this post was submitted on 26 Sep 2026
389 points (94.9% liked)
Technology
88272 readers
3109 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The problem he is describing here is mostly with enrollment and account recovery and not so much passkeys. The risk of getting locked out of accounts exists whether or not you use passkeys. Code based authenticators are not any better in this regard. Enrollment and recovery are the hardest part of identity. Passkeys are meant to address phishing risks specifically. I would love to see us do better on account recovery whether or not passkeys get adopted. The thing is, passkeys adoption is pretty slow and it has little to do with the issues described in this article. People just find it complicated and confusing. Until it is dead simple and the default, it will not find broad adoption.
The core issue is identity. If people would protect a digital identity a little better than they protect a credit card, that could/should be the basis of everything. Any account "worth more" than the CC $50 liability limit should have additional layers ON TOP OF the secure identity, including front line security that must be passed before the secure identity comes into play, but that single identity could/should be an element of access control to all non-anonymous accounts.
Anonymous accounts should stick with passwords, and online material should be clearly attributed as anonymous, or sourced from a secure identity (signed by said identity and blockchained to provide provenance).