4 ms·

It's good to have options but... I hate passkeys. Here is why: 1. Passkeys are device dependent. That means you need to have more devices and be tied to your e

It's good to have options but... I hate passkeys. Here is why: 1. Passkeys are device dependent. That means you need to have more devices and be tied to your existing devices. For a lot of people, that means even tighter phone dependence. 2. Even if you don't use a phone to store your passkeys, they promote vendor lock-in, because you need to rely on Apple, Google, or some other cloud-keychain system to store your passkeys. Tech companies love passkeys, not because it makes your life better, but because it entrenches people further into relying on their systems. People will love passkeys because it appears simple and makes passwords a thing of the past. But there's a tradeoff: more dependence on advanced technology are major tech corps. Let me ask you this: suppose you want to go phone-free and big-tech company free. Or you lose your phone and computer overseas. If you only use a passkey, then you'll have to grovel back to Apple or Google to log into your fastmail. Tech corps love that. This is just one step to make people tied to big tech, and so it seems harmless. But it is part of an overall procedure to integrate us so tightly (free Google docs, log in with Google/Apple/X is another of many), so that we can't function on our own any more, or choose any company we like any more.

Untit1ed 2y ago
I still haven't reckoned the security implications, but Bitwarden supports passkeys, you can mostly use them the same way as you do a username/password across devices.
- vouaobrasil 2y ago
  That still means dependence on some software product to log-in to basic services. With a password, I don't need to use a software product. What if I don't want to pay for Bitwarden, or buy a smartphone, or tie my log-ins to my computer? What happens when the WebAuthn standard evolves and only the big-tech companies have solutions for storing passkeys because little software vendors or open-source vendors don't support the standard as well? What happens when password-based login is phased out because passkeys are SO much simpler...assuming the user acquiesces and signs up for a big tech company's service? Who will be able to choose then?
  - lorenzk 2y ago
    Bitwarden is open source and has a free option. Granted, the app store app is a binary blob outside your control, but you have options.
    - justsomehnguy 2y ago
      > is open source and has a free option For now. Remember Hashicorp? > but you have options If you don't want (or able) to use the 'app store app' what the options are there? What options would be when Google/Apple make a smartphone (and an app on it) a requirement, in the name of security?
  - ylk 2y ago
    > What if I don't want to pay for Bitwarden, or buy a smartphone, or tie my log-ins to my computer? Then you and the people you influence can continue to enjoy getting phished. > What happens when the WebAuthn standard evolves and only the big-tech companies have solutions for storing passkeys because little software vendors or open-source vendors don't support the standard as well? For a bunch of companies/gov entities syncable passkeys aren’t secure enough. So they still need to use hardware-bound passkeys on e.g. yubikeys. Try to read up about a subject next time before you let your imagination go wild and scare equally ignorant people away from more secure alternatives. Your conspiracy theories even seem to push you to be against using password managers in general. I guess googling around for an offline one like KeePass that’s heavily recommended all around the internet was too hard? KeePassXC even supports passkeys.
    - vouaobrasil 2y ago
      > Then you and the people you influence can continue to enjoy getting phished. Yes, you are quite right (although I have never been phished). But the spirit of your answer is correct. But that was my point: there is no choice, except to be more tightly integrated into tech, which in my opinion is a horrible thing. Instead, we should lessen our dependence on technology so computer accounts aren't so important after all. > Try to read up about a subject next time before you let your phantasy go wild and scare equally ignorant people away from more secure alternatives. I am fully aware that passkeys are MORE secure. If you actually read my post, my argument was not TECHNOLOGICAL, but sociological: I argue merely that the tighter dependence on this technology is a bad thing sociologically, even if it is the RIGHT thing technologically. My thesis is that passkeys are a symptom of tighter tech integration, perhaps an inevitable one. You are irate because passkeys are the better solution to a technical problem, but I nevertheless maintain that the existence of that technical problem itself is merely a side-effect of a much larger problem for society -- the dependence on a tightly-integrated vertical technology stack. So perhaps YOU should read into the subtelty of my argument before claiming that I am ignorant.
deleted 2y ago
[deleted]
xyse53 2y ago
I like passkeys. I'm not able to be all in on them yet but I feel like they simplify my life. I have hardware keys and register all of them with sites that support them. Bitwarden for everything else. I don't feel like that makes me dependant on any of the big tech cos, but I do recognize everyone won't be able to pull off such a setup.
- vouaobrasil 2y ago
  My argument was never that tech-savvy individuals won't find a way not to be dependent on big tech. There will always be a few people from the previous era who find a way to be more independent. My argument was only about the majority, about the future of society, and how eventually people won't have much of a choice, because there will be future steps by big tech to integrate more and more people.
dools 2y ago
How is that any different from a password manager? Instead of being beholden to LastPass I'm beholden to the manufacturer of my laptop and my phone, until I get a new one at which point I just transfer the passkey over to that. I don't see the problem.
- EasyMark 2y ago
  you can use something like bitwarden. Make sure you keep track of those backup codes though
- LachlanHunt 2y ago
  Use a 3rd party password manager with Passkey support like 1Password or Bitwarden for the most broad cross-platform support. You can't currently export and import passkeys between different implementations, so if you wanted to switch from Apple iCloud to Google, for example, then you'd have to go to each site and register a new passkey on each of them with your new password manager. The FIDO alliance as supposedly working on a way to securely transfer passkeys between different password managers, but that's not here yet.
fauigerzigerk 2y ago
You are selectively ignoring the features of passkeys that don't fit your chosen conclusion. Yes of course passkeys come with some lock-in risk. Most technologies do. But compared to the status quo they give us new freedoms and less lock-in. We don't live in world of memorable passwords ("abc123") or post-it notes or even password managers. That world has long been replaced by a dependence on SIM cards, big tech OTP apps, proprietary banking apps and worst of all social logins. And all of it is tied to oppressive mobile platforms. You portray passkeys as another brick in the big tech lock-in wall. I totally disagree with that. Anything that frees us from dependence on mobile platforms and phone numbers is a net win.
eddyg 2y ago
Passkeys are fantastic! I recently had to use somebody else's computer to access my Google Mail account. I was able to login securely, without typing my password into the untrusted computer, by selecting "Try another way", then "Use your passkey". I scanned the QR code with my phone's Camera app, I tapped "Use passkey", my phone used Face ID to verify it was me, and then attested to Google that it was me logging in via an automatically-established Bluetooth connection between my phone and the browser. It was GREAT, and way better than typing in my password (no worry about keyloggers) and having to do a 2FA dance.
- drdaeman 2y ago
  The problem is, it's NOT mandatory in the spec, not even properly encouraged, and even the official demo at https://webauthn.io/ https://webauthn.io/ (and unofficial demos linked from passkeys.dev, like https://www.passkeys.io/ https://www.passkeys.io/, https://passkeys.guru/ https://passkeys.guru/ or https://passkey.org/ https://passkey.org/) do NOT have anything like that.
  - eddyg 2y ago
    Because websites don’t have to worry about it or do anything “special”. It’s built-in to how to passkeys work. https://support.apple.com/guide/iphone/use-passkeys-to-sign-in-to-apps-and-websites-iphf538ea8d0/ios https://support.apple.com/guide/iphone/use-passkeys-to-sign-... https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-sign-in-passkey-authenticator https://learn.microsoft.com/en-us/entra/identity/authenticat... https://support.google.com/chrome/answer/13168025 https://support.google.com/chrome/answer/13168025 https://support.apple.com/guide/mac-help/create-a-passkey-mchl4af65d1a/mac https://support.apple.com/guide/mac-help/create-a-passkey-mc...
    - drdaeman 2y ago
      Weird that you say it’s built in, because I specifically checked and I didn’t see that option anywhere. I’m using 1Password on GNU/Linux with Firefox. And I don’t think I saw it in a spec as an actual requirement for compliant implementations.
sebazzz 2y ago
It is annoying that passkeys are by definition discoverable passkeys, which make older Yubikeys useless because they can only hold like 25 passkeys or so. WebAuthn non-discoverable keys are so much better as just a second factor of authentication (after putting in your username/email for key lookup).
et1337 2y ago
I share your concerns, but you can store passkeys in the password manager of your choice, which syncs them across all your devices. As long as device attestation remains optional (and that's a big if), passkeys are strictly better than passwords.
- drdaeman 2y ago
  Until the mandatory requirement (SHOULD-level at the minimum) for compliant password^W passkey managers is that passkeys' keypairs must be user-accessible - it's just a pinky swear from corporate that "it's going to work" while they're effectively holding your credentials hostage. I can promise you that it's NOT really going to work as soon as you'll need to do something just slightly outside of the happiest path. Like logging in from an untrusted machine in a Internet Cafe. Exceptions for hardware-based solutions (like Yubikey) are acceptable and reasonable, as long as there is a ban on implementing any attestation anti-features. Current spec and official demo sites doesn't even require or suggest that multiple Passkeys must be a thing. A significant number of actual real-world implementations are extremely user-hostile (check BestBuy for an example).
jesseendahl 2y ago
Your two arguments are actually arguments against using any password/passkey manager at all. So it seems like you are actually arguing that people should not be using password managers, which is pretty bad advice given how we've seen how that turns out for the world: most people using weak, reused passwords, falling prey to phishing attacks, and all of the above resulting in tons of compromised user accounts.
- drdaeman 2y ago
  Sorry but this is completely wrong. Passwords are not device dependent. Save for some user-hostile enterprise environments that try to implement passwords without letting user "see" them, you can store passwords on any medium, with as many copies as you deem necessary, and use them however you want. Passwords are vendor independent. They're just a shared secret piece of information, there is nothing whatsoever that can even theoretically tie them to any provider. My "hunter2" secret is not and cannot be held hostage by Apple or Google or 1Password or anyone else. Passkeys in their current state lack both of those properties. If the Passkey committee would've explicitly made it in the spec that: 1) any compliant non-HSM-backed Passkeys SHOULD be exportable in a standardized text-based container format; 2) any compliant Passkey implementation MUST be capable of importing passkeys in the same standardized container format; 3) any compliant Passkey accepting service MUST provide means to authenticate via a QR code, Bluetooth connection, or, in absence of either, MUST provide a way for a manual fido:/ URI input as a last-resort measure; and lastly 4) there must be no way to distinguish between a hardware and software based Passkey - all those issues would be solved. But that's not happening.

Untit1ed 2y ago

I still haven't reckoned the security implications, but Bitwarden supports passkeys, you can mostly use them the same way as you do a username/password across devices.

vouaobrasil 2y ago
That still means dependence on some software product to log-in to basic services. With a password, I don't need to use a software product. What if I don't want to pay for Bitwarden, or buy a smartphone, or tie my log-ins to my computer? What happens when the WebAuthn standard evolves and only the big-tech companies have solutions for storing passkeys because little software vendors or open-source vendors don't support the standard as well? What happens when password-based login is phased out because passkeys are SO much simpler...assuming the user acquiesces and signs up for a big tech company's service? Who will be able to choose then?
- lorenzk 2y ago
  Bitwarden is open source and has a free option. Granted, the app store app is a binary blob outside your control, but you have options.
  - justsomehnguy 2y ago
    > is open source and has a free option For now. Remember Hashicorp? > but you have options If you don't want (or able) to use the 'app store app' what the options are there? What options would be when Google/Apple make a smartphone (and an app on it) a requirement, in the name of security?
- ylk 2y ago
  > What if I don't want to pay for Bitwarden, or buy a smartphone, or tie my log-ins to my computer? Then you and the people you influence can continue to enjoy getting phished. > What happens when the WebAuthn standard evolves and only the big-tech companies have solutions for storing passkeys because little software vendors or open-source vendors don't support the standard as well? For a bunch of companies/gov entities syncable passkeys aren’t secure enough. So they still need to use hardware-bound passkeys on e.g. yubikeys. Try to read up about a subject next time before you let your imagination go wild and scare equally ignorant people away from more secure alternatives. Your conspiracy theories even seem to push you to be against using password managers in general. I guess googling around for an offline one like KeePass that’s heavily recommended all around the internet was too hard? KeePassXC even supports passkeys.
  - vouaobrasil 2y ago
    > Then you and the people you influence can continue to enjoy getting phished. Yes, you are quite right (although I have never been phished). But the spirit of your answer is correct. But that was my point: there is no choice, except to be more tightly integrated into tech, which in my opinion is a horrible thing. Instead, we should lessen our dependence on technology so computer accounts aren't so important after all. > Try to read up about a subject next time before you let your phantasy go wild and scare equally ignorant people away from more secure alternatives. I am fully aware that passkeys are MORE secure. If you actually read my post, my argument was not TECHNOLOGICAL, but sociological: I argue merely that the tighter dependence on this technology is a bad thing sociologically, even if it is the RIGHT thing technologically. My thesis is that passkeys are a symptom of tighter tech integration, perhaps an inevitable one. You are irate because passkeys are the better solution to a technical problem, but I nevertheless maintain that the existence of that technical problem itself is merely a side-effect of a much larger problem for society -- the dependence on a tightly-integrated vertical technology stack. So perhaps YOU should read into the subtelty of my argument before claiming that I am ignorant.

deleted 2y ago

[deleted]

xyse53 2y ago

I like passkeys. I'm not able to be all in on them yet but I feel like they simplify my life. I have hardware keys and register all of them with sites that support them. Bitwarden for everything else. I don't feel like that makes me dependant on any of the big tech cos, but I do recognize everyone won't be able to pull off such a setup.

vouaobrasil 2y ago
My argument was never that tech-savvy individuals won't find a way not to be dependent on big tech. There will always be a few people from the previous era who find a way to be more independent. My argument was only about the majority, about the future of society, and how eventually people won't have much of a choice, because there will be future steps by big tech to integrate more and more people.

dools 2y ago

How is that any different from a password manager? Instead of being beholden to LastPass I'm beholden to the manufacturer of my laptop and my phone, until I get a new one at which point I just transfer the passkey over to that. I don't see the problem.

EasyMark 2y ago
you can use something like bitwarden. Make sure you keep track of those backup codes though
LachlanHunt 2y ago
Use a 3rd party password manager with Passkey support like 1Password or Bitwarden for the most broad cross-platform support. You can't currently export and import passkeys between different implementations, so if you wanted to switch from Apple iCloud to Google, for example, then you'd have to go to each site and register a new passkey on each of them with your new password manager. The FIDO alliance as supposedly working on a way to securely transfer passkeys between different password managers, but that's not here yet.

fauigerzigerk 2y ago

You are selectively ignoring the features of passkeys that don't fit your chosen conclusion. Yes of course passkeys come with some lock-in risk. Most technologies do. But compared to the status quo they give us new freedoms and less lock-in. We don't live in world of memorable passwords ("abc123") or post-it notes or even password managers. That world has long been replaced by a dependence on SIM cards, big tech OTP apps, proprietary banking apps and worst of all social logins. And all of it is tied to oppressive mobile platforms. You portray passkeys as another brick in the big tech lock-in wall. I totally disagree with that. Anything that frees us from dependence on mobile platforms and phone numbers is a net win.

eddyg 2y ago

Passkeys are fantastic! I recently had to use somebody else's computer to access my Google Mail account. I was able to login securely, without typing my password into the untrusted computer, by selecting "Try another way", then "Use your passkey". I scanned the QR code with my phone's Camera app, I tapped "Use passkey", my phone used Face ID to verify it was me, and then attested to Google that it was me logging in via an automatically-established Bluetooth connection between my phone and the browser. It was GREAT, and way better than typing in my password (no worry about keyloggers) and having to do a 2FA dance.

drdaeman 2y ago
The problem is, it's NOT mandatory in the spec, not even properly encouraged, and even the official demo at https://webauthn.io/ https://webauthn.io/ (and unofficial demos linked from passkeys.dev, like https://www.passkeys.io/ https://www.passkeys.io/, https://passkeys.guru/ https://passkeys.guru/ or https://passkey.org/ https://passkey.org/) do NOT have anything like that.
- eddyg 2y ago
  Because websites don’t have to worry about it or do anything “special”. It’s built-in to how to passkeys work. https://support.apple.com/guide/iphone/use-passkeys-to-sign-in-to-apps-and-websites-iphf538ea8d0/ios https://support.apple.com/guide/iphone/use-passkeys-to-sign-... https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-sign-in-passkey-authenticator https://learn.microsoft.com/en-us/entra/identity/authenticat... https://support.google.com/chrome/answer/13168025 https://support.google.com/chrome/answer/13168025 https://support.apple.com/guide/mac-help/create-a-passkey-mchl4af65d1a/mac https://support.apple.com/guide/mac-help/create-a-passkey-mc...
  - drdaeman 2y ago
    Weird that you say it’s built in, because I specifically checked and I didn’t see that option anywhere. I’m using 1Password on GNU/Linux with Firefox. And I don’t think I saw it in a spec as an actual requirement for compliant implementations.

sebazzz 2y ago

It is annoying that passkeys are by definition discoverable passkeys, which make older Yubikeys useless because they can only hold like 25 passkeys or so. WebAuthn non-discoverable keys are so much better as just a second factor of authentication (after putting in your username/email for key lookup).

et1337 2y ago

I share your concerns, but you can store passkeys in the password manager of your choice, which syncs them across all your devices. As long as device attestation remains optional (and that's a big if), passkeys are strictly better than passwords.

drdaeman 2y ago
Until the mandatory requirement (SHOULD-level at the minimum) for compliant password^W passkey managers is that passkeys' keypairs must be user-accessible - it's just a pinky swear from corporate that "it's going to work" while they're effectively holding your credentials hostage. I can promise you that it's NOT really going to work as soon as you'll need to do something just slightly outside of the happiest path. Like logging in from an untrusted machine in a Internet Cafe. Exceptions for hardware-based solutions (like Yubikey) are acceptable and reasonable, as long as there is a ban on implementing any attestation anti-features. Current spec and official demo sites doesn't even require or suggest that multiple Passkeys must be a thing. A significant number of actual real-world implementations are extremely user-hostile (check BestBuy for an example).

jesseendahl 2y ago

Your two arguments are actually arguments against using any password/passkey manager at all. So it seems like you are actually arguing that people should not be using password managers, which is pretty bad advice given how we've seen how that turns out for the world: most people using weak, reused passwords, falling prey to phishing attacks, and all of the above resulting in tons of compromised user accounts.

drdaeman 2y ago
Sorry but this is completely wrong. Passwords are not device dependent. Save for some user-hostile enterprise environments that try to implement passwords without letting user "see" them, you can store passwords on any medium, with as many copies as you deem necessary, and use them however you want. Passwords are vendor independent. They're just a shared secret piece of information, there is nothing whatsoever that can even theoretically tie them to any provider. My "hunter2" secret is not and cannot be held hostage by Apple or Google or 1Password or anyone else. Passkeys in their current state lack both of those properties. If the Passkey committee would've explicitly made it in the spec that: 1) any compliant non-HSM-backed Passkeys SHOULD be exportable in a standardized text-based container format; 2) any compliant Passkey implementation MUST be capable of importing passkeys in the same standardized container format; 3) any compliant Passkey accepting service MUST provide means to authenticate via a QR code, Bluetooth connection, or, in absence of either, MUST provide a way for a manual fido:/ URI input as a last-resort measure; and lastly 4) there must be no way to distinguish between a hardware and software based Passkey - all those issues would be solved. But that's not happening.