ensures the fingerprint cannot be retrieved by *anyone*.

Also, I missed the part of this article where a quote was identified that hardware keys are for the entire population of the world? We do not roll keys out to every single employee - you're right about that. It's an interoperability nightmare. We do roll keys out to critical staff though. CEOs, COOs, high profile figures, critical service admins, etc. These folks are already trained and understand exactly why this initiative is so important; usually because they themselves have been targeted already.

Hardware keys are a great thing. I'm frankly getting really exhausted reading about how every new solution must be engineered to fit every single human of planet earth's needs. Its simply not designed with them in mind because they're simply not ready yet. It is what it is.

Nuclear power plants don't air gap controls because they hope the same system is used by Walmart down the street. They do it because their risk is... well... nuclear. Hardware keys in tech are no different.

alin23• 3 years ago

None of my relatives care about remembering passwords, not even those more technically inclined. They create the password, and 30 seconds later forget they even did such a thing.

Someone even lost access to their iPhone 8 because after replacing the screen, they got a "This device is locked". But they could not remember their iCloud email and password, they didn't need to remember it. The phone worked fine for years without it. Now it's a perfectly functioning phone, but locked and useless.

The difference between "account" and "email" is also lost on them. Not a week goes by before someone needs to access a new site they need to register, and I get the same:

    I already have this "gmail" thing, why do I need to create another gmail??

(because they have to use their email as the "username")

And this is the norm! Most devs creating these systems don't understand this.

A passkey sounds marvelous to me, it finally uses the thing that should be the password: the person itself. That is what a password should say after all:

    yes, this is me, the person that owns this account
    why do I need to tell you this mumbojumbo words and symbols to know that it's me? you have my face and finger data, match them please.

But that's only if it seamlessly supports biometrics like FaceID/TouchID/BrainwavesID-or-something, otherwise it will be just as useless.

jksflkjl3jk32• 3 years ago

you have my face and finger data, match them please.

No thanks. A kidnapper or the government also has access to my face and fingerprints. As tech changes, usable biometric data will likely be captured by 3rd parties from a distance as well.

I'll stick with something that I know and at least have some limited constitutional protection from being forced to divulge.

the_snooze4• 3 years ago

That's not what passkeys are though. The server isn't validating if you have a matching face. The server is only checking if you have the private key that corresponds to a public key registered to your account. The private key lives on your device, and may be encrypted under a PIN, password, or biometric. In all those cases, the decryption operation is strictly local.

Let's say some crook makes a convincing copy of your face. With passkeys, that's still not enough to log in. They have to have your private key too.

dangus• 3 years ago

My problem with passkeys is this:

I don’t understand how to use them.

My current workflow when I sign up for a website is to save my login and password to my password manager. This works across all platforms and browsers, and I use both Mac and Windows along with using both Safari and Firefox.

If I choose the passkey option Passkey stuff comes up on Safari and I’m 80% sure that means I can’t use that passkey with my PC? I don’t know how to make sure my passkey isn’t lost by switching devices.

Then what do I do if I use an embedded web browser like the one on a Steam Deck or Meta Quest? With my current workflow I can just reveal the credentials and type them in in a worst case scenario that my password manager can’t be installed on that device.

I have no idea what I am supposed to do, and this is even true despite the fact that I am aware that my chosen password manager supports passkeys.

If this is the learning curve the average person is supposed to contend with I am hesitant to migrate because something this difficult to figure out will never be mainstream.

I would welcome any of you to tell me how this is supposed to work.

Ringz2• 3 years ago

Good questions.

lowestdecks• 3 years ago

Passkeys are at the beginning stages of support both from the perspective of platforms (OSes, browsers, passkey/password managers) and websites. e.g., Firefox is still figuring out how to support passkeys from OSes and passkey/password managers (e.g. https://connect.mozilla.org/t5/ideas/support-webauthn-passke...) and will likely (this part is just speculation) support Firefox sync as a passkey manager eventually.

This is why there is no major website that is requiring users to drop passwords yet. Nor am I aware of any that allow users to even choose to drop passwords yet.

If I choose the passkey option Passkey stuff comes up on Safari and I’m 80% sure that means I can’t use that passkey with my PC? I don’t know how to make sure my passkey isn’t lost by switching devices.

If you're saving your passkeys to a credential manager (i.e. password & passkey manager), once there is support from Firefox and your credential manager of choice is plugged into any prerequisite APIs, you will be able to use your passkeys between Windows, Mac, iOS, Android, Safari, Firefox, etc.

Devices like Steam Deck, Meta Quest, smart TVs may require additional support added. I'm not super familiar with the platform, but Steam Deck should be fully capable of supporting passkeys through hybrid flow. If it is running a chromium browser and has Bluetooth support, it would be trivial to add support for hybrid flow with a phone as the authenticator (that is: the phone has the passkey and signs a challenge with Bluetooth assistance). Smart TVs already have in place methods to login using a local smart phone, tablet, or laptop (which would use the passkey). I can't speak for Meta Quest because I have literally no idea how that platform works.

---

As for the median user globally: the median global user has 1 device: their smartphone. Passkeys are so simple in that case. These users likely are not using any credential manager other than the one built in. Each of these major platforms (except maybe for some Chinese OSes that I'm not familiar with) already has recovery mechanisms in place for when users lose their device.

The next largest group has 2-5 devices, with basically all of them able to work just fine using the phone as a hybrid authenticator.

You are not a simple case. In fact, anyone that chooses to use a non-platform credential manager is not a simple case.

sys_64738• 3 years ago

What the heck is a passkey? I never understood the concept how it was different from passwords. Am I just dumb?

Are Passkeys the beginning of the end of passwords? I hope not

Related Stories