you are viewing a single comment's thread
view the rest of the comments
[–] 36 points 1 month ago (23 children)

For users who previously reused passwords across all their sites, passkeys are a huge step-up.

That is exactly why passkeys are a good thing. Basically everyone reused passwords everywhere.

  • source
  • hideshow 23 child comments
  • [–] 56 points 1 month ago (11 children)

    A password manager is better than passkeys in 2026

  • source
  • parent
  • hideshow 11 child comments
  • [–] 13 points 1 month ago (5 children)

    Some password managers can sync passkeys for you! Bitwarden can handle it

  • source
  • parent
  • hideshow 5 child comments
  • [–] 4 points 1 month ago (4 children)

    android doesn't allow 3rd party apps to use passkeys nor autofill 2fa consistently. For passkeys, you are forced to use google services for it, or loose access, making it pointless. TOTP codes meanwhile can at least be copied and pasted manually from a password manager.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 5 points 1 month ago* (3 children)

    https://developer.android.com/identity/passkeys/manage-passkeys

    Actually not, 3rd party Android apps can act as passkeys providers

    With Bitwarden you can even do your own self hosted sync of passkeys

    https://bitwarden.com/blog/bitwarden-passkeys-mobile/

    Any app where it doesn't work has chosen to not use the right API

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 1 month ago (2 children)

    It's android version dependent. Only 14 and up support 3rd party providers.

    Passkeys are supported on devices that run Android 9 (API level 28) or higher.

    On many devices, Credential Manager stores passkeys to Google Password Manager by default. Users can choose other password managers as its passkey providers in the System Settings on Android 14 or higher.

    Given the slowness of android version rollouts, this will be an issue for a long time.

    I also think supporting older androids is pushing apps to do it the "wrong" way and making it google specific.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 month ago (1 child)

    Really depends on what you mean by passkey, since it's actually a fairly vague term for a bundle of technologies.

    I don't really care for password manager passkeys; just use a password, all it really does is save you from needing to enter a username in a login flow.

    But I'm a big fan of hardware 2fa using non-resident keys ("passkey" lite); I'll use a regular login flow with a password manager, then the 2FA step with a hardware token. Basically bulletproof (ditto if you secure your PW manager with hw 2fa) and painless.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 month ago

    Even pw synced passkeys at least have the benefits of both being phishing resisting + replay protected, as well as being able to use the TPM chip for extra local protection.

    Hardware keys are logically simpler though

  • source
  • parent
  • [–] 1 point 1 month ago (2 children)

    It's a false dichotomy to have one or the other. I use passkeys as a quicker and more convenient way to log in to some sites, but I still have passwords in my password manager as a fallback.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 14 points 1 month ago (10 children)

    Maybe 5 or 10 years ago, but who doesn't use a password manager these days? They generate random passwords and remember them for you

  • source
  • parent
  • hideshow 10 child comments
  • [–] 31 points 1 month ago (2 children)

    Do you know any non tech people, especially over 40? Literally none of them uses a password manager.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 16 points 1 month ago (2 children)
  • [–] 3 points 1 month ago

    My current employer will not authorize the use of a password manager. I have a key fob for my Microsoft account, and another account does phone verification. I use one password. If they don't want to put the effort in for account security then neither do I. I use a password manager for nearly all my other accounts.

  • source
  • parent
  • [–] 1 point 1 month ago (1 child)

    I just remember my passwords idk lol. I never understood the logic of a password manager, someone hacks your manager they have everything in your life? Rather just run the risk of getting hacked one account at a time rather than they all get hacked at once when they get my password manager.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 month ago*

    So make the manager's password massive. There, that complete sentence just now is over 30 characters long and could literally be a password. You can double up security with a secret file that you must locate on your PC, in KeePass, at least. You can also add notes about entries, track more than just website accounts, etc. It's just too much brainpower to remember individual websites' passwords. All important ones have 2FA anyway.

    Managers are local to your computer so you likely messed up big-time if it got hacked, whereas websites can get hacked entirely out of our control.

  • source
  • parent