3 ms·
There's no reason not to trust it. It's strictly better than passwords in almost every regard. Of course if you manage your passwords well, you don't get more s
by vbezhenar 2y ago
There's no reason not to trust it. It's strictly better than passwords in almost every regard. Of course if you manage your passwords well, you don't get more security with passkeys, because your account is already safe enough. But for someone, who used to write his universal "Johny1987" password on a sticker at his display, passkey provides security and usability benefits.
Passkey is just not supposed to solve all the problems in the world. It's supposed to replace login and password and that's about it. Authentication.
- nottorp 2y agoThat would be fine if it didn't introduce device dependency and vendor lock in. How do I get my keys out of Apple's wallet again? Or out of a Yubikey for that matter. They are no longer under my control and I depend on Apple's or Yubikey's benevolence to access my services.
- bigfatkitten 2y ago> Or out of a Yubikey for that matter. You don't, and neither does an adversary. That is literally the whole point of paying $50 for a Yubikey.
- nottorp 2y agoSo I need to pay for the privilege of having a single point of failure for my credentials :) Oh no I forgot, I could pay even more to have backups.
- bigfatkitten 2y agoIt's an open specification. You can make your own if you like. If the security properties of a hardware authenticator aren't important to you, you don't need to use one at all.
- nottorp 2y agoA phone is also a hardware authenticator in this case. With the same problems in case of theft/destruction.