Sadly did not dig into the whole "the other side decides which device you are allowed to use" topic, a feature inherently build into passkeys.

This article does a great job of articulating a lot of the uncomfortableness I have around passkeys. I've always said they make a lot more sense in an corporate environment but the level of control you lose in a personal setting is not commensurate with the protections and possible lock-in they offer.

I just don't like passkeys. They are an overly technical solution to what is mostly a human problem.

I really wish that SQRL had taken off, as it solved most of the problems noted. It was effectively passkeys that you generated on the fly based on your private key (which you can back up and restore to other platforms if necessary) and the website domain by scanning a QR code (or clicking rh QR code if your on the same device) and sends the signed challenge to the website to auth you.

No need to login to your manager on random systems, no issues with platform lock-in, no worries about dedicated hardware, no worry about losing your access if your device dies (assuming you backup your shit).

I think their biggest weakness is the vendor lock in. Using a 3rd party password manager is the best solution for most people, so they arent locked to their phone. But they are right in saying none of it is quite ready.

I think the article is forgetting, they are password replacements, not account recovery replacements. Realistically, people are just as likely to forget a password, and account recovery proceedures still have to be in place. I dont see the issue there.

Passkeys are good they are just being pushed before properly fully developed, but we are slowly getting there.

I am using my password manager, which is keepass.

I have tried adding pass keys to it, and have had mixed success. On some websites, it seems to work fine, and then on others, it seems to break miserably, and made me return back to a password.

I like the idea of passkeys, because then you don't have a shared secret between you and the website, and you get a different key for every single website using public-private key cryptography. That's fantastic, but the implementation still needs some work.

You know what u don’t like. Fucking xøcode sent to my email or a «magic link».

Srsly fuck off. Let me type my password

The problem he is describing here is mostly with enrollment and account recovery and not so much passkeys. The risk of getting locked out of accounts exists whether or not you use passkeys. Code based authenticators are not any better in this regard. Enrollment and recovery are the hardest part of identity. Passkeys are meant to address phishing risks specifically. I would love to see us do better on account recovery whether or not passkeys get adopted. The thing is, passkeys adoption is pretty slow and it has little to do with the issues described in this article. People just find it complicated and confusing. Until it is dead simple and the default, it will not find broad adoption.

I'm not the biggest fan of passkeys, either.

I appreciate this article. Passkeys kinda came out of nowhere to me and I haven’t liked them since day one. So it’s nice to have my gut feeling vindicated with some actual info.

For users who previously reused passwords across all their sites, passkeys are a huge step-up.

That is exactly why passkeys are a good thing. Basically everyone reused passwords everywhere.

Me neither | aesthelete

Good article.

Currently passkeys are too much of a vendor lock-in to big tech.

Bitwarden support alone does not change that.

There is still nothing better than passwords.

I don't want my access to be tied to a specific device. Devices get lost, or break.

I don't want someone to be able to use my face or finger or eyeball to access my data. You can legally be compelled to unlock a device with your biometric security.

So current biometric security sucks. And passkeys suck.

Also, though...passwords suck for all the reasons that we all already know.

There has to be some better method that the owner can have full agency over, I just don't know what. I don't have the answers.

I agree with this article, i think all points mde are valid and true.

But is there a downside for using mozzila password manager? (other than being in the cloud) I think It allows you to sync your passwords and login information accross any device you use, it works well for phone apps, websites log in and cross platform credentials (ios, android, linux and webpages)

I dont understand the issue. Arent passkeys and password in any case just stored in a pw manager nowadays?

The trap: Putting any 3rd party between you and your access.
It's a 3 card monte game, but with security.

Roleplay: Mr. Jonsith did you know your house is vulnerable? Your simple little key can be used by anyone to get in to your house. Security!? Our Keypass system will super secure your house. You give us your key, and when you want access, you come to one of our 5 in town locations, request access from us by showing us this new key here, and we will let you into your house.