Top all-time · #4892
Corbado
Company blog · corbado.com/blog · on HN as vdelitzsecurityweb
Corbado is the company blog at corbado.com, writing about security and web. Since 2023, 16 different Hacker News readers have linked it 37 times, most often “Passkey Implementation: Misconceptions, pitfalls and unknown unknowns”. No feed was found, so read it on the site itself.
Too few sampled comments (9) to say how often HN recommends it.?
Why HN links it
Corbado's blog covers passkeys and WebAuthn: QR-code hybrid transport, passkey syncing, iOS and Safari support, and implementation pitfalls. Commenters link these posts as sources or background, without judging them.
Summarised by Claude from a sample of 9 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
See what's breaking logins across every authentication method and scale passkeys across millions of users without replacing your IDP.
Most-linked posts?
- Passkey Implementation: Misconceptions, pitfalls and unknown unknowns2 people · 2 mentions · first linked 2024-04-30
- /2 people · 2 mentions · first linked 2023-05-20
- KeePassXC's new passkey support reviewed2 people · 2 mentions · first linked 2024-01-31
What Hacker News says?
Yes, its called "hybrid transport", and its a flow where a laptop presents a QR code to a mobile phone, who then sets up a BLE connection for one time use of the passkey. https://www.corbado.com/blog/webauthn-passkey-qr-code (Not sure how the "cloud assisted" part of caBLE works)
Comment linking /blog/webauthn-passkey-qr-code
on “Microsoft Confirms Password Deletion for 1B Users”Submitted Passkey Implementation: Misconceptions, pitfalls and unknown unknowns as a story · 184 points
HN discussionPassKeys are definitely the future, they aren't just device-specific, they can be synced also. https://www.corbado.com/blog/nist-passkeys talks about this, though I'll admit I haven't read anything on the subject yet. But I can say that most implementations of PassKeys seem to cloud sync, including 1Password, Apple, Google, Edge, etc. I should also add that PassKeys that are tied to devices are like FIDO2 security k…
Comment linking /blog/nist-passkeys
on “OpenAUTH: Universal, standards-based auth provider”Submitted We moved away from web components – learnings from a Component-First DevTool as a story · 6 points
HN discussionI'm pretty sure Safari supports it since iOS 18! See for example https://www.corbado.com/blog/ios-18-passkeys-automatic-passk... and https://www.corbado.com/blog/passkeys-prf-webauthn .
Comment linking /blog/passkeys-prf-webauthn
on “Encrypting files with passkeys and age”Submitted Don't implement passkeys. Five Day 2 issues explained as a story · 5 points
HN discussionclearly biased: https://corbado.com
Comment linking /
on “Ask HN: What type of Auth are you using on your side projects?”Submitted Revolution: Google Password Manager Syncs Passkeys to Apple and Windows Devices as a story · 4 points
HN discussionThird-party passkey providers got added with iOS 17. https://www.corbado.com/blog/apple-passkeys-integration
Comment linking /blog/apple-passkeys-integration
on “Google announces passwordless by default: Make the switch to passkeys”Submitted WebAuthn Conditional UI (Passkeys Autofill) Technical Explanation as a story · 3 points
HN discussionyou could also take at look at what we're building at Corbado (passkey-first authentication): https://www.corbado.com
Comment linking /
on “Okta Says Hackers Stole Data for All Customer Support Users”Submitted KeePassXC Passkeys: Analysis of Sign-Ups and Logins as a story · 3 points
HN discussionThere are some parts of this that are correct and other parts that are incorrect: >1. The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing). This is incorrect. The idea was to provide a phishing resistant primary factor that could compete with the usability of passwords to the point that consumers would actually want to adopt it. >2…
Comment linking /blog/webauthn-passkey-qr-code
on “Passkeys were invented by engineers with zero understanding of consumer brain”Submitted Why Consumer Authentication Is Broken as a story · 3 points
HN discussionNot an endorsement (haven't read it fully!) but this article goes into some of the difficulties with implementation: https://www.corbado.com/blog/passkey-implementation-pitfalls... The #1 issue as far as I'm aware is that there's no good story around portability. It sounds like using Passkey equals vendor lock-in right now. Idk how representative this is, but there's been some criticism recently, and the response fr…
Comment linking /blog/passkey-implementation-pitfalls-misconceptions-unknowns
on “About Passkey – the password-free tech Apple is betting on”Submitted Coinbase's Smart Wallet Security Flaws as a story · 3 points
HN discussionThis is covered by the cross-platform scenario. It's not super elegant, although I'd say it's easier than typing 100+ random characters (and also trusting that the locked down device doesn't have any key logging?). Lots of providers have their own FAQ, but here's one: https://www.corbado.com/passkeys/faq#:~:text=Passkeys%20have... .
Comment linking /passkeys/faq
on “Are Passkeys the beginning of the end of passwords? I certainly hope not”Submitted B2C Authentication Is Broken: Here's Why as a story · 3 points
HN discussionIf your a developer, you would probably want to minimize setup time with sth like https://corbado.com
Comment linking /
on “Understanding Passkeys”Submitted Passkeys Cheat Sheet for Developers as a story · 3 points
HN discussionYou could check out what we're building at https://www.corbado.com . It's passkey-first / passwordless authentication solution. Technically, it's based on HTML5 web components which are framework-agnostic and work perfectly with vanilla JS. Maybe it's useful in your case.
Comment linking /
on “Ask HN: Looking for alternatives to auth0 and clerk (user login services)”Submitted KeePassXC's new passkey support reviewed as a story · 3 points
HN discussionCould you switch to just using passkeys instead of Google, Apple, or Facebook federated identity? This eliminates the risk of storing passwords, and also doesn't create a dependency on one of the companies mentioned. You'll still need to store username, email, or both, depending on your use case. You can also create a code path that will transition accounts from federated identity to self hosted with passkeys as wel…
Comment linking /blog/user-transition-passkeys-expert-strategies
on “Ask HN: Is “sign in with Facebook” dead for indie developers?”Submitted Amazon Passkeys Launched: Response to Consumer Demand with Poor Implementation as a story · 3 points
HN discussionSubmitted Google Passkeys Flows Analyzed as a story · 3 points
HN discussionSubmitted Why passkey sign-in success rate is much lower than many companies pretend as a story · 2 points
HN discussionSubmitted >80% of devices are passkey-ready (2023) as a story · 2 points
HN discussionSubmitted Passkey Benchmark 2026: 97-99% mobile readiness, but adoption still stalls as a story · 1 points
HN discussionSubmitted Hardware passkeys are winning on security, losing on adoption as a story · 1 points
HN discussionSubmitted Why your 2-week passkey sprint will turn into 6 months as a story · 1 points
HN discussion
