4 ms·

> Maybe you misunderstand how they work? For me, it's precisely because I know I don't understand how they work. With a password, I can hold it "in my hand".

> Maybe you misunderstand how they work? For me, it's precisely because I know I don't understand how they work. With a password, I can hold it "in my hand". It's a string. I can export, and basically know that I have the whole thing. With a passkey, I don't understand it enough to convince myself that my password manager is not able to lock me out of my accounts. The test for me is whether I can copy some piece of data out of the password manager and use it to authenticate. If authentication has to "go through" the manager, then my access to my account is vulnerable to the whims of the password manager. Or perhaps the whims of the new corporate owners of the password manager. I've migrated passwords once from one password manager to another. I don't understand at all how this is supposed to happen with passkeys. I'll be holding out either until I can understand satisfactory answers to these, or until support for passwords gets dropped from services I use.

phildenhoff 3y ago
From looking at the 1Password app, exporting Passkeys isn't an option. that's a bit of a usability nightmare IMO, one which I hadn't considered. I'm still strongly in favor of passkeys overall, though. They don't need to be used for every service, but strong, safe, phish-proof asymmetric crypto being used for user auth just makes sense.
WA 3y ago
Good points, maybe 1Password will pull a Unity post-IPO and demand 1 cent per login. Right now, 1Password is really good, but who knows if it'll stay the same.
CharlesW 3y ago
> With a password, I can hold it "in my hand". It's a string. I can export, and basically know that I have the whole thing. Fair enough! It still seems a bit like magic when it works. > With a passkey, I don't understand it enough to convince myself that my password manager is not able to lock me out of my accounts. I'm not sure how a pass[word|key] manager would lock you out of your accounts, but if you don't use password managers for that reason, that same theoretical danger would be true of passkey managers. I don't personally have any of my extremely secure auto-created passwords memorized either, so for me a passkey is not different in that respect. If I inadvertently delete a pass[word|key], I'll have to go through the "forgot my password" process. Within 5 years, I can imagine services without password support. I'd expect that in "lost passkey" cases, those services will support allowing you to log in with a one-time code sent to your registered email address (or SMS) and/or with backup codes. > I've migrated passwords once from one password manager to another. I don't understand at all how this is supposed to happen with passkeys. Here's a real-world example: I played with Apple's passkey support before 1Password's passkey support was available. When 1Password added passkey support, I added another passkey to the sites that supported it and called it "1Password". And here's what it looks like when your Google account has 3 passkeys: https://imgur.com/a/NQl8XPI https://imgur.com/a/NQl8XPI
heavyset_go 3y ago
If you know how public key authentication works, then you know how passkeys work. Passkeys are private and public key pairs. Your password manager acts as the middleware between the keys and the software you need to authenticate with. You just need it to speak to services that use passkeys, and you can swap it out for anything that is able to do the same. Your "password manager" in this case can also just be a physical security key.
- recursive 3y ago
  Saying "I can swap it out" is different from me actually knowing what buttons to press to make that happen. It is at least partially lack of familiarity, but I'm not seeing how to do that with passkeys.

phildenhoff 3y ago

From looking at the 1Password app, exporting Passkeys isn't an option. that's a bit of a usability nightmare IMO, one which I hadn't considered. I'm still strongly in favor of passkeys overall, though. They don't need to be used for every service, but strong, safe, phish-proof asymmetric crypto being used for user auth just makes sense.

WA 3y ago

Good points, maybe 1Password will pull a Unity post-IPO and demand 1 cent per login. Right now, 1Password is really good, but who knows if it'll stay the same.

CharlesW 3y ago

> With a password, I can hold it "in my hand". It's a string. I can export, and basically know that I have the whole thing. Fair enough! It still seems a bit like magic when it works. > With a passkey, I don't understand it enough to convince myself that my password manager is not able to lock me out of my accounts. I'm not sure how a pass[word|key] manager would lock you out of your accounts, but if you don't use password managers for that reason, that same theoretical danger would be true of passkey managers. I don't personally have any of my extremely secure auto-created passwords memorized either, so for me a passkey is not different in that respect. If I inadvertently delete a pass[word|key], I'll have to go through the "forgot my password" process. Within 5 years, I can imagine services without password support. I'd expect that in "lost passkey" cases, those services will support allowing you to log in with a one-time code sent to your registered email address (or SMS) and/or with backup codes. > I've migrated passwords once from one password manager to another. I don't understand at all how this is supposed to happen with passkeys. Here's a real-world example: I played with Apple's passkey support before 1Password's passkey support was available. When 1Password added passkey support, I added another passkey to the sites that supported it and called it "1Password". And here's what it looks like when your Google account has 3 passkeys: https://imgur.com/a/NQl8XPI https://imgur.com/a/NQl8XPI

heavyset_go 3y ago

If you know how public key authentication works, then you know how passkeys work. Passkeys are private and public key pairs. Your password manager acts as the middleware between the keys and the software you need to authenticate with. You just need it to speak to services that use passkeys, and you can swap it out for anything that is able to do the same. Your "password manager" in this case can also just be a physical security key.

recursive 3y ago
Saying "I can swap it out" is different from me actually knowing what buttons to press to make that happen. It is at least partially lack of familiarity, but I'm not seeing how to do that with passkeys.