this post was submitted on 12 Oct 2026
267 points (84.7% liked)
Privacy
51408 readers
667 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 7 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I evaluate it based on that they replace passwords. Password is shared secret, which is bad. Passkeys are public-private cryptography, which is good. Passwords has to be stored in a password database and your username is gonna be stored alongside it, so you might as well store your passkeys there istead. Passkeys have the added benefit of being possible to store in an authenticators secure storage, like a security key. I see no real downsides, relatively speaking. Passwords that are created by humans, those not using pw managers, are gonna be bad.
With my security key, using FIDO2, i have to have the key, touch the key and enter a PIN. My key is never exposed, signatures happen on device. It's neat!
See I bought a couple of yubikeys, but have zero passkeys becuase I've yet to encounter any service that lets me choose to store their passkey on said yubikeys. How do you do it?
Seems to me that if I could tie them to yubikeys (ideally on two keys), remote attestation wouldn't risk me allowing any third party to assert influence or control over my choices of technology - is that right?
Amazon is probably the most visible example of trying to create passkeys all the damn time, but it never offers any user choice about where this passkey would be (my best guess is that its on the computer and tied somehow to my login). I'd happily use passkeys with yubikey, but I'm not willing to set up a different passkey on each computing device I use. Thatś a housekeeping/maintenance headache I dont want or need and it would be made all but impossible if I give up visibility and control over what devices are 'authorised' and how.
I hate to think how many people have inadvertently set up passkeys on devices that they rarely use.
If the site supports passkeys, the site asks the browsers WebAuthn API to create a passkey. From there it's up to the browser where the passkey ends up. In firefox, for example, it tries my security keys first, and I can choose which one by touching it. If you use a password manager, like KeepassXC, you install an extension to hijack this process, so all passkeys end up in the password database.
Attestation on a security key just means the firmware on the key has to be signed. So in theory, you can't use something like the 'Solokey hacker'. When sites ask for information on my keys I ususally choose to block it in the browser. That has not been a problem so far. I allways register two separate keys for each service and they are fully mobile. A security key you could not bring with you would be pointless.
I have amazon passkeys on my security keys. I didn't notice anything unusual with the registration process.
All the sites I've encountered have allowed me to use my security keys. Google had some dark pattern that made it confusing to set up and Discord does not allow passkeys for login, so the ones they let me create ended up undiscoverable passkeys, only for 2fa. The only site my solokey didn't work so far is l1t forum. I don't know why. but I doubt they require an attested device.
I use a NFC key for my phone.
I would not accept a device bound passkey. Nor would I let a third party, like Google, manage them for me.
If you wanna try it out; use https://webauthn.io/
Problem is passkey generation, expiration logic, etc., is often not well protected, so if a hacker is able to get it, they may not be able to target a specific account, but they can target random accounts with semi-bruteforce since there's no username to limit tries against or lock the account if there's too many tries. Just use a botnet and start throwing probable keys at it and you're likely to get a few.
Also, with a password repository, I protect that as exceptionally as I can, but I can always change my passwords and would do so of that was compromised. But I'm not talking about the passkeys of an individual being stolen, I'm talking about a compromised site having very little way of determining of a hacker has gotten enough information to narrow brute forcing down to a relatively manageable level with a botnet and using that to access random accounts for personal information scraping. And the user may have no idea it's happened to them since the bad tries never were associated with any login.