Technology

This article does a great job of articulating a lot of the uncomfortableness I have around passkeys. I've always said they make a lot more sense in an corporate environment but the level of control you lose in a personal setting is not commensurate with the protections and possible lock-in they offer.

I just don't like passkeys. They are an overly technical solution to what is mostly a human problem.

Sadly did not dig into the whole "the other side decides which device you are allowed to use" topic, a feature inherently build into passkeys.

I think their biggest weakness is the vendor lock in. Using a 3rd party password manager is the best solution for most people, so they arent locked to their phone. But they are right in saying none of it is quite ready.

I think the article is forgetting, they are password replacements, not account recovery replacements. Realistically, people are just as likely to forget a password, and account recovery proceedures still have to be in place. I dont see the issue there.

Passkeys are good they are just being pushed before properly fully developed, but we are slowly getting there.

For users who previously reused passwords across all their sites, passkeys are a huge step-up.

That is exactly why passkeys are a good thing. Basically everyone reused passwords everywhere.

Good article.

Currently passkeys are too much of a vendor lock-in to big tech.

Bitwarden support alone does not change that.

There is still nothing better than passwords.

I don't want my access to be tied to a specific device. Devices get lost, or break.

I don't want someone to be able to use my face or finger or eyeball to access my data. You can legally be compelled to unlock a device with your biometric security.

So current biometric security sucks. And passkeys suck.

Also, though...passwords suck for all the reasons that we all already know.

There has to be some better method that the owner can have full agency over, I just don't know what. I don't have the answers.

I really wish that SQRL had taken off, as it solved most of the problems noted. It was effectively passkeys that you generated on the fly based on your private key (which you can back up and restore to other platforms if necessary) and the website domain by scanning a QR code (or clicking rh QR code if your on the same device) and sends the signed challenge to the website to auth you.

No need to login to your manager on random systems, no issues with platform lock-in, no worries about dedicated hardware, no worry about losing your access if your device dies (assuming you backup your shit).

Love them.

Using 1Password for sync.

Never ever failed to connect to QR code passkey request, even on weird corporate networks.

Portability has gotten so much better - there’s now a defined standard for portability that passkey providers are implementing.

Honestly I cannot understand the criticism at all.

I am using my password manager, which is keepass.

I have tried adding pass keys to it, and have had mixed success. On some websites, it seems to work fine, and then on others, it seems to break miserably, and made me return back to a password.

I like the idea of passkeys, because then you don't have a shared secret between you and the website, and you get a different key for every single website using public-private key cryptography. That's fantastic, but the implementation still needs some work.

You know what u don’t like. Fucking xøcode sent to my email or a «magic link».

Srsly fuck off. Let me type my password

I don't know that OP is wrong per-se, but I think they're overstated a bit.

Their statement that passkeys are better than people using the same password, but are a step back for people using a password manager, is maybe a bit much. It's basically the same, but sometimes better.

Most of their drawbacks are the hardware implementations, but that's already true of people using hardware 2FA, and corporate management, which is already a problem if you use Apple's or Google's existing baked-in password managers.

But if you don't already have both of those problems, the standard is basically just "instead of having the password manager pretend to type in a box, what if they dumped something into the stream directly", and that extends to what if the UI didn't ask for anything and just said "hey, do you want to login? Just let me know and it's done"

And, like, should you be able to export from Apple's built in store to migrate? Absolutely, but if you never used Apple's passkeys in the first place, because ugh gross, then it's not a problem you need solved yet.

There is one problem I'll admit, which is that it's easier to make a sketchy password manager that just pretends to be a keyboard. I myself don't actually use passkeys because I sync my passwords with git and use pass, which is cool and I love it. And then I type them using a dmenu script and xdotool, which is silly and I love it. But that doesn't work with passkeys which I can definitely store in git, but would require a real actual connection between my browser and the tool, in a way that I don't think currently exists.

But just because I can't use my sketchy crap, doesn't always mean it's a step back 😛

The trap: Putting any 3rd party between you and your access.
It's a 3 card monte game, but with security.

Roleplay: Mr. Jonsith did you know your house is vulnerable? Your simple little key can be used by anyone to get in to your house. Security!? Our Keypass system will super secure your house. You give us your key, and when you want access, you come to one of our 5 in town locations, request access from us by showing us this new key here, and we will let you into your house.

I dont understand the issue. Arent passkeys and password in any case just stored in a pw manager nowadays?

The problem he is describing here is mostly with enrollment and account recovery and not so much passkeys. The risk of getting locked out of accounts exists whether or not you use passkeys. Code based authenticators are not any better in this regard. Enrollment and recovery are the hardest part of identity. Passkeys are meant to address phishing risks specifically. I would love to see us do better on account recovery whether or not passkeys get adopted. The thing is, passkeys adoption is pretty slow and it has little to do with the issues described in this article. People just find it complicated and confusing. Until it is dead simple and the default, it will not find broad adoption.

I appreciate this article. Passkeys kinda came out of nowhere to me and I haven’t liked them since day one. So it’s nice to have my gut feeling vindicated with some actual info.

Me neither | aesthelete

Passkeys and 1FA were always just a duct tape solution for users resuing basic passwords without having to set a stronger password requirement or relying on users to use a strong password.

I think Chrome and Firefox should have decided on making an API for their builtin password generation and filling functions, that way any password manager would be able to integrate with foolproof functionality out of box.

People already use browser auto gen passwords for the reason that its faster and usually has an account sync built in. Now it would work with any 3rd party solution as well which covers enterprise and security minded users as well.

Users won't use a password manager if it means you have to manually make an entry everytime you make an account.

I'm not the biggest fan of passkeys, either.

Companies have had 13,000+ Data breaches in the last 5 years. Lets all put our access in one of those, so that when some thief get access to one, they get access to everything.

"But Lutra, they won't have access-access the pieces arent all there .. blah blah blah"

Oh, cool, Lets put all our access in one of those, so when they get access to one, they lock us all out of everything.

Passkeys are a good idea with an insufficient compatibility issue.

In self host vaultwarden and it's great with my passkeys and very convenient.

🎶Security is Theatre🎶