I don't like passkeys(hawksley.dev) |
I don't like passkeys(hawksley.dev) |
Password managers are great IMO, I can use some absurdly long password, backup is reliable, I can use them across devices. For extra secure stuff 2FA works the same, I've got an app with codes I can easily back up and use from multiple devices.
Passkeys tend to obscure everything and take away a lot of control.
so much better than fumbling around with a password managers
I don't know who designed this or who thinks these are acceptable affordances, but it seem to be part of the same disingenuous push that's behind passkeys in general.
The purpose of rotating passwords is to cycle out potentially compromised ones, due to phishing attacks, keyloggers, shoulder snoops, etc. But those cannot exist with a passkey.
Microsoft is especially poorly prepared for this - Often if you have a passkey, it will CONTINUE To ask you to create a passkey (a new and different one), and it may save it in a different place, which is infuriating.
Strong password + MFA is the way, and I don't see that changing.
If you think passkeys aren't ready yet, blame the people implementing it on their platforms.
Passkeys work nicely, and I'll use them, in cases where I want decent security, but I don't consider them the "Philosopher's Stone" of regular end-user security. I think they are still a bit too "fiddly" for your average Joe[line].
The author's assertion that the greatest risk to an individual is account lockout versus phishing or password harvesting is just not grounded in reality. I get phishing emails and SMSs daily. The criminal ecosystem running these campaigns is extremely active already and set to become even more so with LLMs. These campaigns are by far the biggest threat to normies.
Whereas account lockout happens most often with multiple failed password entries, which passkeys completely eliminate. I just don't know where this risk evaluation comes from.
The author also points out that even with passkeys, if you're able to also log in with e.g. security questions, you still have a much weaker security footprint for that account. This is true, but it's also true of a TOTP second factor. So I'm not sure what the criticism is here.
The exportability argument is a real weakness and something I'd like to see addressed. Passkeys don't have an equivalent for backup TOTP codes that you can just write down somewhere or trivially store yourself. But it probably wasn't in v1 because the people who designed passkeys figured that websites would not go all in on them immediately and would preserve other authentication methods, which is exactly what's happened.
Of course, at the rate we see security failures everywhere, I'm not entirely convinced writing your passwords on post-it notes wasn't such a bad idea after all.
It's entirely one sided solution.
Like, no company should be storing anything but a salted hash of their users' passwords.
They provide crappy usability, they're expensive, they're easy to lose, you can't use the physical keys when doing remote desktop access.
My job requires me to use them. I use only for the job and nothing else. For sites requiring 2FA, I use TOTP (time-based one time passwords) from KeePassXC.
And why do the OSes push for this so hard? Because the goal of the execs is lock-in and control. And their lackeys here on HN who implement this stuff and their families are the 1% who are all-in on one ecosystem so they arrogantly believe "this all works great and the masses are just too stupid to get it".
1. Write it down on a piece of paper and put it in a safe deposit box.
2. Read it on one device (or from a piece of paper!) and enter it manually on another device.
Plain text is the ultimate form of cross-platform portability. Passkeys are the ultimate form of vendor lockdown. The passkey vendors won't even allow you to view the private key, unlike with ssh keys, which you can also write down on a piece of paper. It's vendor cabal to destroy computing freedom in the name of "security", always the excuse. Tech company paternalism at its worst.
If passkeys were meant to be user friendly then there'd be a secure optical transfer mode to QR code them from device to device with the screen and camera.
Easy to implement (receiver flashes a public key, sender encrypts to that key and flashes the QR code back).
That it doesn't exist for a protocol meant to work with phones tells you exactly where the thinking was headed.
I can see why they would be problematic for people who otherwise live life with a single love2025 password though.
1Password everywhere, on iOS, Mac, and Windows. I’ve run into none of the issues elsewhere in the comments. Everything just works, including in-app logins.
Maybe your other password managers are just bad at implementing the right browser/OS hooks?
As many USB-security keys can be used passkeys.
As someone who's OpSec puts swiss cheese to shame Passkey has been a godsend. My passwords are actually much better because of it.
I also don’t love how many websites and apps use them in stupid ways like using them alongside other 2FA or login methods when the passkey alone should be sufficient.
My gripe with passkeys is they are almost always implemented without a second factor.
You’ve mentioned the rare case of 2FA with a passkey as being a bad thing, but in my opinion those few cases are actually doing it RIGHT.
With passwords and 2FA, if someone manages to copy your primary authenticator (password) they will still be locked out because they don’t have your secondary authenticator. This protects you against malware that steals your password database.
But the way most companies implement passkeys (single auth), if someone steals your passkey database they can use it immediately. For all of the true measurable benefits that passkeys bring (not memorizable, higher entropy, automatic storage and use in a database) they are almost always used in a way that has this huge drawback: no 2FA.
This is not an issue with passkeys directly, it’s an issue with how services implement passkeys.
It should always have remained a second factor device. It’s not impossible to teach people to use these, European banking did it for years. There’s just no will to do it.
Under this scenario, the first factor can be a short password or even a PIN.
I have physical passkeys, one attached to my keys and another on my desk at home and I absolutely hate software based passkeys. Every single time I'm asked for a passkey it always ask me if I want to use my Apple Keychain first and I wish I could default to physical.
> Phishing through the standard login flow is eliminated by passkeys, but it creates a false sense of security. An account’s security is still dictated by the weakest recovery method: SMS, email links, security questions, and so on.
Passkeys are too strong and may cause account loss.
Passkeys are too weak and can be bypassed by account recovery.
As a service provider myself, I've evaluated and said "Nah" to passkeys - because it's simply increased Customer Service contacts I have to invest in, whenever a user changes or loses devices, or any of the hundreds of ways Passkeys are not portable.
And guess what, the Tech companies pushing this have zero liability for user login support or security breaches. It's always me. There is no need for me to work hard and spend CS contacts, to wall off my users to the OS or Browser vendor.
I'll simply do passwordless Email or SMS 2FA / Magic Links and own my users without the overhead of Customer contacts, thank you.
It most definitely isn't. Any 2nd factor that is not the device I am currently using (either a yubikey or my phone) has a non-zero chance of not being near me when I need it, leading to the constant question of "where the fuck did I put that darn thing", only to find out that the cat has decided to believe the yubikey is a mouse and tried to devour it, the phone's battery went dead...
They didn't want to cooperate, and they wanted to make passkeys transferable within you cloud account, while not cooperating with anyone or anything else. The result was that you have no predictable and stable pattern/protocol/interface, or even general description, for how, for instance, a website connects to the passkey or even a hardware key, if you wanted it.
We basically have all the browsers, the operating systems, and the password managers, all fighting over who gets to store and present the passkey. And everybody assumes that they are the only one that exists and actively tries to fight the others is they can.
The basic technology is really good and could work well, but the large asshole tech firms focused on self-interest and walled gardens and made it insufferable.
That said, I don't like passkeys either.
(Or since syncing passkeys usually works within ecosystems, you might just need a passkey per OS.)
<sarcasm>On the plus side, this way passkeys can also be tied to age/identity verification.</sarcasm>
Ideally optionally followed by a 2FA (naturally, via text, delivered straight to my Mac, even further diluting the questionable security of the whole exercise) and naturally, to be repeated every 2 days or so, since "stay logged in" is the biggest lie after "I've read and accepted the ToS".
Your phone (which is probably what, 80% of relevant traffic these days?) likely has a perfectly fine password manager built in. This "sign in via email" trend must be every scammer and phishers biggest dream come true...
I am looking at a new project that uses magic links sent by texts. I have been there and done that with authentication systems and that's good enough for a low stakes ludic activity.
Website problems:
* First big problem: you try to kludge them as an "add-on" to a password or SMS "2fa". Just rip the band aide off and let people go 100% passkey by default. It's actually really easy for users. We do a push at the end of their onboarding flow and have a 95% conversion. Users love it and its seamless.
* Don't make people enter a username. Just have a "login with passkey" button first, and thats it. If the HIPPO in your organizations insists a username-password still be available, make the user navigate to a secondary page first to do so. Make the passkey the first-class citizen.
Password Manager problems:
* Google, Apple, Microsoft are trying to lock people in to proprietary password managers. Microsoft's password manager, plus their "microsoft account" experience is a steaming pile of shit. The key here would be portability. An export format exists for the public key (thats how enrollment works): It's a but of digits in ANSI X9.62 format. Not hard. The private key would be an unbelievably simple export.
Protocol problems, and I'm happy to be wrong here:
* The client does not sign the server issued nonce (aka the 'challenge') during the authentication flow. This is kinda weird IMHO. Technically, yes it is secure, but it relies solely on the TLS channel heuristics. It'd be much better to have the client prove the signature on enrollment as layered security.
To address the author fears on attestation: This is a real threat to users... imagine a website "only accepting passkeys from OUR password manager". Luckily, Apple has done us all a favor and outright killed that part of the protocol by refusing to send this required fields there, protecting all users.
Overall, you should use them. We need one tiny change to the protocol and better password managers.
People have replied it's possible to extract the private key, but it's not clear to me that that's usable (maybe it is I don't know). It's certainly not in line with what passkey devs want people to do and not do, so I'm not interested in "fighting" against the "flow" so to speak.
I'm happy with TOTP, as I can manage and use the codes where I want, under my control.
Probably hundreds of millions or even billion people have devices that support biometric auth. How is that not mature?
Brilliant security: a highly secure high-tech shiny front door that can randomly fail to open, so you still need the low-tech back door, which is the one potential thieves will use.
Mind you, it can work if the back door is old but sturdy (basically, for a bank that will ask for KYC authentication, or in the worst case you can set foot in the brick-and-mortar branch showing your face and ID and ask for access) but for pretty much every other service it introduces risks for very little or no gain.
Like, seriously?
If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport). iOS and Android support this, and it’s generally not a locked-down thing if other devices wanted to do it too.
The only use case left is in “how do I login if all my devices are stolen/fall into a body of water” in which there really isn’t an answer beyond “get (a|your) device back, sign back into your password manager, use that to get back into critical accounts”.
They're cheap enough if you lose one it's not the end of the world. Goes on your keyring. Doesn't require esim management. Use NFC swipe/usb-plug-in + pin to use.
Sad reality is that such usecase is less and less common, thus, no one cares about it. I think majority of my friends would not be able to access their email, or facebook or alike, if they were forced to use my computer in emergency.
I've definitely done this, but not sure if the workflow was at the OS or browser level.
I'm honestly confused by all the negativity in the comments. Passkeys are great for convenience. Just leave your password login enabled as a backup. That defeats any security benefit, but oh well.
Some password managers will only fill if a domain matches, but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in. I've also seen lots of them do stuff like happily autofill on any prefix of the domain, so your credential for `something.example.com` will autofill into `fake-something.example.com`.
Same thing is going to happen with passkeys for non-technical users for exactly the same reason you stated. People will think the integration is busted and manually copy/paste the non-passkey credentials in. In that way, I would argue that passkey is not stronger protection against phishing attacks unless its the only way to login. It is, at best, a convenience for users.
Why would you trust the very same password managers that don't handle passwords properly to handle passkeys properly?
I've seen people do this AFK as well, and I'm always helpfully suggesting them the correct way of solving this: verifying the URL again, and if correct, add it to the password manager so it remembers in the future, and never copy-paste passwords on the web. Basically 50/50 if they take the advice or come back after a week asking if it's safe to copy-paste the password into the website, and I try to inform again.
Shockingly, I saw one developer peer copy-pasting a password into a website, but I guess for these people there is no hope.
No doubt there exist services that do not offer recovery method for passkey or mfa enabled account. But this is entirely on them (the service), to blame for, not the passkeys or the users. It’s bad implementation.
Oh well.
Passkeys have been a massive quality-of-life improvement. Yes, there's the minimal risk of lockout if you lose access to the passkey (though almost every site I've used that implements pk's lays it on top of their traditional user/pass auth flow), but generally speaking most people use iCloud or their Google account to store their passkeys, and because those sync everywhere, this isn't a real risk.
I love not needing to deal with 1Password's autofill being flakey and having to CMD-C/CMD-V passwords/passphrases/OTPs on these sites.
I like Yubikeys as well but they are super inconvenient by comparison when dealing with multiple devices. Setting them up is also very user-unfriendly in general; doubly so compared to passkeys.
Now, what I'd REALLY F'IN LOVE to see go away is the passwordless/magic link auth flow wherein you authenticate by clicking a magic link that gets sent to your email or text message inbox.
"Emails are super easy to hack and we're still not sure whether text messages are safe to send on US carriers, so let's have everyone click on a link sent by email or text so that they don't have to deal with those pesky passwords that iOS or Android will automatically suggest for them." Like, what?
Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.
And the confusing mechanism hurts there too: I'm always a little bit afraid that i'm somehow more in danger because I keep them in a vault that's shared on all my devices rather than a TPM, because whenever the protocol is explained the "it can't leave your device" part is highlighted as the main source of the security, except.... mine obviously do leave my device, with the vault, so.....
Sites can request hardware-bound tokens, which would block any software based password managers. It's an option in the protocol but one not yet widely utilized.
It should not be in the protocol. And I don't trust Apple and Google not to lock it away from me.
I want my own open source manager and if that is attempted I want it to lie about it.
What setup are you using? Because I don't have that problem on Linux + Firefox at all
And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".
Passwords with 2FA are simply better and more freedom friendly.
The reason is the ever increasing number of hijacks of social media presences and code hosting portals, with the latter being a serious financial threat. Done right, passkeys stay in the Secure Enclave, at least for anything Apple and most of the Android sphere. There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
Passkeys could be the savior of all security problems worldwide from a capability point of view and tech companies would still ruin it by trying to force ways it pushes you into their ecosystem instead of just being whats both secure and convenient.
As an example, I have 3 different passkey APPS on my phone and cannot go down to one because of various reasons with each (e.g. MS authenticator forced for work).
Click "I lost my device", enter contact, get a reset link via email/sms
The same is true for passwords with a password manager.
> If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details.
Also not really a problem with randomly generated site-specific passwords in a password manager.
Really all the browser vendors had to do was add an API to make automatically generate a password that is then stored in the user's password manager the low friction option.
My annoyance with the prompts is not evenly spread over the sites I use, it just so happens the same sites that think short login periods = security (it does not) are also the same sites that think passkeys are the best thing since sliced bread.
I have such a low opinion of any company that logs me out every time I turn around and those are the same disrespectful companies that think it's appropriate to spam me with passkey requests when I login. My dislike also extends to those companies they have a "Remember me" or "Remember this choice" checkbox that is decorative, as in it doesn't do anything. Often paired with clicking external links in things like a banking website "Warning: You are leaving this site!", yeah, I know how the internet works, I don't need to be babied by a completely ineffectual dialog (if you think normies are reading that and not just clicking through, you are living in a fantasy world).
<<ducks>>
But for regular end users where services are primarily motivated to take money from those users and lock them into their ecosystems, they are a usability disaster and yet another exploitation vector.
It's one solution for two very different usecases, and it just does not work. There is an approach that could work for end users who own their own accounts, but they need to go back to the drawing board and rewrite the protocol with the assumption that the keystore is hostile to the user's interests. That means strong guarantees on key portability so users can migrate away from hostile keystores, and absolutely no ability for services to restrict the user's choice in passkey provider software.
Sure they work fine on a technical level, but they're frustrating and confusing for the vast majority of people I know.
I worry I am going to get locked out of my Google account, muggles don't. Doesn't stop them from getting locked out.
Apple has a vision where you have an iPhone and a mac at home and a mac at work and a vision pro and an Apple TV and all of that and your passcodes "just work". Doesn't work for the "rest of us", like we're already used to AirPods punishing us for using Windows.
The only part that is very persuasive is the part about storing your passkeys with Google or Apple integrations, and what happens if they ban your account. But the same argument would apply if you’re only storing your passwords in a Google or Apple password manager.
I use passkeys and I always store them in a password manager I control - but usually I also store another one in the OS on Windows, Apple, and Google. Best of all worlds. Also, I appreciate that idiots aren’t forcing me to “change my passkeys” every 90 months like they STILL do with passwords!
Their security is nearly universally undermined by reset mechanisms.
There are virtually no sites where passkeys cannot be bypassed.
Same as traditional physical keys, you don't have a single key, you have multiple ones precisely so that if you lose/break one, you are not stuck and can go to the local locksmith and get another one in minutes.
In fact it's even nicer since you can just re-use the backup key with no security loss by revoking the other one, and buying another key.
(At least til I get around to setting up my new usb c yubikeys!)
I actually prefer non-resident U2F in some ways. You don't have to store anything on your key, you are just signing requests. This is relevant where U2F/FIDO keys have limited slots for 'resident' keys.
In principle, it's great. You have one good password to remember for the average user, and that's enforced by their device's probably good enough security posture.
They are resistant to being phished and they won't reuse the same one everywhere. They then don't end up going from hunter2 to hunter2! everywhere.
But my experience for users is that they worry they are giving their biometrics to Amazon or whoever and so the UX just confuses them.
The certification aspect was new to me too last time passkeys came up. Sites can require that a given passkey has been certified.
The patchy support for them is also frustrating. MacOS does not support NFC FIDO/U2F. iOS does.
Very odd. I use passkeys extensively with BitWarden and I love it to the point where it's my preferred way of securing things at this point.
The fact that the website presents the question to BitWarden in a structured way (what website, what username) means that I never fight with selecting the right account to get the password for (because I commonly have multiple accounts for a single site) and it generally makes the login flow much smoother.
Environment is MacOS with Brave/Firefox + iOS.
But they also introduce single points of failure, as the article points out. I can't even remember how many times I've had to help a family member recover their account or get confused when they can't sign in on a new device. It's incredibly frustrating that this flow is promoted as the default for so many services.
1password is the best solution I've found for the average person. It's not perfect (it's definitely more complex than writing down your passwords on a piece of paper or using the same password everywhere) but it's much easier than juggling yubikeys. I know so many non-technical staff members who prefer the OS or browser keys even if it means another account recovery is lurking around the corner.
I proposed an alternative scheme many years ago: https://www.researchgate.net/publication/343318317_Privacy-a... . By allowing "offline" keys you can also treat them as higher priority, and use them to revoke any lesser keys from attackers if your account is compromised.
It would also be nicer to get rid of usernames, but that's a fight against the data-gathering powers that we're unlikely to win.
If the browser supports them and stores them securely you're safe as houses even in a breach.
0 intermediary yet proper and convenient authentication. If that friend ate the key (which he didn't) I'd just use my backup key, a cheaper non biometric one.
I think it's not more popular because people don't care enough about security to buy actual keys, rely instead of 3rd parties that they don't actually trust, e.g. Microsoft, Google, etc then... complain it's not good enough.
It wanted me to log in for some reason even though it had worked fine for months. Login uses my Google log in.
When I try that, Google asks me for a hardware key to complete the login, even though it's my phone and I'm already logged in.
Eventually I figured out that if you select "log in using another device" and then click cancel when it brings up the qr code, you can select a push notification on "another device", which actually pops up on the same device. Do that once and it fails. Do it a second time and it succeeds.
All to use the tailscale app on my own phone.
Passkeys just make it harder/riskier.
This is, in my opinion, the most serious problem with passkeys. I'd like to adopt them, but this is a blocker.
there's some issues with passkeys, but not being able to memorize them is a feature
My bigger problem with passkeys is how there's no universal way to register more than one device (in case the first one is lost).
Tada, passkeys.
To your point, I for example would add point c) - Is linked to the device you are using currently. If you want to use another device to log in you are in a world of complexity and pain.
Ironically on macOS we used to have an app called Keychain which unfortunately was effectively renamed to Passwords for non-technical users.
Unlike physical objects they may reside in a TPM, a software vault, an export/backup, or any combination thereof. You may or may not be able to recover or migrate them, depending on where/how they were made.
Therefore you may need multiple per service, or maybe not. Services which only allow one may end up locking you out with no recourse. You get to find out.
None of this is obvious or self explanatory to normies.
I always operated under the assumption that the passwords app was just a more casual view into the keychain
Maybe that's a bad assumption
Logging into a site with your device is like putting your card into the terminal. The site can ask for a password the way the terminal asks for a PIN, but if your device supports Passkeys, that’s like your card having a chip, and it’ll use that instead.
So think of Passkeys like using a chip card.
I dunno how well this analogy works down to the last detail but it has gotten it across to all the parents I’ve used it with
That's a pain point in everyone's day that should make the benefit easy to understand.
Sure, its explained. But not in a satisfactory way that would reach all users at their level.
This is a bit of an exaggeration and out of proportion, but I think my ideal would be one of the big tech companies should have bought out something like a super bowl ad. Something that actually conveys the idea "hey, we know you've used passwords since you were able to type on a keyboard, but here's new technology that's better and here's why" in plain language that the average person can understand.
Unfortunately, XKCD 2501 continues to be relevant. [1]
If it's that unclear to me, I can't imagine how it can be to the average user.
The way they explain them is atrociously unclear, borderline negligent for services that nag people to activate it for accounts where they may hold valuable data for their personal lives. And while I don't want to spend much time finding out the details as long as I have the option to decline them, I suppose if they can't explain it and convince people of its advantages, it's because it's just bad tech.
I'm not sure why you're making a distinction. In many cases the browser is the password manager.
Password managers have had to be permissive enough to work with most websites, and there is no standard for it. There have been sites that blocked the autofilling of passwords and so on as well.
My point wasn't this one particular flaw in some password managers is the reason to use passkeys (the copy/paste point is the much bigger issue anyway), just that it's an example of how relatively brittle the password manager process is. Having it a core part of the spec gives stronger guarantees.
Gell-Mann amnesia effect
https://en.wikipedia.org/wiki/Michael_Crichton#%22Gell-Mann_...
Historically I've seen lots of sites do a subdomain shuffle for login pages every now and then which routinely breaks domain matching, introducing false positives that users have to deal with, making them numb to the threat too. Passkeys baking in the domain check with no workaround means that sites can't do that, which is a benefit.
For the average user, which doesn’t use a password manager, this is great. It means they can’t get phished. And it’s also great for the average password manager user, who keeps dozens of insecure and reused passwords in their vault because they manually thought of a password when signing up instead of randomly generating one.
If you’re already using a password manager and random passwords, the UX is designed to be the same. It’s just a way to get regular people to do this.
same ux, different security properties.
>Except that at least I can memorize a password by heart just in case.
"just in case" should be a thought out recovery flow, rather than hoping that you remember the password of the account you need to access.
I’d buy that there are too many different confusing ways to recover from this situation, but not that it’s impossible
Proton Pass is a specific way to do that, but not a universal way. Bitwarden can't use proton pass to move keys around, google can't, firefox can't.
Are you part of the 99.99999% users of one of iOS+Apple or Androidlike+Google/Tencent or HarmonyOS+Huawei? If that's the case, you don't need to as the key is automagically saved by your OS' platform and synced with your new device.
Otherwise, you're such an extreme outlier that you probably either know what you're doing or can find out by yourself, right?
Passkeys really are not any more difficult to explain than 2-factor authentication. Anyone who’s currently been able to actually create an Apple or Google account and successfully navigate their devices up to a passkey screen will be able to grok how it works.
People around here really ought to stop thinking users are complete idiots. Hell, you don’t even to scroll that far to read people calling users “normies” for crying out loud. What is this? High school?
I suspect that most people that ostensibly do this actually only enroll one for non-critical accounts and then depend on some fallback mechanism.
I assume the QR code contains a token for the device, which is used by the app to authorize the login and the server automatically logs in the client on the device with the matching token.
Seems a lot safer to me than using my login credentials on a potentially unsafe device.
These may seem like nitpicks, but there's probably a thousand rare scenarios like these that exist. You inevitably have to consider them when you're moving from punching in letters and numbers that you remember in the normal, low-tech way to a complex networked two-device workflow.
The number of people sharing GP's concerns for reasons of poverty rather than because of their personal security posture will be vanishingly small.