This is the only accurate take in the whole thread.

Passkeys solve "well, can't be fished" by introducing 2 new problems and never resolving super prevalent session hijacking. Even as a basic cost-benefit analysis, it's a net loss to literally everyone.

Password managers store passkeys. They’re portable and not device-locked. Been using them on Bitwarden for like 2 years now.

Cops also love them because they make getting access to your entire phone including all accounts simple as cake if you use fingerprint/faceID to unlock your device.

You can store Passkeys in open source password managers.

I don't know most of my passwords, so the step to passkeys doesn't feel like a big one. I also really like the flow of pressing Login; Bitwarden pops up a prompt without me initiating it; I press confirm. Done, logged in, and arguably more secure due to the surrounding phishing and shared secrets benefits.

I think they are being pushed because cool technology on paper. Whenever I read an article about them, I can't help but think about the human factors. How are passkeys created, often by a password or email. okay... that looks a lot like a password. Oh you lost the passkey, here lets send you one again. It stinks of a second factor without a first. Sure, the passkey itself is hard to compromise, but how about its creation. If your email is compromised I see no difference from passwords or passkeys.

I came to sorta say this. Regardless of the system if it can fail and if people have to recover an account then phishing will always be a thing. In person options to deal with an account like with bank branches or government offices are the only true way of making things more secure. I sometimes think it would make sense for this. One rare thing I have seen that gives me a bit of hope is the use of in person at the post office for us government accounts. Thats exactly how it should be done. Secretary of state for state and usps for federal. They are the only agencies with enough physical locations.

Passkeys are a technology that were surpassed 10 years before their introduction

Question is by what? I could see an argument that it is an overcomplication of some ill-defined application of x509 certificates or ssh user keys, but roughly they all are comparable fundamental technologies.

The biggest gripe to me is that they are too fussy about when they are allowed and how they are stored rather than leaving it up to the user. You want to use a passkey to a site that you manually trusted? Tough, not allowed. You want to use against an IP address, even if that IP address has a valid certificate? Tough, not allowed.

Not to mention Apple decided to make passkeys Airdropable. Fun.

I worked on a cool projected called FedID: https://fedid.me/ that creates a distributed identifier (DID) out in the world, federated with AvtivityPub, and gives you a key you can sign in with via OpenID Connect. It allows the DID to have multiple keys for multiple devices, and delegate authority, so losing a device/failure is no big deal.

That being said, Web passkeys can be stored in password managers, just like passwords.

I use them with bitwarden and a self hosted vaultwarden. If my phone breaks, no issue. If my server breaks, I got local backups.... Keys are stored encrypted in a postgres database for which I have access, if I need to restore it. No lock-in issue or risk of loosing access when one or two devices break.

I've found a pretty good use for a passkey. Docusign. About every 3 months I need to docusign something at work. The process involves logging in, changing your password, logging in again, opening the document, logging in to sign, logging in to finish. The only steps you get to skip if there's more than one document is the initial log on, and changing password. So with a passkey I just touch it a bunch of times and there's no password change.

Even if you are really careful, your details can always be leaked from a company server during a breach. If the companies adopt passkeys, that issue isn't there. Because there isn't a password anyone can randomly use. That's why I feel big tech companies are moving towards it.

Passkeys can't be phished.

That's the main point.

Phishing is a reeeeal pain. And something that needs to be solved. Not through training but with technology.

Today we use lots of accounts with unique passwords. Obviously these passwords have to be stored somewhere. So I disagree with you when you say it's a unique passkey thing.

Passkey has an advantage when it comes to phishing because it doesn't totally rely on human intelligence or state of mind.

From a personal experience my data was leaked online, not because of phishing or I was careless. but it was leaked from a well known third party site which I used. They were affected by a very serious breach. Many unlike me use the same passwords for their emails and stuffs. But in case of passkeys there isn't a shared secret. A breach will be useless.

KeePassXC supports passkeys directly through the Browser Integration service.

https://keepassxc.org/docs/KeePassXC_UserGuide#_browser_passkey_support

There you go. Local, serverless passkeys in the software of your choice.

You can? At least I do that. I host vaultwarden myself and store the passkeys there.

Passkeys to me are just a better way to autofill in login data.

lets just hold the line of "the answer is always username/password + second factor".

could be username/password + totp..

could be username/password + passkey..

if someone figures out my password, i dont lose everything..

if someone steals my passkey, i dont lose everything..

even if i do use the same password for everything, the second factor has it covered.

(nobody will ever guess my password of ******** anyway!)

Currently I use a FOSS (I think?) password manager, BitWarden, that supports passkeys. I use it across Mac, Windows and Android so I'm while my passkeys are locked yo the password manager, I am not locked to any of the aforementioned megacorps.

This is a big one. Lock-in and the threat of provider blacklisting means it will remain a shortcut like SSO (“sign in with ____”) until we’ve established federated providers.

On further reading, this may not be as far off as I thought. Passkey registration providers can be OS-level but browser and password manager based solutions were intended (overview from FIDO alliance). And it looks like KeePassXC has begun rollout of their own. If I’m reading correctly they currently “piggyback” off of an OS-based provider in various ways, so it’s not yet an end-to-end implementation, but these are early days.

That's not the biggest disadvantage "if used properly." Any account you have should get a passkey on every device you own. Each device has it's own passkey system. If you have an iPhone, yeah, you get an apple passkey, but then if you have a windows laptop, you have a microsoft passkey, a FLOSS system will have it's own, and so on. You are already on whatever system would contain the passkey and can easily add different ones each time you get a new device.

The biggest issue is that most people use a small number of devices (including many who use 1). Passkeys work best if you have many devices, so if you lose one, you just use another to access your services. If you have 1, you need to use recovery codes (and people don't save them).

That hasn't been true since password managers stored passkeys, which I've been doing for years. That objection goes into the trash. 🗑️

Your password hashes (assuming they even hash them) already live on their servers...

I really don’t want to turn my devices into hardware keys. I can’t imagine how difficult it would be to recover if, say, there was a fire or flood. Hardware breaks, gets lost, stolen. How about people who can’t afford multiple devices? What about the unhoused? How about if you get arrested and your one device gets confiscated- you can’t even give anyone else access to your data. What if you’re a good witness recording something and the police decide to make your device into evidence (or destroy it).

MFA? Absofuckinglutely. I’ll pass on passkeys, sorry.

I mean, I wouldn't mind if I could use my flipper for it, but the big issue is "if flipper break get fucked." I can back up my .kdbx file in 14 luks encrypted locations, I can't backup a whole ass flipper as easily.

Might I suggest Bitwarden.

It's open source, syncs across every platform I know of, and supports passkeys.

Thanks to our dystopian hellscape we live in it'll become mandatory just like useless online ids. I hate having to explain passkeys to my family. Some fuckface suit who doesn't use it properly pushed for a portfolio addition.

Personally, I found that It works well with Microsoft, Paypal, Google, Shopify and Proton. I was really surprised to find the option on German government sites, worked there as well. Tested in Ungoogled Chromium and Librewolf. The only thing I find dissappointing is adoption

Most of the sites I've seen use it as the single auth source. That said, using multiple forms of authentication in a layered model only improves security.