Products · Product
WebAuthn
Raised as a usability problem by 28 people on Hacker News over 7 years (2018–2024), in 26 threads.
No issue was raised by at least 3 people in 3 threads this year.
- 1
- 2
Every issue, all time, most people first
Losing a hardware key locks users out of recoveryUnreviewed
20182026- Losing the hardware key locks people out of buying a replacement and recovering accounts2023-02-15
- Losing a physical key means being locked out of accounts, since keys cannot be backed up2022-11-26
- Revoking a lost key means separately de-registering it on every provider, which is a pain and risky2022-10-14
Browsers and OSes handle WebAuthn differently, forcing workaroundsUnreviewed
20182026- No simple way for sites to start using WebAuthn; users lack a local authenticator2023-05-03
- Commenter believes WebAuthn is impossible to use without specific big-company devices and browsers2023-04-23
- Developers struggle to understand how to use WebAuthn correctly and find the API awkward2023-01-18
Users find it hard to manage security keysUnreviewed
20182026- Hard for users to manage security keys right now2022-07-14
- Security key is hard to keep within reach and its button interaction is hard to remember2021-01-17
- Security keys are hard to use in practice; the commenter says the flow is impractical and makes them doomed2020-05-23
Unreviewed issues were grouped by machine: Claude Haiku labelled each comment as a usability complaint, named what it's about and summed up the problem in a line, and a small model grouped similar problems. Nobody has checked them by hand. Expect mistakes.
The newest 35 complaints
- Authentication is annoying to use in practice2024-12-27
- Relying parties force resident keys and stack WebAuthn on existing second factors, making login user-hostile2024-12-27
- Software passkeys are gated behind dev tools and keys are hard to back up or restore2024-12-27
- Users stuck with no way to proceed when a site URL mismatches2024-05-24
- Confusing prompt choices leave average users unsure how to register2023-09-02
- Losing a phone leaves unclear steps to replace the device and regain access2023-07-02
- Registered WebAuthn devices vanish, and deleting them is painful or requires the command line2023-06-06
- No simple way for sites to start using WebAuthn; users lack a local authenticator2023-05-03
- Browser-managed keypair UX is horrible and keys can't easily be shared across devices2023-05-01
- Desktop users get QR code sign-in by default, which makes no sense for desktop use2023-04-24
- Security key option and QR code phone sign-in shown by default, forcing unwanted choices2023-04-24
- Prompts to scan QR codes and endless popups confuse users during account creation2023-04-24
- Too many ways to implement it; users still need email/password account setup2023-04-23
- Unclear how to add a new device's key to an account2023-04-23
- Commenter believes WebAuthn is impossible to use without specific big-company devices and browsers2023-04-23
- Losing the hardware key locks people out of buying a replacement and recovering accounts2023-02-15
- Implementing it is complicated, quirky, and hard to restrict which login options users see2023-01-19
- WebAuthn UX is a disaster with scary dialogs, unlike simple LastPass YubiKey prompt2023-01-19
- Developers struggle to understand how to use WebAuthn correctly and find the API awkward2023-01-18
- Losing a physical key means being locked out of accounts, since keys cannot be backed up2022-11-26
- Revoking a lost key means separately de-registering it on every provider, which is a pain and risky2022-10-14
- Hard for non-technical people to use, so they work around the security measures2022-09-23
- Hard for users to manage security keys right now2022-07-14
- Adding a second authenticator for every account is tedious and migrating devices means repeating it per account2022-06-23
- Forced click-to-consent before PIN entry, with no bypass, wastes people's time and breaks login flows2022-05-10
- Browsers and OSes handle WebAuthn differently, forcing developers into workarounds for decent UX2022-04-26
- Windows Hello silently overrides hardware keys, so registration behaves differently across platforms2022-04-26
- Hard for developers to configure RP ID and origins; works on localhost but fails when deployed2022-02-05
- Cannot register several security keys at once, so each must be added separately to every service2021-09-27
- Losing the key makes account recovery terrible, sometimes requiring an in-person office visit2021-02-13
- Security key is hard to keep within reach and its button interaction is hard to remember2021-01-17
- Login prompt appears on Touch Bar, which users miss with external monitor2020-10-20
- Security keys are hard to use in practice; the commenter says the flow is impractical and makes them doomed2020-05-23
- Firefox prompt only offers Cancel, so the user can't tell how to proceed2020-01-05
- Browser key-based authentication feels too complicated for most users, so they avoid it2018-08-21