passkeys were invented for vendor lockin and will be used to add friction to migration, say if you wanted to move from apple to bitwarden well sorry you can’t. fido originally made the protocol to sell their dongles and fought like hell to keep them off smart phones, platform vendors are only interested in this to lock you into their system too. there is absolutely nothing wrong with normal passwords.

Was about to post the great blog post from my bookmarks, but another commenter beat me to it (t y !). Here’s comments on that blog post on Lobsters and HN :

• https://lobste.rs/s/gqoj5n/passkeys_shattered_dream
• https://web.archive.org/web/20240507211213/https://news.ycombinator.com/item?id=40165998

They’re FIDO keys but bad.

Here’s a great blog post from someone who knows what they’re talking about: https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/

they don’t work. Technically they do, but they are a major major pain to manage.

They’re better than passwords in that they really are phishing proof and well they are basically RSA key pairs that are generated, so they are naturally brute force resistant. Great for the majority because most people reuse their crappy password over and over again, ignorant of the fact that password managers exist just because they have to spend 10 seconds more to press buttons to generate a password and store them in the db. The tech is great as long as the user knows how to keep them safe.

HOWEVER: Since third party password managers (like Bitwarden, 1Pass, etc.) just recently started to provide support for passkeys, alot of people who wanted to use passkey on first release were locked into big tech bros like Google on Android and Apple on iOS’ solutions. And well that’s not good at all. The tech is great though, I’m all for it. You just need to know where to store them. Ideally, I’d store them offline on my device and that exists already but not on Linux (afaik) nor on Android are they a reality yet.

^They definitely are not more than secure than my yubikey though.^

Passkeys as password replacements reduce the total factors required to login to a service. If you use 2fa for all your services anyway then passkeys are a downgrade. That’s why so many people are angry they are having security options removed.

For people who use the same username and password everywhere, then passkeys are a upgrade.

So normal people get a benefit from passkeys in exchange for getting locked into a ecosystem.

For security minded people I hate passkeys.

• Less factors to login
• Discoverable
• • Unlike fido2 webauthn the service the credentials attach to have to be known, so if anyone steals your hardware key, or gets access to your phone they can see all the passkeys and accounts you have

I WANT my logins to be something I know, something I have, and something I am. Password, hardware key, biometric unlock of key.

I don’t mind passkeys existing, but I HATE that services are replacing hardware key flows with passkey flows. I want to use my hardware key as fido2 not as a passkey. I don’t want to downgrade my security! Microsoft makes it impossible to use a 2fa hardware key as a second factor now, only as a passkey, that’s strictly worse then before.

deleted by creator

I highly dislike the idea of a passkey replacing a password as it means you’ve lost the something you know and replace it only with something you have.

Passwords AND passkeys together sound great.

I would like to use it (or any biometric authentication at all) on Linux with my USB fingerprint reader (DigitalPersona 4500), but it seems broken in libfprint and the devs are unresponsive to their gitlab issues. Using a Windows VM just for fingerprint support is not something I want to do either.

If you care about privacy then you care about security; if you care about security then why would you ever use a password again?

I’ll use passkeys if and only if they work with my password manager (Proton Pass). If not, I’m sticking with the password (and 2fa if they offer it)

They are more secure than password authentication, though how much more secure depends on how the user manages their passwords.

If a user never reuses passwords across different services and maintains long complex passwords, preferably randomized strings; the security upgrade of Passkeys is quite marginal. Arguably marginal enough to not even bother. The farther a user gets from ‘ideal’ password security practices though, the more of a security upgrade Passkeys would be for them; though convincing them of that is another story…

Switching to Passkeys does take a lot of responsibility off of both the user and service provider. The user no longer needs to ensure passwords aren’t reused, insufficiently complex, or already compromised; and the service provider doesn’t need to worry about leaking your passkey as they only have the public key portion which can’t be used to login as you.

In some ways they can be more inconvenient though. With a password, even long unique complex passwords stored in my password manager; I can open the password manager on my phone, read the password I want, and manually enter it into an unfamiliar or shared device without having to load my entire password/key vault onto that device. Passkeys make that impossible; essentially forcing you provide the whole vault to the device or give up. It is also a big step for people that aren’t familiar with password managers and are used to just remembering their passwords, to then switch to a passkey manager where they can’t use their memory to login anymore.

There’s good sides and bad sides to everything really. Some people will prefer one way, some will want the other way. Ultimately I think we’ll get pushed into using Passkeys by most companies, just so they can shed some of the responsibility of keeping your credentials secure. A stolen passkey database, unlike a password database, would not allow you to pose as users, which leads to less claims of fraudulent activity.

I would very much prefer to use passkeys wherever possible. My password manager of choice Bitwarden also supports them. Unfortunately, Android 13 which I am running does not support setting a default app to handle passkeys. So I cannot access that functionality on my phone yet. I think in a few years I will be authenticating with passkeys for a lot of services. However there will be a lot of services that lag behind in terms of offering passkey authentication.

Since I use a good password manager. And use TOTP on everything I can. Which admittedly I do store in my password manager as well. I don’t think passkey really improves security very much in my case.

That being said though I’m a big fan of passkeys and use them everywhere I can. But I don’t store them on devices only in my password manager. So I don’t have to worry about if I lose a device.

I think where passkeys really shine though is for people who still aren’t using a password manager. While I’ve tried to get everyone I know using bitwarden most still don’t. And the ones that do still don’t have half of there accounts in it. They are still reusing passwords across multiple sites. So I think passkeys will massively increase security for the majority of ppl. And for those of us using password managers I still think its a slight improvement to convenience.

@bilbobaggins The good part: my self-hosted VaultWarden supports passkeys, so I’ve added them to everything I can. The bad part: Android does not support third-party passkeys on Android 13 and lower, and guess whose phone is stuck with 13 being the latest official release for his smartphone - that means that the websites that completely substitute the password with a passkey, such as PlayStation and Microsoft, are currently off-limits for me because I’ll end up locked outside.