Why passkeys are a step back for personal security: examining account lockout risks, platform lock-in, hardware key limits, and fragile recovery flows.
  • audaxdreik@pawb.socialEnglish
    1·
    1 month ago

    This article does a great job of articulating a lot of the uncomfortableness I have around passkeys. I’ve always said they make a lot more sense in an corporate environment but the level of control you lose in a personal setting is not commensurate with the protections and possible lock-in they offer.

    I just don’t like passkeys. They are an overly technical solution to what is mostly a human problem.

  • ouch@lemmy.worldEnglish
    1·
    1 month ago

    Good article.

    Currently passkeys are too much of a vendor lock-in to big tech.

    Bitwarden support alone does not change that.

    • Clusterfck@lemmy.sdf.orgEnglish
      1·
      1 month ago

      Microsoft 365 implementation of passkeys is sacrilegious somehow.

      It requires only the Authenticator app from Microsoft and can use nothing else to create the passkey. The way this is implemented on iOS means that Authenticator comes up as an autofill option BUT IT ONLY SUPPORTS M365 and is useless for anything else. Leave it to Microsoft to take an open standard and bastardize it to the point of it being MORE CONVENIENT to just type a damn password.

    • turmacar@lemmy.worldEnglish
      1·
      1 month ago

      I agree the passkey user experience needs work, but man do I enjoy it over the haphazard ‘passwordless’ website login that just sends you an email.

      I get it, they’re just skipping an attack vector and basically relying only on ‘2FA’. But now I have to go to a different app/tab, copy a code, and return to the site instead of letting the password manager fill stuff in for me. Some, like kickstarter, let you still have a 2FA code enabled so you have to grab your code from whichever authenticator and go to your email. Really nice login experience out of nowhere one day. \s

  • kestrel7_7@lemmy.worldEnglish
    1·
    1 month ago

    I appreciate this article. Passkeys kinda came out of nowhere to me and I haven’t liked them since day one. So it’s nice to have my gut feeling vindicated with some actual info.

  • warm@kbin.earth
    1·
    1 month ago

    I think their biggest weakness is the vendor lock in. Using a 3rd party password manager is the best solution for most people, so they arent locked to their phone. But they are right in saying none of it is quite ready.

    I think the article is forgetting, they are password replacements, not account recovery replacements. Realistically, people are just as likely to forget a password, and account recovery proceedures still have to be in place. I dont see the issue there.

    Passkeys are good they are just being pushed before properly fully developed, but we are slowly getting there.

  • sunbeam60@feddit.ukEnglish
    0·
    1 month ago

    Love them.

    Using 1Password for sync.

    Never ever failed to connect to QR code passkey request, even on weird corporate networks.

    Portability has gotten so much better - there’s now a defined standard for portability that passkey providers are implementing.

    Honestly I cannot understand the criticism at all.

  • pleksi@sopuli.xyzEnglish
    0·
    1 month ago

    I dont understand the issue. Arent passkeys and password in any case just stored in a pw manager nowadays?

  • DJKJuicy@sh.itjust.worksEnglish
    0·
    1 month ago

    There is still nothing better than passwords.

    I don’t want my access to be tied to a specific device. Devices get lost, or break.

    I don’t want someone to be able to use my face or finger or eyeball to access my data. You can legally be compelled to unlock a device with your biometric security.

    So current biometric security sucks. And passkeys suck.

    Also, though…passwords suck for all the reasons that we all already know.

    There has to be some better method that the owner can have full agency over, I just don’t know what. I don’t have the answers.