Technology

This is the only accurate take in the whole thread.

Passkeys solve "well, can't be fished" by introducing 2 new problems and never resolving super prevalent session hijacking. Even as a basic cost-benefit analysis, it's a net loss to literally everyone.

Cops also love them because they make getting access to your entire phone including all accounts simple as cake if you use fingerprint/faceID to unlock your device.

Password managers store passkeys. They’re portable and not device-locked. Been using them on Bitwarden for like 2 years now.

You can store Passkeys in open source password managers.

I don't know most of my passwords, so the step to passkeys doesn't feel like a big one. I also really like the flow of pressing Login; Bitwarden pops up a prompt without me initiating it; I press confirm. Done, logged in, and arguably more secure due to the surrounding phishing and shared secrets benefits.

its being pushed because corporations want to control your passwords with lock-in.

no way i'm using that garbage over my own manager with recallable plaintext passwords.

I think they are being pushed because cool technology on paper. Whenever I read an article about them, I can't help but think about the human factors. How are passkeys created, often by a password or email. okay... that looks a lot like a password. Oh you lost the passkey, here lets send you one again. It stinks of a second factor without a first. Sure, the passkey itself is hard to compromise, but how about its creation. If your email is compromised I see no difference from passwords or passkeys.

Currently I use a FOSS (I think?) password manager, BitWarden, that supports passkeys. I use it across Mac, Windows and Android so I'm while my passkeys are locked yo the password manager, I am not locked to any of the aforementioned megacorps.

That hasn't been true since password managers stored passkeys, which I've been doing for years. That objection goes into the trash. 🗑️

Thanks to our dystopian hellscape we live in it'll become mandatory just like useless online ids. I hate having to explain passkeys to my family. Some fuckface suit who doesn't use it properly pushed for a portfolio addition.

All my passwords look like @A#vVukh9c$3Kw4Cs8NP9xgazEuJ3JWE and are unique.

You're still transmitting the actual secret to the destination, so interception is a risk. Passkeys use asymmetric cryptography: no reusable secret is ever transmitted, only time-sensitive challenges that prove possession of the private key. Servers only store public keys, which aren't secret by design.

Passkeys have multifactor authentication built-in whereas passwords do not.

Passkeys can be more convenient than passwords. My password manager has my passkeys. At login, my password manager raises a passkey prompt that I simply confirm.

I really don’t want to turn my devices into hardware keys. I can’t imagine how difficult it would be to recover if, say, there was a fire or flood. Hardware breaks, gets lost, stolen. How about people who can’t afford multiple devices? What about the unhoused? How about if you get arrested and your one device gets confiscated- you can’t even give anyone else access to your data. What if you’re a good witness recording something and the police decide to make your device into evidence (or destroy it).

MFA? Absofuckinglutely. I’ll pass on passkeys, sorry.