Technology

This isn't a good article @ouch. It's dull, meandering and conflates issues.

Both Apple and Google want your identity anchored to their operating systems.

That's true regardless of passkeys and why is Microsoft excluded here?

Logging into accounts on devices you own is the ideal scenario for passkeys. When you have to handle a colleague’s computer, it gets much more inconvenient. You could plug in a hardware key, but you don’t always have access to the ports.

What sort of drivel is this? Is anyone reading the article? I doubt it. Sorry, I'm not logging into important accounts on a colleague's computer, regardless of being unable to squat and plug in a usb-dongle. The last statement even concedes that passkeys are an improvement for 99% of the user-population. It's an improvement for 100% of the user-population. Like usual this is just drivel generated from friction around 'newness'. It's different--which automatically becomes scary for some users. The writing is just not coherent and there's zero critique on passkey's design and technicalities, of which there are things to criticize.

Get a physical passkey and if you have more than 100 accounts you have a problem. Buy two and use one as a backup in case you lose your first. Keep it in a safe and if you forget your safe's combination... well, I guess we should abolish safes too: terrible account recovery support there. Yikes!

Passkey's themselves can be protected with a PIN--the software I've used does not limit it to numbers. It can be your 'master password' if you want. This is a technical complaint of mine as all software I've used reference it as a PIN (personal identification number), which means numbers only. Except other characters are allowed. I'm not sure what the official spec. states.

🎶Security is Theatre🎶

Good article.

Currently passkeys are too much of a vendor lock-in to big tech.

Bitwarden support alone does not change that.

Passkeys and 1FA were always just a duct tape solution for users resuing basic passwords without having to set a stronger password requirement or relying on users to use a strong password.

I think Chrome and Firefox should have decided on making an API for their builtin password generation and filling functions, that way any password manager would be able to integrate with foolproof functionality out of box.

People already use browser auto gen passwords for the reason that its faster and usually has an account sync built in. Now it would work with any 3rd party solution as well which covers enterprise and security minded users as well.

Users won't use a password manager if it means you have to manually make an entry everytime you make an account.

I really wish that SQRL had taken off, as it solved most of the problems noted. It was effectively passkeys that you generated on the fly based on your private key (which you can back up and restore to other platforms if necessary) and the website domain by scanning a QR code (or clicking rh QR code if your on the same device) and sends the signed challenge to the website to auth you.

No need to login to your manager on random systems, no issues with platform lock-in, no worries about dedicated hardware, no worry about losing your access if your device dies (assuming you backup your shit).

There is still nothing better than passwords.

I don't want my access to be tied to a specific device. Devices get lost, or break.

I don't want someone to be able to use my face or finger or eyeball to access my data. You can legally be compelled to unlock a device with your biometric security.

So current biometric security sucks. And passkeys suck.

Also, though...passwords suck for all the reasons that we all already know.

There has to be some better method that the owner can have full agency over, I just don't know what. I don't have the answers.

For users who previously reused passwords across all their sites, passkeys are a huge step-up.

That is exactly why passkeys are a good thing. Basically everyone reused passwords everywhere.

This article does a great job of articulating a lot of the uncomfortableness I have around passkeys. I've always said they make a lot more sense in an corporate environment but the level of control you lose in a personal setting is not commensurate with the protections and possible lock-in they offer.

I just don't like passkeys. They are an overly technical solution to what is mostly a human problem.

I dont understand the issue. Arent passkeys and password in any case just stored in a pw manager nowadays?