5 ms·

I don't understand your concern. How is it more difficult to control the keys? Why is it less secure than 2fa solutions? Every worry I've heard about passkeys

I don't understand your concern. How is it more difficult to control the keys? Why is it less secure than 2fa solutions? Every worry I've heard about passkeys can be leveled at 2fa schemes as well. The upside of passkeys is they can't be phished, can't be revealed in data breaches, and can't be forgotten. What third company is involved? Are you thinking about syncing services? With the exception of Linux (for now), you can have passkeys enabled on any modern device. It is just public/private key sharing right? A bad actor would have to have your device and be able to unlock it in order to get access to your accounts secured with passkeys. Every time passkeys are mentioned on HN the FUD starts flying and people lose their minds. Passwords are terrible with many weaknesses. There isn't perfect security, there are always weaknesses but I have yet to be shown how passkeys are worse than passwords for typical users.

astrange 3y ago
> Passwords are terrible with many weaknesses. One being, when you're entering them on a phone in public, someone can watch you type them. This makes them easier to clone than biometrics.
- jrm4 3y ago
  Oh come on. You can CHANGE passwords. That's the the point. Passwords are safer not because they're bulletproof. They're safer because they fail elegantly. You can't change biometrics and that's why they're definitely worse. They might be acceptable as one of many factors, but they're absolutely the worst idea for a primary.
  - astrange 3y ago
    How do you know when to change the password? > You can't change biometrics and that's why they're definitely worse. Sure you can, you've got ten fingers and after that all it takes is a blowtorch.
jasonjayr 3y ago
My specific concern is the "tied to a device". The only devices that seem to support the keys are proprietary devices, that only offer to backup the passkeys to their proprietary services. I can't see myself using this unless I can store the passkeys in my own keepassx (or similar) system, that I can manage 100% the backup, replication + storage of myself, without any assistance from a 3rd party.
jrm4 3y ago
This presumes Google is never the bad actor, not a smart assumption.

astrange 3y ago

> Passwords are terrible with many weaknesses. One being, when you're entering them on a phone in public, someone can watch you type them. This makes them easier to clone than biometrics.

jrm4 3y ago
Oh come on. You can CHANGE passwords. That's the the point. Passwords are safer not because they're bulletproof. They're safer because they fail elegantly. You can't change biometrics and that's why they're definitely worse. They might be acceptable as one of many factors, but they're absolutely the worst idea for a primary.
- astrange 3y ago
  How do you know when to change the password? > You can't change biometrics and that's why they're definitely worse. Sure you can, you've got ten fingers and after that all it takes is a blowtorch.

jasonjayr 3y ago

My specific concern is the "tied to a device". The only devices that seem to support the keys are proprietary devices, that only offer to backup the passkeys to their proprietary services. I can't see myself using this unless I can store the passkeys in my own keepassx (or similar) system, that I can manage 100% the backup, replication + storage of myself, without any assistance from a 3rd party.

jrm4 3y ago

This presumes Google is never the bad actor, not a smart assumption.