this post was submitted on 11 Nov 2025
290 points (87.6% liked)
Technology
76799 readers
5626 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The biggest disadvantage:
More eggs in the American megacorp basket for more people, yay
Currently I use a FOSS (I think?) password manager, BitWarden, that supports passkeys. I use it across Mac, Windows and Android so I'm while my passkeys are locked yo the password manager, I am not locked to any of the aforementioned megacorps.
While I use and love bitwarden, it's not exactly foss. Although there is a foss implementation of their server backend
Vaultwarden (the free server implementation) also supports passkeys.
A cursory search lead to this thread from 2024 https://community.bitwarden.com/t/concerns-over-bitwarden-moving-away-from-open-source-what-does-our-future-hold/74800
where an employee stated
Both the client and server are mostly open source. Some server features are paywalled. The alternative Vaultwarden server is fully open source, and much lighter on system resources.
Have there been any recent licensing shenanigans with BitWarden?
I use BitWarden too. OS , device and browser agnostic is a win
But I imagine the vast amount of people will use whatever their platform is pushing, so Apple Google or Microsoft. And in 5 years time "3rd party passkeys" are not "secure enough" and blocked by the OS. (Ok that's a bit tinfoil hat, but Google's recent Android app developer verification scheme is fresh in mind)
KeePassXC has begun rollout of their own implementation, and I’m pretty sure they’re considered FOSS.
From a quick scan of the white paper, it appears they’re currently using on-device passkey discovery and otherwise “intercepting” passkey registration workflows, which I take to mean they aren’t originating the request as a passkey registrar. This may be the easiest method to satisfy FIDO’s dID requirements.
That's not the biggest disadvantage "if used properly." Any account you have should get a passkey on every device you own. Each device has it's own passkey system. If you have an iPhone, yeah, you get an apple passkey, but then if you have a windows laptop, you have a microsoft passkey, a FLOSS system will have it's own, and so on. You are already on whatever system would contain the passkey and can easily add different ones each time you get a new device.
The biggest issue is that most people use a small number of devices (including many who use 1). Passkeys work best if you have many devices, so if you lose one, you just use another to access your services. If you have 1, you need to use recovery codes (and people don't save them).
A key for each service for each device is too impractical in real life.
Getting a new device would mean logging in to hundreds of services to link up the new device. Or somehow keep track of which services have keys with which devices. And signing up to a new service would mean having to remember to generate keys for a a handfull of devices, some of which might not be available at the time (like a desktop computer at home when you are out). Or you risk getting logged out if you loose the one device that had a key for that particular service.
I agree passkeys can make sense with something like BitWarden or KeyPassX. Something that is FOSS, and is OS and device agnostic, and let's you sync keys across devices. And should have independent backups too. Sync is not backup.
~~This is a big one. Lock-in and the threat of provider blacklisting means it will remain a shortcut like SSO (“sign in with ____”) until we’ve established federated providers.~~
On further reading, this may not be as far off as I thought. Passkey registration providers can be OS-level but browser and password manager based solutions were intended (overview from FIDO alliance). And it looks like KeePassXC has begun rollout of their own. If I’m reading correctly they currently “piggyback” off of an OS-based provider in various ways, so it’s not yet an end-to-end implementation, but these are early days.
And they can be hardware based as well. I have a cheap Yubikey USB dongle, which works as a passkey vault as well. Completely OS independent.
Yeah I have a few of those for the most secure stuff. Hard to beat! The USB-C one is the newest and I debated the choice but damn these days it’s great how it works with everything.
That hasn't been true since password managers stored passkeys, which I've been doing for years. That objection goes into the trash. 🗑️
Your password hashes (assuming they even hash them) already live on their servers...
Cool, they know the hash to that one service I signed up with them. Not every account ever.
~~Your passkeys aren't synced to anything, so the passkey is no different than your password hash. They're device locked unless you use something like bitwarden, so you're no more dependent on American mega corps than you are right this second.~~
I'm wrong.
Dont they all sync to the respective cloud services?
iOS vault -> synced apple cloud Android vault -> synced with Google cloud?
Windows Hello -> synced with Microsoft account?
And if they're not synced, that's even worse. Loose your device and loose your account. Or keep track of which of your 5 devices are have keys for which of your 150 accounts
Well shit, you're right. I must not have been paying attention when they updated them to include that
Say you don't understand passkeys without saying you don't understand them...
A passkey uses public key cryptography to secure your account instead of a password, it only grants you access to the one account you set it up for, and the account provider only holds your public key, you control the private key. Your passkey is a secure alternative to passwords because you CANNOT reuse it across services, cannot reasonably remember it, and the method of using it isn't by copying and pasting into a field like a password, so it isn't susceptible to the same attacks.
If the provider loses your public key, they can't give you a challenge to verify you have the private key, so you lose access. Just like if they lose your password hash. It's an identical scenario.
Everything you said is correct, but you misunderstood my point. I was referring to the fact that Google/Apple/whatever would hold your private key. In practical terms, it is barely different from the existing "Sign in with Google/Apple/whatever".
The assumption is that the native passkey manager on the device (iPhone, android, windows) would sync the passkeys (to Apple , Google, Microsoft) for protection against device failure and easy of use across devices. Or you risk loosing your accounts if you loose your device.
That would happen if you store your passwords there too...
If you're proactive enough with your passwords to manually store them in your own vault, you can be proactive enough to not use the corporate vaults that don't allow exporting. This isn't a "downside" of passkeys, it's a downside of using the built in managers.