Passkeys give me anxiety because it’s like “Hope you can go the rest of your life without a phone or USB drive getting lost or stolen LMAO”
Use a password manager like bitwarden et al.
Passkeys mean a spread of enshittification to ever more areas of life. Specifically, they
- force me to use an extra OS on an extra device and keep it around just to use a site with passkeys.
- add insecurity and inconvenience. I neither can backup the passkeys nor use them on another device. (That’s not implemented on Windows.) This user experience is laughable in 2026. The passkeys are forever locked on the device where I created them. I am forever chained to exactly one device. If it breaks down, my life ends because our lives depend on digital technology.
- take away control from me and force me to trust third parties. I have to trust the hardware, the OS, the proprietary software, which makes me feel very uncomfortable as someone used to use Free software. Security by obscurity was always a bad idea.
- deny me anonymity and control over my accounts. I can have only one account per domain.
- are a black box with no user interface. With passwords I know exactly what account name and password I enter at which site. With passkeys I get asked for a PIN. That is all. There is no indication what exactly I authorize. This is a lot like clicking links in emails and giving your banking details to everyone who asks.
The recommendation “do not use them” is cute. They are forced on people. I can’t choose.
I’m not familiar with any of these limitations that you described. Those might be limitations of the specific credentials manager(s) that you’re using. You might want to try a different one.
Yeah I’m confused. I also don’t remember ever using a site tha would force use of passkeys. I always have standard TOTP alongside those.
some of this is disingenuous. For example you’re supposed to make multiple passkeys for your devices so that you can still Access your Accounts even if you lose your Main device (Ofc its still shitty because this forces you into the cloud if you only have 1). Also thats why the passkeys being bound to their „birthplace“ is Not really more of an issue than the others. Also im Not sure where they are forced? In fact i wish it would be more supported in certain apps
Indeed. Every device should get a passkey. Its like client certs where you can lose a device and just remove that passkey from your account. Also, you /can/ store passkeys in pure software. Bitwarden can store passkeys for example. Lots of options for FIDO keys too. I have never heard a non technical person give me a secure password strategy. That is 100% of nontechnical people I have asked use bad password schemes. Passkeys at least enforce a truly randomly generated key.
They still suck at usability but it is an attempt to solve a real problem. Basically the only thing standing between 99% of people and having all their accounts compromised is service password attempt rate limiting.
You think an everyday user will think this way?
That’s how they work, regardless of how users think. Though you’re correct: the majority of computer users don’t understand what they’re doing and do feel threatened by change, even if that change is positive by any measure other than “I feel uneasy about changing something I have no grasp on”.
Regardless of if a regular user will think this way or not, it is good to have options, precisely for providing them as an option to a regular user, even if they end up not implementing them. The other option is NOT having the option. Which one do you think is more beneficial across the board?
For example you’re supposed to make multiple passkeys for your devices How do I do this? Can you link to a guide?
Also im Not sure where they are forced? The big transition is underway. Switch to passkeys or you are out.
Log in to a website that supports passkeys, go to the account security page, press add passkey. Your browser looks for connected security keys to add the passkey to or if you have an extension installed, it might start your password manager. in the security key case; It asks for your pin and it’s done. If you use a password manager to store it, it will ask you where to put it. Once done; you can repeat and add any number of passkeys to your security keys or database. You should do at least two, for redundancy.
I would not tie my passkey to windows/ios/android or whatever. I won’t let a third party manage or sync them. Only on a security key I own or my password database.
Zero trust is the end station, if you allow organizations to treat your personal devices as being theirs. Organizations that could actually benefit from the increased security (which isn’t Twitter, except for some high-profile individuals, maybe), should provide the user with resources to do so, at their expense (issuing a dedicated TOTP device for example).
But what tends to happen instead, is enshittification of service, while offloading it onto the client. A similar trend can be observed with car parking: where operators remove parking meters, and require the customer to use their device and data plan, to make a payment to the operator…
We’ve been on this trajectory for quite a while now: from Outlook enforcing IT-policies of email administrators (dictating screen locking requirements as device administration app), to SMS-based 2FA requiring one to have a mobile phone number and tying all to this tamper-resistant identifier. So why not a black box snitch, paid for by the client, further restrict their freedom for “security”?
It seems perfectly in line, and I think this article draws all the right parallels.
An attempt to make an image describing where passkeys live:
It’s funny because I can’t see it and when I view the code of your post and copy/paste it into the location bar I get the broken jpeg picture.
Edit: At the time of upload it was a png. I guess lemmy.zip made the choice to convert it.
It’s even more apropos that the fediverse behaves unpredictably when uploading images.
Passkeys in a nutshell: how does it work? Idk. Who’s in control of it? Idk.
I wasn’t able to see the image because it’s an avif. What a weird format and choice of format.
Apropos of a discussion about over complicated unpredictable passkey behavior.
As far as I know using a password manager such as KeePassXC or Bitwarden solves all of these problems?
The way i understand it is that remote attestation (main point of this article) makes it possible for services to deny unapproved software. They can deny off market devices, operating systems, or certain password managers. So even if you use password managers you mentioned, if you’re using off market OS (e.x lineageos) they can deny access. Here’s a quote from the article “Remote attestation lets a website demand cryptographic proof that your device, operating system, firmware, and passkey manager are all on an approved list.”
Hm, so similar to websites blocking user agents now.
It’s more like how my bank has started locking users out of online banking if they don’t have the mobile app for authentication, and preventing the mobile app authenticating the user if they’re running a non-approved version of Android like GrapheneOS. Try to gain digital independence and all these mechanisms will be used to shut you out of everything you need. Only thoroughly locked-down and surveiled devices will be allowed to access useful services.
Make that question mark a period, good sir/ma’am!
and your redundant 3-2-1 backup system of that. Everyone knows that! Surely no one has no backups. Oh well, can’t design around that unpredictable problem that no one could guess. Everyone has backups!
I mean I would hope so, but losing a password manager database sucks regardless if you used passkeys or not.
So it’s HDMI for login? Thanks, I hate it.
Please just stop using a service when it gets unbearable. There is no online service you -need- except maybe bank and tax stuff.
And for the bank, you can always switch to a better bank.
The problem isn’t you or me, the more technically aware… it’s when the majority of users switched to passkeys and then subtly get switched to attested passkeys and sites don’t offer other choices. Once the majority are under-thumb, sites won’t have a reason to offer open solutions to the same number of objectors.
This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites. But the FIDO Alliance standard makes attestation a part of the passkey ecosystem, whether you want it or not. And even if the website doesn’t require attestation now, simply by using passkeys you indicate to the website that your setup supports the FIDO Alliance’s passkey standard and that you as a user are capable of using passkeys.9 This means that once Twitter (formally X) is satisfied that the overwhelming majority of its users would be unaffected, they can flip the switch – perhaps not all at once, perhaps just for ten thousand users at a time so as not to cause a fuss – and start rejecting non-attested passkeys.
Critically, remote attestation requires the co-operation of your cryptoprocessor, your passkey manager software, your device’s operating system, and your device’s firmware to all pass the remote attestation check. After all, your phone’s operating system has total access to all the 0s and 1s in every app that’s ever run, so it’s not enough for Twitter (formally X) to trust your passkey manager if it can’t even trust your phone’s underlying operating system. If any single one of those things were to fail – say, because your phone stopped receiving security updates so you installed a custom operating system like LineageOS to keep yourself safe without having to buy a new device – then Twitter (formally X) will be able to notice and prevent you from logging in.
Remote attestation can allow them to verify that your device is not capable of, say, sending and receiving encrypted messages, or running a competitor’s app, or using social media without verifying your ID. They don’t want you to be able to turn off the mandatory built-in AI image scanner on your phone that scans everything your phone sees for nudity. (Yes, I’m serious.)
The convenience of using passkeys is a double-edged sword.
This is also one of the ways Playstation stops you from installing Linux and other unauthorised software on the PS5.
So… Uh… What’s a passkey? The article is saying they’re pure evil. Everyone here is saying they’re good. Everyone knows what they are except for me.
What’s the difference between a passkey and a password?
Password is a shared secret: When you want me to prove myself, i repeat the password we both know. Both of us could loose that password and it happens every day. Can’t go a day without a major data breach news.
passkeys use public-private keys. Anyone can posses the public key, so that is ok to leak. The private key you keep to yourself. When you ask me to prove myself, you hand me a challange which i manipulate with my private key and hand back to you. You check it with the public key and conclude that i am indeed the one that posseses the private key. Mathematical magic! The private key was never shared.
For the user, the password is replaced with a file stored somewhere. Either in your usb security key or in your password manager of choice. Stored in a security key (aka authenticator), the private key never leaves the authenticator and all cryptographic operations are done inside it. The private key can’t leak. Amazing! Passkes in a security key are called hardware bound, very secure and nice. The security key, you can plug out and take with you. There are built in hardware like this in phones and computers. But you can’t take that with you. That sucks. They only authenticate that device. But you can make any number of passkes for all your devices.
The bad part is that some big corporatins would like to control where and how you can store the passkeys and preferably make it harder for you to escape them. The solution is to not use the services of these malicious corpos.
Nice explanation!
Can you elaborate on this part?
some big corporatins would like to control where and how you can store the passkeys
Attestation means that whatever code runs on your authenticator has been submitted to the FIDO Alliance (google and buddies) and they signed off on it. After that it can’t be changed.
Security keys like the Solokey Hacker (the superior version), is not signed and never will be, cause I can tinker with it in any way I wish. It’s truly mine.
Like the article highlights, attestation is part of the standard. The remote service can ask for cryptographic proof that your authenticator, where you stored your passkey, is attested. I have not seen any service doing that so far. IT managers are doing that internally, for their employees for sure. They don’t trust bobs homemade solution, only their chosen vendors. From that standpoint it’s reasonable.
This gives the service the power to deny you freedom of choice of where to store your passkey. They might say only yubikeys allowed or only microsoft hello or only IOS secure enclave or whatever they wish. It might become a scenario where they don’t allow any passkey solution that can run outside their platform. Running LineagOS or Linux? Google and microsoft will say it’s “not secure enough”.
They will abuse that power to make your decision for you and lock you in. “Password manager not allowed, Use our cloud insted”.
Ideally it’s not part of the standard and they don’t get the option of knowing anything about your authenticator. It’s none of their bussines how i choose to store my secrets.
Any sane service will just not ask about the attestation. They don’t have to ask. I would not ask my users on my webpage. You can store your passkeys on printed paper for all i care. Although, storing them on a usb/nfc key is pretty damn secure and cool!
Very cool, I didn’t know about Solokey.
Thanks for mentioning it.
I’m trying to reconcile corp IT doing it being reasonable, but it shouldn’t be in the standard. If it’s not in the standard, how would they do it?
Personal anecdote to illustrate: the last time I tried creating and using passkeys for my Google account, I got the impression they (Google) would only accept keys coming from either Google Authenticator (their 2fa smartphone app) or something like macos’s built-in keychain. No way to give them a key generated using a local, offline service that I could store however I want - it needed to be accessible using, basically, a big corpo['s software] as the intermediary. This coming from how their website would request the keys from my browser (which means mozilla seem to be in on it as well :/).
Given that I currently use a pure file-based password manager that I can move around and switch the keys for as I please, the current state of passkeys feels like a step back in terms of allowing me to control my digital identities.
It sounds like your browser is not hooked up to your password manager. I’m not sure how you want it to work if the browser APIs the website needs don’t have the required plumbing.
That does not mean the standard or Google have locked anyone out of the ecosystem.
EDIT: seems like it’s both simpler and more complex than I thought to achieve what I want. https://codeberg.org/PassFF/passff/issues/581 suggests it is “just” a local tweak. At the same time, any search I make for finding an actual implementation guide for authenticators is buried under pages of results for using passkeys in your own web app. The ecosystem’s current state seems to be “don’t bother, just trust us!”. Even the damn “passkeys.com” site is a barely disguised ad for OwnID.
I dunno, the browser could open a file picker and let me point it towards the passkey, or perhaps let me paste the key contents into a field?
It’s been several months since I looked into it, so maybe things have changed since, but I don’t see why the browser has to be hooked up to my password manager through a mechanism that seemingly can’t be user-piloted nor user-intercepted. How does a browser API require some external third-party software to be installed and configured to work?! It’s a public/private key pair at the end of the day, right? Not some novel algorithm, protocol, or whatever. Why can’t I simply tell the browser “here is where my existing passkeys reside; place any newly generated ones here as well”? Or perhaps “here is the program to call and here are the arguments to supply when you need to create and/or retrieve a given passkey”?
I don’t think I have claimed the standard itself is locking anyone out - let me correct that if I did. I have just not found a way to not be locked out of the feature itself in the products of big players like Google - my Google account(s) being the one service where I feel like I could actually benefit from using passkeys over passwords (not to mention one of those I have seen pushing the “replace all your passwords with passkeys!” messaging).
To be specific, my password manager is http://passwordstore.org/, (“the standard Unix password manager”).
So in order to log into most websites, you need your username/email address and a password.
You can save your username/password in your web browser or in the cloud.
Sometimes people get lazy and reuse passwords, sometimes people forget their passwords.
Passkey is a replacement for usernames/passwords. It does require that the passkey is saved somewhere, often on your device (in the cloud is possible, but non-standard).
When you “create” a passkey, this passkey is used only at a single place. For example, you’d have a passkey for your bank, another one for your email, another one for Lemmy. You have no say in the matter, that’s just how it works.
When you log into a website that has passkey enabled, your passkey/password manager pops up, you click on the passkey and that’s it. There is no email address, there is no password, no MFA.
edit: oh, you also asked about the difference between passwords.
It’s all about improved security.
You go to certain websites, and they’ll only allow a-zA-Z0-9, others require a minimum length of 8 characters, needs 3 symbols (except ! for whatever reason ;)
Then you have no idea how the website is storing your password. Are they encrypting it? Did they do it correctly?
If you look at the number of “breached/leaked” passwords on the internet, it’s because it’s hard to securely store passwords.
Passkey solves all this. Websites are just given “a public key” and it can be “just stored”, no special treatment necessary.
This is still fuzzy. What would this look like in BASIC?
10 PRINT "So in order to log into most websites, you need your username/email address and a password." 20 PRINT "" 30 PRINT "You can save your username/password in your web browser or in the cloud." 40 PRINT "" 50 PRINT "Sometimes people get lazy and reuse passwords, sometimes people forget their passwords." 60 PRINT "" 70 PRINT "Passkey is a replacement for usernames/passwords. It does require that the passkey is saved somewhere, often on your device (in the cloud is possible, but non-standard)." 80 PRINT "" 90 PRINT "When you "; CHR$(34); "create"; CHR$(34); " a passkey, this passkey is used only at a single place. For example, you"; CHR$(39); "d have a passkey for your bank, another one for your email, another one for Lemmy. You have no say in the matter, that"; CHR$(39); "s just how it works." 100 PRINT "" 110 PRINT "When you log into a website that has passkey enabled, your passkey/password manager pops up, you click on the passkey and that"; CHR$(39); "s it. There is no email address, there is no password, no MFA." 120 PRINT "" 130 PRINT "edit: oh, you also asked about the difference between passwords." 140 PRINT "" 150 PRINT "It"; CHR$(39); "s all about improved security." 160 PRINT "" 170 PRINT "You go to certain websites, and they"; CHR$(39); "ll only allow a-zA-Z0-9, others require a minimum length of 8 characters, needs 3 symbols (except ! for whatever reason ;)" 180 PRINT "" 190 PRINT "Then you have no idea how the website is storing your password. Are they encrypting it? Did they do it correctly?" 200 PRINT "" 210 PRINT "If you look at the number of "; CHR$(34); "breached/leaked"; CHR$(34); " passwords on the internet, it"; CHR$(39); "s because it"; CHR$(39); "s hard to securely store passwords." 220 PRINT "" 230 PRINT "Passkey solves all this. Websites are just given "; CHR$(34); "a public key"; CHR$(34); " and it can be "; CHR$(34); "just stored"; CHR$(34); ", no special treatment necessary."I wish I could give more than one upvote for the commitment to the bit on this.
No, I mean the actual code. It’s been decades since I’ve used BASIC but a password programd would look vaguely like this:
10 x=1234
20 Print “What is the password?”
30 If user input equals 1234 goto 60
40 Print “Incorrect”
50 Goto 20
60 Print “Correct”
Your 1234 example is stored in plaintext, which is bad practice but still happens sometimes. Usually 1234 will be hashed (irreversible and functionally unique string) and the user input gets hashed with the same algorithm to check against the server’s stored hash.
Passkeys are fundamentally different and work with public-private key pairs. It’s not possible for your public key to be “stored incorrectly” because it’s meant to be public. Your private key stays private and you never have to send it to the server to be checked against what they have stored. Instead, the server sends you a mathematical challenge that you solve with your private key. The resulting answer is also irreversible and functionally unique, but in such a way that the answer can be checked with the public key to make sure it was solved by the associated private key. It’s really clever math that’s worth watching or reading up on to understand.
I don’t understand the maths well enough to give you a pseudocode example, but I always found trying to simplify it made it difficult to understand anyway. Every analogy ended up falling short because it was an analogy and not what was actually happening under the hood.
Imagine instead of inventing and storing passwords in your head and typing them in each device. With passkeys each device generates a real, cryptographically strong password for each site and stores it in a secured part of the device. Nothing to memorize.
Sites must now to let you have many passwords so you can have many devices without needing to sync between devices like a password manager might do.
No one can guess your password and it is never reused because they are machine generated. They are protected on device by the security of your device (typically behind a pin) so if you trust your OS, it is safe (which, in effect is the same as passwords you type).
Unfortunately, the experience still sucks and shitty companies might use them to further lock people in if they end up with all their passkeys on one iphone, for example.
Oops, I lost my device or bricked it, now what? Login with passsword? Password reset?
Password reset, and your mail account used for that is secured by a passkey 😬
Please send a blood sample to Google Gemini to confirm your identity.
Microsoft has been a major annoyance on me with passkeys. I don’t like not knowing for sure that I can get back into an account if any of my devices get fucked (authenticators are nice and I do have some things setup but always worry if my phone is broken or lost out of nowhere). They (Microsoft) have such a dark pattern way of pushing passkeys. When I have to help someone get into their MS account at work (normal consumer PC stuff not IT/corp stuff) which is already hard since the people I try to help already don’t tend to realize how important even simple things they don’t think about WILL fuck them later. Some examples are stereotypical “boomers” that default to adding their land-line when an account asks for a phone number, or that they were even making an account (another dark pattern from Windows 8 where sooooo many people created @outlook.com accounts without really paying attention).
Obviously I experience a higher than average amount of tech illiterate folks (that also seem to just not care like shit is still the Windows 7 and earlier times). But Microsoft pushes dialog prompts/boxes for physical security keys and passkeys in a way that at first seems like the person has one of those setup. In some cases trying to sign into an account without a passkey/security key it will do what I expect. Give an extra option to not keep using a password or password+text/email code, or setup passkeys to “not have to worry about remembering passwords”. Though I still think they don’t really clearly explain how crucially important it is to make sure the person’s information for the account is correct and making damn sure to know recovery options if anything happens.
But I started seeing just a box pop-up that looks like a system prompt that only gives two options. Enter your PIN/insert security key, or to use the authenticator app. No obvious option for picking that neither are setup. The only way for not using those is to click the X on the top-right of the prompt. In some cases I have seen people click on the options and it just acts like they are setup. Pick the authenticator option and it asks for the code on an app/device that doesn’t exist. In the cases that it does start the process of setting up passkeys, I still feel like they are trying to trick people into it rather than the users choosing to do it.
Again I deal with more than average “I’m not a ‘techy’!” kinds of people along with older folks. But it really does seem like any level of tech literacy keeps getting worse based on running into more and more people of all ages. Which is what freaks me out about how these things are suddenly seemingly pushed on folks at the worst moments. A lot of people first trying to setup their new device just want to get into it as fast as possible, and really don’t understand how they can just lose access to so many things they didn’t realize are now tied together. Let alone be aware that they should export those things to something that isn’t tied to the OS in the event they for some reason want to get something else (PC to Mac/Mac to PC/Android to iOS/iOS to Android/etc).
Sounds like a turbo encabulator.
Also, that website is full of sand traps. Every time I accidentally mouse over something, a huge menu covers up the definition.
Imagine if a romantic partner said “I will send you a unique string, probably exactly 8 characters” to verify that I am your partner. You would laugh and remind them it takes less than a second to generate every 8 character combination possible.
Instead, your SO makes a key and keeps it with them at all times, and you promise to talk to them using a machine that makes secret messages only their key can decipher. For fun, they give you a key and make a machine too… Explaining this shit is complicated I’m sorry for what you’re about to read.
They send “heyy”, You send “whatup”, They send “send pics”, You take one, encrypt and send the pic, They say “huh? Wtf?”, You remind them about the secret key, They have no idea what you’re talking about -fail OR they send something in return back (which you decrypt) -success
That’s basically the same thing as authentication with a passkey oversimplified and only slightly wrong but good enough. There’s shitloads of devices that do it, yubikeys, authenticator apps, but they’re all doing that.
As the article states, they’re an extremely malicious solution to a problem that has better, simpler, and easier to understand solutions.
It’s also a very good solution to the “problem” of users being able to do things our corporate overlords don’t want us to do.
In short, they’re even worse malware than the ones they’re sold as protecting us from.
Enshittification manifest.
problem that has better, simpler, and easier to understand solutions.
Can you give an example?
Amazon/whatever login:
- email: koalalover@schmeemail.com
- password: hunter2
Email login:
- username: chlamidiyasux
- password: hunter3
There. You’ve solved 90% of online fraud that begins with website(s) leaking your credentials and someone combining leaks to gain access to everything in your life via your email (including bank, socials, porn habits, whatever).
How do you suggest enforcing it?
Enforcing what? It’s up to your email service to adopt the change. The way it currently works was probably okay for the early days of the internet when people had just started using emails, but now that so much private and sensitive financial information passes through your email account, it makes little sense that the same credential you use to login to your email account (email id) is also what you must use when some random website forces you to register in order to access it, just so they can send you massive volumes of unsolicited spam.
Certainly a simpler change with more potential to do good relative to the ease of enforcing a convoluted passkey-slash-usb-slash-save-this-file-somewhere-safe implementation
I don’t understand what will stop the users from using same passwords for both services
Then you’ve missed the point of the change entirely. Splitting email addresses into public and private-facing addresses is one thing. Reusing passwords is entirely another evin if both are related to securtity.
It’s something you pass around–like a word, but a key instead. If you’re familiar with passwords–instead of a word–imagine a key: a passkey. That’s what passkeys are. The issue with passkeys is–as you pass them around they begin to open more and more stuff; everyone is opening stuff with your key as it’s passed. So they need to be sanitized every now and then. Deposit them into a furnace and buy a new passkey. Every two to three days. If you have more questions please feel free to ask!
Okay. I think I’m understanding. A passkey is a virtual key? That we have to buy? And some company makes these virtual keys? And there’s a virtual locksmith who makes virtual locks? And you have to hire them to install them on your computer? Is this what’s going on?
I apologize. The reply you responded to was entirely satirical. It was written in frustration. From my point of view passkeys are the way to do authentication. More specifically public-key cryptography. It has a lot of desirable qualities. Governments and ‘tech platforms’ should have been using it from the start–we’ve had the software to do this since the 1980s and it was libre-software by the 1990s.
Any criticism of passkeys (as brought up in this thread) are more so applicable to the private-dictatorships that are Microsoft, Apple and Google. The contrary behavior of continuing to use these private-dictatorships whilst decrying passkeys is tantamount to hypocrisy? stupidity? To give a tiny bit of context: the quality of attestation in passkeys are also applicable to SSL-certificates, yet no one is decrying SSL-certificates. It’s also applicable to every GNU/Linux distribution and libre-software at large.
That’s to say the criticism is written from a place of ignorance. “Privacy” forums on the internet are not interested in reality. Their users are full of users with static behaviors. More often than not any questions asked in these places amount to “how can I continue doing what I was doing before? Big-corp has introduced a change I don’t like. I want to do the exact same thing on big-corp that was previously permissible.” When the factual observation is stated: “big-corp is a corporation designed for surveillance-capitalism therefore if you desire liberty and privacy whilst computing you cannot use such a corporation in any manner” it’s met with unfounded hostility, hypocrisy and lies. Any use of such software is contrary to your stated desire: digital-privacy. Even when responses illustrate how you could achieve what the OP wanted, but with libre-software and privacy-preserving-software you’re often met with: “no. I want to use Google/Microsoft/et al.” Users are lazy idiots.
Technical and correct responses are ignored whilst a flood of ignorant, emotional or status-quo enforcing responses are brought to magnified attention. I’ve abandoned restraint and started to shitpost as every one else appears to be doing.
I suppose this is all a criticism of ‘social-media’ and how it’s a waste of everyone’s time.
That’s to say the criticism is written from a place of ignorance.
The praise is also written from a place of ignorance too. People love it and they don’t know what it is. If you can’t explain it to a five year old, then you don’t understand it. And if we don’t understand, it’s a horrible idea to fork over our security to it. We don’t want to rely on a box full of ADE 651 bomb detectors.
You’re an idiot.
Are you serious?
No. Sorry.
dude speaks about not being able to write down his passkey, then he acts like it can only be saved in bigtech clouds, then some random ai rumbling starts about ads being show to us? can you guys stop posting these god damn fearmongering password articles written by ai?
That seems to miss the main point of the article, which is that Passkey standard has attestation procedure built in. A site that uses Passkey can verify the flags you set and deny your access if you use unapproved device, operating system, old kind of secure chip or, say, allow your passkey to be shared between devices.
finally people are waking up to this garbage.
I didn’t even know what they were until now. And still don’t. Every explanation sounds like a long convoluted MLM pitch. They smell fishy as hell. They may need more grameters to prevent side fumbling.
Healthequity tried forcing this passkey garbage on me, and they wouldn’t allow me to manage investments over the phone, so I ended up transferring everything to a different HSA provider. Not giving in. I love TOTP though.
Based
It’s wild seeing people spaz out over passkeys, clearly venting at something that isn’t passkeys.
I suspected as much, being shoved on us like AI.
you do not have ultimate control over your passkeys.
Looks like it boils down to that? Because I just started using a few and they’re on my self hosted vaultwarden so…
