this post was submitted on 26 Sep 2026
390 points (94.9% liked)
Technology
88272 readers
3099 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Github only asks me for (bitwarden's) passkey. That's just a single factor.
A securely stored modern certificate is going to be magnitudes more secure than password plus MFA.
The certificate path uses cryptography to prevent disclosure of your secret, and can't be compromised when the site inevitably gets hacked.
I wouldn't classify passkeys as MFA tho, they are a passwordless method that's more secure than most MFA methods. Afaik it's based on signed certificates or something like that and that's virtually unhackable unless someone gets physical access to your device (and that's game over anyway).
But bitwarden uploads it to the cloud to be used on any computer, AFAIK.
Bitwarden uploads the whole vault (the whole json of passwords, passkey codes, MFA identifiers, credit card info...) encrypted with your master password. Meaning that whatever is on the cloud should be virtually unbreakable. That's why every time you write the password in the extension or Android app or whatever it takes a second or two to open, because it's downloading and decrypting everything locally.
When you update a password they need to reencrypt the whole vault and re-upload it again even though it's wasteful since that's their whole security plan.
If you're using software that properly uses your device's SE / TPM chip then it's much more secure against malware, etc. And the main selling point is the much stronger phishing resistance (can't trick you into logging in via a fake site, etc)