Technology

There is still nothing better than passwords.

I don't want my access to be tied to a specific device. Devices get lost, or break.

I don't want someone to be able to use my face or finger or eyeball to access my data. You can legally be compelled to unlock a device with your biometric security.

So current biometric security sucks. And passkeys suck.

Also, though...passwords suck for all the reasons that we all already know.

There has to be some better method that the owner can have full agency over, I just don't know what. I don't have the answers.

This article does a great job of articulating a lot of the uncomfortableness I have around passkeys. I've always said they make a lot more sense in an corporate environment but the level of control you lose in a personal setting is not commensurate with the protections and possible lock-in they offer.

I just don't like passkeys. They are an overly technical solution to what is mostly a human problem.

For users who previously reused passwords across all their sites, passkeys are a huge step-up.

That is exactly why passkeys are a good thing. Basically everyone reused passwords everywhere.

Sadly did not dig into the whole "the other side decides which device you are allowed to use" topic, a feature inherently build into passkeys.

I think their biggest weakness is the vendor lock in. Using a 3rd party password manager is the best solution for most people, so they arent locked to their phone. But they are right in saying none of it is quite ready.

I think the article is forgetting, they are password replacements, not account recovery replacements. Realistically, people are just as likely to forget a password, and account recovery proceedures still have to be in place. I dont see the issue there.

Passkeys are good they are just being pushed before properly fully developed, but we are slowly getting there.

The trap: Putting any 3rd party between you and your access.
It's a 3 card monte game, but with security.

Roleplay: Mr. Jonsith did you know your house is vulnerable? Your simple little key can be used by anyone to get in to your house. Security!? Our Keypass system will super secure your house. You give us your key, and when you want access, you come to one of our 5 in town locations, request access from us by showing us this new key here, and we will let you into your house.

I am using my password manager, which is keepass.

I have tried adding pass keys to it, and have had mixed success. On some websites, it seems to work fine, and then on others, it seems to break miserably, and made me return back to a password.

I like the idea of passkeys, because then you don't have a shared secret between you and the website, and you get a different key for every single website using public-private key cryptography. That's fantastic, but the implementation still needs some work.

I dont understand the issue. Arent passkeys and password in any case just stored in a pw manager nowadays?

The problem he is describing here is mostly with enrollment and account recovery and not so much passkeys. The risk of getting locked out of accounts exists whether or not you use passkeys. Code based authenticators are not any better in this regard. Enrollment and recovery are the hardest part of identity. Passkeys are meant to address phishing risks specifically. I would love to see us do better on account recovery whether or not passkeys get adopted. The thing is, passkeys adoption is pretty slow and it has little to do with the issues described in this article. People just find it complicated and confusing. Until it is dead simple and the default, it will not find broad adoption.

Companies have had 13,000+ Data breaches in the last 5 years. Lets all put our access in one of those, so that when some thief get access to one, they get access to everything.

"But Lutra, they won't have access-access the pieces arent all there .. blah blah blah"

Oh, cool, Lets put all our access in one of those, so when they get access to one, they lock us all out of everything.

I'm not the biggest fan of passkeys, either.

Me neither | aesthelete

I don't know that OP is wrong per-se, but I think they're overstated a bit.

Their statement that passkeys are better than people using the same password, but are a step back for people using a password manager, is maybe a bit much. It's basically the same, but sometimes better.

Most of their drawbacks are the hardware implementations, but that's already true of people using hardware 2FA, and corporate management, which is already a problem if you use Apple's or Google's existing baked-in password managers.

But if you don't already have both of those problems, the standard is basically just "instead of having the password manager pretend to type in a box, what if they dumped something into the stream directly", and that extends to what if the UI didn't ask for anything and just said "hey, do you want to login? Just let me know and it's done"

And, like, should you be able to export from Apple's built in store to migrate? Absolutely, but if you never used Apple's passkeys in the first place, because ugh gross, then it's not a problem you need solved yet.

There is one problem I'll admit, which is that it's easier to make a sketchy password manager that just pretends to be a keyboard. I myself don't actually use passkeys because I sync my passwords with git and use pass, which is cool and I love it. And then I type them using a dmenu script and xdotool, which is silly and I love it. But that doesn't work with passkeys which I can definitely store in git, but would require a real actual connection between my browser and the tool, in a way that I don't think currently exists.

But just because I can't use my sketchy crap, doesn't always mean it's a step back 😛

Love them.

Using 1Password for sync.

Never ever failed to connect to QR code passkey request, even on weird corporate networks.

Portability has gotten so much better - there’s now a defined standard for portability that passkey providers are implementing.

Honestly I cannot understand the criticism at all.