TIL what passkeys are. Thx for sharing.
this post was submitted on 12 Oct 2026
267 points (84.7% liked)
Privacy
51408 readers
659 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 7 years ago
MODERATORS
This is actually a terrible take. Passkeys provide a very large security benefit over passwords and have an open standard.
It’s particularly ridiculous that they seem to think TOTP good passkey bad. They solve the same problem: symmetric persistent encryption like passwords is very weak. TOTP solves this my making it not persisting and passkeys solve this by making it asymmetric. Passkeys are mildly more convenient because you don’t have the copy a code over.
Both also have the same potential for abuse, any service could require you use their specific app. The fact that this article makes it sound like TOTP is a perfect open standard while passkeys are a Trojan horse for abuse is ridiculous. If most services are using the open standard for TOTP why wouldn’t they for passkeys? Also not all services do obey the open standard for TOTP. I’m sure I’m not the only one who was forced to install the duo Authenticator because their institution was somehow sold on their protocol being stronger than the open standard.
TOTP and passkeys are comparable and both with doing.
load more comments
(4 replies)
I've always thought they were a really bad idea. It puts everything into a "setting you have" factor and removes the "something you know as well as the need to match the factor to a username. And if the site is hacked, they can get a lot of information about how the passkeys are generated even if they don't get access to secure info. It just simplifies the ability to hack a random account in many ways if not a specific one.
I evaluate it based on that they replace passwords. Password is shared secret, which is bad. Passkeys are public-private cryptography, which is good. Passwords has to be stored in a password database and your username is gonna be stored alongside it, so you might as well store your passkeys there istead. Passkeys have the added benefit of being possible to store in an authenticators secure storage, like a security key. I see no real downsides, relatively speaking. Passwords that are created by humans, those not using pw managers, are gonna be bad.
With my security key, using FIDO2, i have to have the key, touch the key and enter a PIN. My key is never exposed, signatures happen on device. It's neat!
See I bought a couple of yubikeys, but have zero passkeys becuase I've yet to encounter any service that lets me choose to store their passkey on said yubikeys. How do you do it?
Seems to me that if I could tie them to yubikeys (ideally on two keys), remote attestation wouldn't risk me allowing any third party to assert influence or control over my choices of technology - is that right?
Amazon is probably the most visible example of trying to create passkeys all the damn time, but it never offers any user choice about where this passkey would be (my best guess is that its on the computer and tied somehow to my login).
I'd happily use passkeys with yubikey, but I'm not willing to set up a different passkey on each computing device I use. Thatś a housekeeping/maintenance headache I dont want or need and it would be made all but impossible if I give up visibility and control over what devices are 'authorised' and how.
I hate to think how many people have inadvertently set up passkeys on devices that they rarely use.
load more comments
(1 replies)
Problem is passkey generation, expiration logic, etc., is often not well protected, so if a hacker is able to get it, they may not be able to target a specific account, but they can target random accounts with semi-bruteforce since there's no username to limit tries against or lock the account if there's too many tries. Just use a botnet and start throwing probable keys at it and you're likely to get a few.
Also, with a password repository, I protect that as exceptionally as I can, but I can always change my passwords and would do so of that was compromised. But I'm not talking about the passkeys of an individual being stolen, I'm talking about a compromised site having very little way of determining of a hacker has gotten enough information to narrow brute forcing down to a relatively manageable level with a botnet and using that to access random accounts for personal information scraping. And the user may have no idea it's happened to them since the bad tries never were associated with any login.
The article warns that passkeys could be used, assuming they become the only form of logging into platforms, to prevent someone using the wrong operating system to log into those platforms.
Being prevented from using certain applications because you use the wrong OS is nothing new, but there is, from everything i have seen, always a reason to block it, they dont do it for someone elses benefit. A lot of banking apps cannot be used on many android roms; without microg or gapps many android apps wont work (some wont work even with microg); games sometimes use kernel-level anticheat that forces players to use windows; people solved this issue by just not using those apps
Why would a significant portion of used websites/applications that require accounts stop allowing passwords or authenticator apps, relying on this open standard, force certain options to be used for the standard and ensure that the user isnt on an operating system they have no reason to care about. There are already methods to prevent people from using a certain OS, they could just not rely on an open standard