4 ms·

> mostly automatically managed boosters have yet to address this particular elephant to doubters’ satisfaction

toomuchtodo 2y ago
Doubters gonna doubt, it's shipping to hundreds of millions of people today, and their passkeys are backed up to either iCloud Keychain or Google Password Manager (depending on ecosystem). If you have a password manager, that's great! Most people do not, and this is easier for them.
- tomjen3 2y ago
  Yeah it’s easier than ever right until you lose your iPhone and buy an android.
  - deleted 2y ago
    [deleted]
- bscphil 2y ago
  Do you have examples of a few popular sites that support them? I honestly don't know that I've seen one, unless the Apple / Google / Github / Gitlab "single sign on" links have all quietly switched to using passkeys under the hood (I thought they were all OAuth 2.0). Would be frustrating if so, because it wouldn't provide for custom / hardware implementations of the standard.
  - toomuchtodo 2y ago
    https://www.theverge.com/2024/7/30/24209395/dashlane-passkey-report-adoption-passwordless-sign-on https://www.theverge.com/2024/7/30/24209395/dashlane-passkey... https://www.theverge.com/2024/5/2/24147030/google-passkey-passwordless-authentication-400-million-accounts https://www.theverge.com/2024/5/2/24147030/google-passkey-pa... https://passkeys-directory.dashlane.com/ https://passkeys-directory.dashlane.com/ https://passkeys.directory/ https://passkeys.directory/
    - bscphil 2y ago
      Seems like the overwhelming majority of the listed sites require you to already have an account, then go to a difficult-to-find URL on a settings page, enroll a passkey, and then you can login with the passkey. So granted, a handful of sites support it, but I have trouble believing the Google number. Maybe that's including people using their device to sign into Google itself? Putting myself in the position of a typical user, passkeys haven't "replaced" passwords until I don't have a password for Home Depot or what have you. Otherwise there's still a password I have to write down or remember somewhere. I'm not even here as a hater - I do like the idea of cryptographic authentication replacing passwords - but I'm just saying I've seen zero real world uptake of this so far.
  - nixosbestos 2y ago
    Er, Google uses Passkeys and yes is an OAuth2/OIDC IdP for federated sign-in. I think you're missing the point though. I can still login to Google and Tailscale without ever typing a single password, trusting my url bar/eyes, sharing any secret material, etc.
- eep_social 2y ago
  always disappointed to hear “well it’s good because we already built it this way” as a deflection. you will, of course, do what you like but the flippant attitude is a showcase of why the boosters have failed to bring the doubters along. reassuring to hear that I can further offload my login security to an opaque fortune 500 of my “choice” if, when challenged, one is unwilling to acknowledge the trade offs that indicates that they don’t understand them which suggests that they should not be trusted, in short. forced passkeys are coming and I do not believe that is a good thing.

Doubters gonna doubt, it's shipping to hundreds of millions of people today, and their passkeys are backed up to either iCloud Keychain or Google Password Manager (depending on ecosystem). If you have a password manager, that's great! Most people do not, and this is easier for them.

tomjen3 2y ago
Yeah it’s easier than ever right until you lose your iPhone and buy an android.
- deleted 2y ago
  [deleted]
bscphil 2y ago
Do you have examples of a few popular sites that support them? I honestly don't know that I've seen one, unless the Apple / Google / Github / Gitlab "single sign on" links have all quietly switched to using passkeys under the hood (I thought they were all OAuth 2.0). Would be frustrating if so, because it wouldn't provide for custom / hardware implementations of the standard.
- toomuchtodo 2y ago
  https://www.theverge.com/2024/7/30/24209395/dashlane-passkey-report-adoption-passwordless-sign-on https://www.theverge.com/2024/7/30/24209395/dashlane-passkey... https://www.theverge.com/2024/5/2/24147030/google-passkey-passwordless-authentication-400-million-accounts https://www.theverge.com/2024/5/2/24147030/google-passkey-pa... https://passkeys-directory.dashlane.com/ https://passkeys-directory.dashlane.com/ https://passkeys.directory/ https://passkeys.directory/
  - bscphil 2y ago
    Seems like the overwhelming majority of the listed sites require you to already have an account, then go to a difficult-to-find URL on a settings page, enroll a passkey, and then you can login with the passkey. So granted, a handful of sites support it, but I have trouble believing the Google number. Maybe that's including people using their device to sign into Google itself? Putting myself in the position of a typical user, passkeys haven't "replaced" passwords until I don't have a password for Home Depot or what have you. Otherwise there's still a password I have to write down or remember somewhere. I'm not even here as a hater - I do like the idea of cryptographic authentication replacing passwords - but I'm just saying I've seen zero real world uptake of this so far.
- nixosbestos 2y ago
  Er, Google uses Passkeys and yes is an OAuth2/OIDC IdP for federated sign-in. I think you're missing the point though. I can still login to Google and Tailscale without ever typing a single password, trusting my url bar/eyes, sharing any secret material, etc.
eep_social 2y ago
always disappointed to hear “well it’s good because we already built it this way” as a deflection. you will, of course, do what you like but the flippant attitude is a showcase of why the boosters have failed to bring the doubters along. reassuring to hear that I can further offload my login security to an opaque fortune 500 of my “choice” if, when challenged, one is unwilling to acknowledge the trade offs that indicates that they don’t understand them which suggests that they should not be trusted, in short. forced passkeys are coming and I do not believe that is a good thing.