this post was submitted on 11 Nov 2025
290 points (87.6% liked)
Technology
76774 readers
3457 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I've been resisting using them and decided to set one on my rarely-used and unimportant Piefed account to try it out.
Saved to Bitwarden fine on my desktop browser. When I try to log in with a browser on my phone, it asks for my username and does nothing more after that dialog closes. While I'm not sure if this is a problem with Piefed, Bitwarden, or Firefox, I'm now disinclined to try it with anything important, especially if that thing might then discourage me from logging in with a password.
I recognize the theoretical advantages, but passkeys don't do much to solve problems I actually have. All my passwords look like
@A#vVukh9c$3Kw4Cs8NP9xgazEuJ3JWEand are unique. Bitwarden won't autofill the wrong domain. I don't enter credentials in links from emails I didn't trigger myself immediately before. I haven't checked whether I can reliably backup and restore them in my Bitwarden vault.You're still transmitting the actual secret to the destination, so interception is a risk. Passkeys use asymmetric cryptography: no reusable secret is ever transmitted, only time-sensitive challenges that prove possession of the private key. Servers only store public keys, which aren't secret by design.
Passkeys have multifactor authentication built-in whereas passwords do not.
Passkeys can be more convenient than passwords. My password manager has my passkeys. At login, my password manager raises a passkey prompt that I simply confirm.
If they can intercept my password despite TLS, they can probably also steal my session. I'll grant that's marginally less bad since the attacker would have to do their evil immediately if I log out when finished.
I'm going to disagree that passkeys really have multifactor authentication built in. The passkey is a single factor. If it is compromised (an attacker steals the private key), that's all the attacker needs unless the service involved requires another factor like TOTP. The fact that it's usually harder to steal the private key than a password doesn't make it MFA.
I recognize the theoretical advantages, but my one attempt to use it (here, with Piefed) didn't go so well, so I'm not eager to jump in with both feet.
That's not necessarily true: it could leak due to flaw or defect that doesn't affect the session token.
Security is all about layers & reducing risk/surface area of attack. By getting your secret, they can leak it. Leaking a secret they don't have, however, is impossible: that's secure by design.
Then you're disagreeing with standards & definitions. Passkeys are encrypted in an authenticator that needs a biometric or secret (ie, something you are or know) to unlock the key (something you have).
While it's fine to share, "I tried something once, it sucked" is not a great argument to generalize that the technology sucks or isn't better than your limited impression. Maybe piefed sucks: if piefed implemented password authentication wrong, would you blame password authentication?
I self host vaultwarden, and use bitwarden clients everywhere. Passkeys are stored there
Passkeys to me, are a better way to insert login information. Some developers don't think of passwords getting automatically filled in, so this autofill sometimes breaks. Passkeys might be a improved interface to integrate password managers. Also, sometimes 2FA keys from my bitwarden client gets copied into the clipboard, which sometimes overwrites the stuff I wanted to preserve in there. This does not happen with passkeys.