2 ms·
I still don't get passkeys. Even in this article the author says "don't worry about portability just set up a new one using the email fallback that almost ever
by riffraff 2y ago
I still don't get passkeys.
Even in this article the author says "don't worry about portability just set up a new one using the email fallback that almost every service provides".
But then what have I gained, if there is still an email fallback?
- sethaurus 2y agoYou've gained the convenience of not round-tripping through your email client every time you want to login/authenticate with the service! The same is true of passwords, of course; if there's an email-based password-reset mechanism, then your email is your real proof of identity; the password is a shortcut. Passkeys are a shortcut too; they just pick a different set of tradeoffs (less portable, less user-visible, more secure, harder to get phished, less stuff to remember). IMHO, these tradeoffs turn out to better-match the threat model of the modern web.
- riffraff 2y agoRight but before passkeys I was using password + phone confirmation. So I see why passkeys improve on passwords, but not on 2fa.