this post was submitted on 11 Nov 2025
290 points (87.6% liked)

Technology

76799 readers
3136 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


founded 2 years ago
MODERATORS
 

Passkeys are built on the FIDO2 standard (CTAP2 + WebAuthn standards). They remove the shared secret, stop phishing at the source, and make credential-stuffing useless.

But adoption is still low, and interoperability between Apple, Google, and Microsoft isn’t seamless.

I broke down how passkeys work, their strengths, and what’s still missing

you are viewing a single comment's thread
view the rest of the comments
[–] cmhe@lemmy.world 1 points 3 days ago (1 children)

I use them with bitwarden and a self hosted vaultwarden. If my phone breaks, no issue. If my server breaks, I got local backups.... Keys are stored encrypted in a postgres database for which I have access, if I need to restore it. No lock-in issue or risk of loosing access when one or two devices break.

[–] Brokkr@lemmy.world 1 points 2 days ago (1 children)

That sounds great, but also isn't a solution for most people.

[–] cmhe@lemmy.world 1 points 2 days ago* (last edited 2 days ago)

True. But most good stuff isn't a solution for everyone. It takes real effort to escape vendor-lockin. Bigtech made sure of that.

If something is too simple to set up or requires no set up, or comes from a for-profit company, but doesn't cost anything, then it always suspicious.

I am just saying that the issue is not with passkey itself, but the individual implementations and that google/twitter/etc. is pushed towards regular users.

Critiquing passkey because vendor-lockin is like critiquing HTML for allowing ads.