6 ms·
Yep, this is why I don't use passkeys. I tried. The power-grabbing garbage was immediately apparent and sent me straight for "heck no, I'll just use passwords
by Groxx 3y ago
Yep, this is why I don't use passkeys.
I tried. The power-grabbing garbage was immediately apparent and sent me straight for "heck no, I'll just use passwords until they figure this out, at least that can't control my password manager".
In principle I should be very in favor of them, but the wild variety of lack of support for basics, and the built-in-the-spec ability for site X to control how I store and sync stuff is utterly bonkers. It's feeling like the OpenID promise -> OAuth platform lock-in cycle all over again, but compressed into v1.
- sroussey 3y agoI use 1Password which supports Passkeys, and don’t have an issue across mobile or desktop. I don’t get what the issues people have really are. I never experience them (fortunately!).
- MrDrMcCoy 3y ago1Password is a closed-source, cloud-hosted service. At any time, for any reason, they can close and delete your account, leaving you high and dry. Self-hosted, multi-device password managers are the only real solution. Thankfully, Vaultwarden and KeePassXC fill this role perfectly. Now if we could just get the other providers that require insecure email/SMS 2FA to follow suit, that would be great...
- gcr 3y agoFor others reading this thread, looks like KeePassXC announced passkey support last October! Does it work well?
- ceinewydd 3y agoI’m really not sure the “only real solution” is every human needs to selfhost a password manager. That’s ill-advised; an extreme take. The vast majority of the population will do a worse job on the availability and security of a selfhost solution than 1Password, whose core business and value proposition is password management. I’m a very happy user of 1Password for Families and consider it the likely the best ~$50 a year that I spend on hosted technologies.
- sroussey 3y agoAgreed. I self hosted the key 100 bitcoin in like 2010. Machine crashed. Oops.
- littlestymaar 3y agoThat's a fundamental problem with cryptographic security: you cannot trust people to manage your keys for you (because due to lack of regulation preventing that companies have this bad habit of pulling the rug under their customers' feet) but you cannot trust yourself doing that either, because you can, and will, make mistakes.
- pydry 3y agoI've always wanted a decentralized solution that lets me trust my friends instead.
- eru 3y agoYou can use a threshold secret sharing scheme to distribute your keys amongst your friends (and amongst companies). This way you don't need to trust any single one of your friends to be 100% honest nor 100% available.
- littlestymaar 3y agoI know how to do that in theory (I've worked with Shamir secret sharing on elliptic curves before) but you don't have the option to do that in LUKS, so in practice you can't use it.
- pydry 3y agoThats kind of my point. you could rsync files before you could Dropbox too, but there was still a need for a Dropbox.
- prmoustache 3y agoMy rule of thumb is if for some reason you need to use crypto keys that can't be easily replaced, you need to have a safe at the bank with the keys stored in 2 differente media formats, that are recreated every year. I don't trust many people to do that. I have everything encrypted and self hosted and I sometimes wonder what I would do if I was suffering from amnesia after an accident for example. And having a note somewhere telling me I have a safe in bank X is the only solution I have found.
- signal11 3y agoAnd KeePass XC supports passkeys too[1]. Although I’ve not had a chance to try that out yet. [1] https://keepassxc.org/docs/KeePassXC_UserGuide#_passkeys https://keepassxc.org/docs/KeePassXC_UserGuide#_passkeys
- freeAgent 3y agoYour vault is stored locally on each device, so if they decide to shut down you just export locally, import somewhere else and move on. It’s not as big of a deal as you seem to be implying.
- Hnrobert42 3y agoNo they can’t. You have a local cache. Also, you can export and backup if you are really worried.
- arthur_sav 3y ago> 1Password is a closed-source, cloud-hosted service. At any time, for any reason, they can close and delete your account They used to offer their apps offline and you could "host" it anywhere. Venture Capital ruined them.
- generalpf 3y agoHaving the passwords in the cloud is useful though. Before, if you wanted to use your vault across multiple machines, you had to store your vault in someone else’s cloud. This simplifies the process.
- alwaysbeconsing 3y agoIncorrect. 1P orginally offer direct LAN syncing among machines.
- skinkestek 3y agoI wonder if BitWarden doesn't support passkeys too. BitWarden is open source to a large degree and even provides an (open source) server for self-hosting.
- deleted 3y ago[deleted]
- briffle 3y agoBitwarden supports passkeys, is open sourced, and can be self hosted.
- MrDrMcCoy 3y agoVaultwarden is a much simpler self-hosted Bitwarden.