this post was submitted on 26 Sep 2026
389 points (94.9% liked)
Technology
88253 readers
3140 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Good article.
Currently passkeys are too much of a vendor lock-in to big tech.
Bitwarden support alone does not change that.
Microsoft 365 implementation of passkeys is sacrilegious somehow.
It requires only the Authenticator app from Microsoft and can use nothing else to create the passkey. The way this is implemented on iOS means that Authenticator comes up as an autofill option BUT IT ONLY SUPPORTS M365 and is useless for anything else. Leave it to Microsoft to take an open standard and bastardize it to the point of it being MORE CONVENIENT to just type a damn password.
The authenticator requirement was for regular MFA, with passkey you can use others like yubikey. BUT your admin can lock it to certain vendors so they could have selected Microsoft only.
I’m the admin. Every time I try to open it up, I only get guides for doing it on a regular, personal MS account.
Wait, you type passwords? KeePassXC's auto-type awaits!
You realize password managers just open up another attack vector right?
I agree the passkey user experience needs work, but man do I enjoy it over the haphazard 'passwordless' website login that just sends you an email.
I get it, they're just skipping an attack vector and basically relying only on '2FA'. But now I have to go to a different app/tab, copy a code, and return to the site instead of letting the password manager fill stuff in for me. Some, like kickstarter, let you still have a 2FA code enabled so you have to grab your code from whichever authenticator and go to your email. Really nice login experience out of nowhere one day. \s
The best implementation of this I've seen has to be Ghost, an open source self-hostable newsletter/patreon thing. They detect what email provider you have and when you enter your email, will display a link to open your inbox. It's super neat, and I haven't seen it anywhere else, and I'm also not sure how they do it. For something self-hostable, I'll definitely take one less attack vector.
Doesn't help if you're not using a huge provider such as Gmail or Hotmail
It worked with ProtonMail
A DNS lookup on a domain says who runs the email server for email users on that domain (that's how email senders figures out how to send you messages), and if that host is a known one then you can just pull the link to show. If you're self hosting email then a few solutions can be recognized and login shown by guessing that the email software's default URL pattern is used.
I figured it was something like that, thanks for the explanation!
bitwarden went from working great to buggy on browsers. sometimes the browser passes the request to the extension but most times goes to the os
What browser
i have had issues on Firefox, Chrome and Safari between Windows, Linux, and macOS