- cross-posted to:
- technology
- [email protected]
- cross-posted to:
- technology
- [email protected]
cross-posted from: https://feditown.com/post/744772
You must log in or register to comment.
Every time I’ve tried to understand passkeys I either don’t get it and it’s scary to potentially be locked out or I do understand it and I still find it scary to potentially be locked out.
Even 2fa is tricky.
If my phone is stolen and I don’t have my laptop with backup codes, then I’m not getting into my accounts.
What if both are stolen or damaged at the same time?
Bitwarden has a passkey service + a paid totp service, so I can always use either to log into whatever within two clicks. Yeah it’s less secure than a physical keychain but… Whatever, it’s better than passwords and as easy to use.
In any case, if you atore the backup codes in a place where you can lose them, that’s on you. Upload them into somewhere you control that has good privacy laws.
Seems to me the whole argument boils down to “they (the passkeys) are generally saved in proprietary non-communicating stores”, which is fair. But then the problem is not the passkey, it’s the fact that we (as usual) give all our stuff to corps. It’s the eternal struggle of easy of use vs. better security.
I host my own vaultwarden btw 😊
I’d be interested in a discussion of his points here :) those sound like valid points he’s making
edit: I think I’ve misunderstood the point of the article. He is saying passkeys are dangerous for people without password managers, therefore for most people passwords are still better (since most people don’t use password managers). It’s not so much a problem with passkeys, but the lack of password managers.
Even in the best case scenario, where you’re using an iPhone and a Mac that are synced with Keychain Access via iCloud
Surely the better-case scenario would be using a password manager?
The article doesn’t address the recommended use-case of passkeys + password manager, which makes it kind of irrelevant.
But that is exactly what he recommends, using a password manager - with one time email authentication for the first login as an extra step, right?
edit: I think I’ve misunderstood the point of the article. In a non-obvious (to me at least) way, he is saying passkeys are dangerous for people without password managers, therefore for most people passwords are still better.
The problem with passkeys is that they’re essentially a halfway house to a password manager, but tied to a specific platform in ways that aren’t obvious to a user at all, and liable to easily leave them unable to access of their accounts.
Agreed, in its current state I wouldn‘t teach someone less technically inclined to solely rely on passkeys saved by the default platform if you plan on using different devices, it just leads to trouble.
If you’re going to teach someone how to deal with all of this, and all the potential pitfalls that might lock them out of your service, you almost might as well teach them how to use a cross-platform password manager
Using a password manager is still the solution. Pick one where your passkeys can be safed and most of the authors problems are solved.
The only thing that remains is how to log in if you are not on a device you own (and don’t have the password manager). The author mentions it: the QR code approach for cross device sign in. I don’t think it’s cumbersome, i think it’s actually a great and foolproof way to sign in. I have yet to find a website which implements it though.
I use passkeys and find them great, mind you I know that you need at least 2 of them so you have a backup. I also use yubikeys at work and they are the same issue, you need 2 of them in case 1 breaks or gets lost.
Maybe the setup should be, make sure you have 2 passkeys on 2 different devices? but not in your password manager
Still, it makes adding new devices much more of a hassle.
