this post was submitted on 26 Sep 2026
389 points (94.9% liked)
Technology
88253 readers
3140 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I really wish that SQRL had taken off, as it solved most of the problems noted. It was effectively passkeys that you generated on the fly based on your private key (which you can back up and restore to other platforms if necessary) and the website domain by scanning a QR code (or clicking rh QR code if your on the same device) and sends the signed challenge to the website to auth you.
No need to login to your manager on random systems, no issues with platform lock-in, no worries about dedicated hardware, no worry about losing your access if your device dies (assuming you backup your shit).
Because the security is not better. I looked into it back then and it simply didn't have a chance.
FYI, passkeys can also do the Qr thing.
https://www.corbado.com/blog/qr-code-login-authentication
Steve put so much time into it too. SQRL really is the superior method of the two.
SQuiRreL!
Yeah, no idea why not popular.
Because it doesn’t encourage vendor lock in to big tech.
If SQRL was adopted, then the popular manifestations would have just as much vendor lockin, with built in password managers hosting the master private key without export option.
Passkey is not inherently vendor lock in. It's mostly a consequence of password managers doing software passkeys and not making it reasonable to export private keys. It does have a mechanism a site can use to lock to "trusted vendors", but if a site does that, that is on them for being dickish.
Passkeys cross vendor sync is in the works right now and you can already self host with Bitwarden
it does not depend on the name. like, we all use Transmission Control Protocol and HyperText Transport Protocol, and nobody cares because they don't need to know. things can also be renamed before starting use in production, like we aren't normally calling tech by their RFC numbers