Yep, there's a reason 2FA recovery keys are usually printed and stored safely.

With that said, one way to avoid someone compromising service A due to somebody breaking into service B is to have different passwords everywhere, so a Password Manager is more convenient anyway.

I have yet to see a sticky note password that was anywhere near NIST compliant lol.

The “under the keyboard” part at least requires physical access

That's fine at home. Not so great in an office, though

This is why passphrases are better than passwords. So the “Under the keyboard” can be used as password. It has 3 out of the 4 types to match complexity and plentiful for length. And so much easier ro remember. It could be also a quote from your favorite movie or book, part of a lyric of your favorite song, etc.

That's why you should never change your password. No one will think to guess @utumn2O23 in 2026.

Holy $#!7111

Alt joke:

Thanks for the tip! My password is now....

hunter2 I feel more secure already. :D

I will take a stanza from a song, use the first letter from each word, switch the S to 5 or $ as an example, and make sure I have two uppercase, two lower, two numbers. and two special characters, 8 minimum, although now it runs about 13.

I hum as I type in my password. All I have to remember is how I typed it out.

Come at me, dictionary cracks. The result is bonkers as fuck, but I loved that stanza. I have passwords I have used for 20+ years.

My coworker who sits next to me recently commented to me that I always hum the same tune when I log into my computer. Then he mentioned I hum a different tune when I log into the proxmox.

My sticky note would be like:

computer - Local H

proxmox - Sonic Youth

mail server - Future of the Left

NAS - Faith No More

Inventory - Slothrust

etc.

Potentially the server can request hardware/software attestation that would limit the choice of password safe to approved ones only. We don't yet know how big/likely this could be, but in theory it's possible.

The argument from the "it's a trap" article is that the service you are registering to can use attestation to ensure that you are only using passkey managers that they approve.

I have to admit that I haven't investigated this thoroughly myself but if the protocol can be abused in that way then your only choice really would be not to use the service. If it is related to banking or government services then you may not have much of a choice.

Until they only allow specific AAGUIDs to enroll passkeys that don't include the one used by KeePassXC (fdb141b2-5d84-443e-8a35-4698c205a502) or KeePassDX (eaecdef2-1c31-5634-8639-f1cbd9c00a08) because they don't consider them secure enough.

https://aaguid.nicolasuter.ch/

They'll learn like I did the hard way. Lol

The concern is valid, but we should also look at these company's interests in pushing passkeys, which first and foremost is avoiding all support and resources they have to dedicate to password resets and account hijacking, of which TOTP was the band-aid for, which they also push.

The software or hardware attestation is IMO a non-issue for most public sites. We have a precedent in TOTP, and they haven't locked those down either to specific software, because they care more about adoption (to avoid the costs above) than controlling what software you use to validate.

If someone wants to say that these companies will turn on this attestation for passkeys in the future, and break a ton of logins and decrease adoption, then they should have a reason why they haven't done so for TOTP.

If it was just to helpfully reduce friction, it wouldn't be so controversial. The inclusion of any sort of TPM and hardware attestation support at all is what has some people sounding the alarm (in my opinion rightfully).

The features they're talking about are secure from a cryptographic standpoint.

However, there are features built into the passkey system so that a company could decide that it will only accept passkeys from a specific piece of hardware or software.

This isn't necessarily bad, you may only want your server to allow you access if the passkey comes from your phone's hardware. A person could have stolen your passkey but they're unable to fake the attestation step.

On the other end of things, a company like Google could provide a passkey service which requires you to use hardware provided by vendors that they approve of and they could abuse their position to force it's implementation, such as how you can use Google to sign into websites via OIDC.

Google could just as easily provide a service for 'secure' passkeys which are only allowed to be issued by phones provided by Google, Verizon or AT&T. No more third-party OSs (at least, if you want to sign into anything on the Internet) and no more jailbroken phones. You would have to use the exact, spyware laden, operating system that comes installed directly from your cellular provider who would have remote root access to your device.

I think the idea that we can just boycott passkeys and prevent this is nonsense magical thinking. It requires some hypothetical world where we can perfectly coordinate a boycott of otherwise useful technology. In reality this issue will remain obscure and generally only known to people interested in the topic while Google can pour tens of millions in advertising to reach everybody on the planet explaining how good and secure attested passkeys are to mainstream Internet users.

Use passkeys, they're useful and more secure than passwords. Not using them won't prevent enshittification, just sit back and watch the slow motion attested passkey trainwreck as it unfolds over the next decade.

Who did what now?

Still needs an arguably perhaps overengineered complicated standard to do it, and seems to open the door to more hardware attestation demands. I'm not a fan and I refuse to use passkeys. (But I can see the use for preventing fishing attacks, so I realize there is no obvious perfect answer here.)

Yubikeys support device bound passkeys already.

But you need to buy at least two of them, which isn't cheap.

They're actually not tied to a device. They can be synced across devices.

Bitwarden, 1Password, Dashlane, Google, Apple, and Microsoft will all do passkey syncing for you.

We don't yet have a good Linux native passkey store. I believe the credentialsd project is working on a spec for that. Once that's up and running I would expect to see some options for syncing without relying on a third party service (though, you can self-host bitwarden right now). It's definitely not seamless on Linux yet though.