this post was submitted on 11 Nov 2025
292 points (87.6% liked)

Technology

76834 readers
1667 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


founded 2 years ago
MODERATORS
 

Passkeys are built on the FIDO2 standard (CTAP2 + WebAuthn standards). They remove the shared secret, stop phishing at the source, and make credential-stuffing useless.

But adoption is still low, and interoperability between Apple, Google, and Microsoft isn’t seamless.

I broke down how passkeys work, their strengths, and what’s still missing

you are viewing a single comment's thread
view the rest of the comments
[–] obinice@lemmy.world 9 points 5 days ago* (last edited 5 days ago) (3 children)

Okay, so long as a passkey is something I can memorise. Otherwise, it's significantly worse than a regular password (assuming you use good passwords and don't reuse passwords etc).

It seems like they want to tie it to a physical computer (like the one in your pocket), which sucks big time. What happens if I don't have access to that computer at all times, or it breaks, or is lost?

I'm planning on getting rid of my smartphone for something that just does calls and texts for example, because I'm sick of how unhealthily reliant I, and everyone, have become on this thing, and I want to be more connected to the real world. What then?

My brain is the best place to store passkeys, it can't be hacked, stolen, lost, etc, unlike every other option. It's easily capable of storing lots of randomised unique passwords for each service (surely I'm not the only one that can do this?). It's the clear winner.

[–] Jason2357@lemmy.ca 3 points 5 days ago (1 children)

How many good passwords can you memorize? I can maintain 2-3 in my head long term, especially if only used rarely, and you can be phished if you are typing it in. Not tenable for online accounts. The only real comparison with security parity is a password manager + 2fa generated on-device, compared with passkeys. In both cases, you have "strong" password, no re-use, resiliency to fishing, and requires both "something you know and something you have." I think a password manager is slightly more usable, but I'm not convinced either is a "good" experience yet.

[–] andyburke@fedia.io 7 points 5 days ago

security parity is a password manager + 2fa generated on-device

This experience works perfectly for me. I have no need of whatever junk the latest consortium of megacorps has come up with.

🤷‍♂️

[–] JasonDJ@lemmy.zip 1 points 5 days ago

I store all my passkeys in bitwarden so they are available anywhere I have bitwarden. Which makes it tough if/when I need personal accounts at work (like to log into electric company to check outage map).

[–] sentientRant@lemmy.world -4 points 5 days ago

You just need to memorise the PIN at max. If your device has biometric recognition you could even use your face scan or fingerprint so even remembering a PIN is not needed in that case.