3 ms·

Even the closed-system solution pose problems. I think it didn't get much airtime, but when Chrome switched their approach to save passwords, a lot of users los

by raxxor 2y ago

Even the closed-system solution pose problems. I think it didn't get much airtime, but when Chrome switched their approach to save passwords, a lot of users lost access to their accounts. A case where a feature wasn't sensibly discontinued. The workaround now isn't using passkeys, something few people understand. Instead most seem to be migrating to an external password managers. Honestly, I don't have many arguments against this as these at least generate save passwords. There are many advantages to this approach. I believe moving forward, sticking to passwords might indeed be more viable. I think explaining users to upload their public ssl key is safer and more universal at this point.

portaouflop 2y ago
I use password as main auth method for everything (via a pw manager) - but then I often add passkey or similar for convenience. If I get locked out I still have the trad method as fallback; for me that’s the best of both worlds. If you don’t offer password as method I will not use your service. The worst are those that only offer code via email/sms or social login - miss me with that …
lxgr 2y ago
Passkeys are too complicated, so let's have users manage public keys manually instead? You can't be serious.
- 1oooqooq 2y ago
  except passkeys bought you a false sense of security and easy. yeah the happy path is easier because you're just generating new keys... but if the user ever gets a new phone or sit in front of another device, now passkeys are more complicated than the alternative. sadly the world became too dumbly complacent to question their devices.
  - lxgr 2y ago
    Logging in to Bitwarden/1Password/KeePassXC/Strongbox/... takes less than five minutes, even when using sophisticated 2FA. Would you argue that loading a public key (load it where, actually?) is much faster? How'd you do it practically?
    - 1oooqooq 2y ago
      five minutes to click 2 buttons? anyway. yes, when you get your phone stolen in a trip and can't log into anything. or when you realize nobody cares for the 5 nerds using those and require an apple or google passkey.

by raxxor 2y ago

portaouflop 2y ago

I use password as main auth method for everything (via a pw manager) - but then I often add passkey or similar for convenience. If I get locked out I still have the trad method as fallback; for me that’s the best of both worlds. If you don’t offer password as method I will not use your service. The worst are those that only offer code via email/sms or social login - miss me with that …

lxgr 2y ago

Passkeys are too complicated, so let's have users manage public keys manually instead? You can't be serious.

1oooqooq 2y ago
except passkeys bought you a false sense of security and easy. yeah the happy path is easier because you're just generating new keys... but if the user ever gets a new phone or sit in front of another device, now passkeys are more complicated than the alternative. sadly the world became too dumbly complacent to question their devices.
- lxgr 2y ago
  Logging in to Bitwarden/1Password/KeePassXC/Strongbox/... takes less than five minutes, even when using sophisticated 2FA. Would you argue that loading a public key (load it where, actually?) is much faster? How'd you do it practically?
  - 1oooqooq 2y ago
    five minutes to click 2 buttons? anyway. yes, when you get your phone stolen in a trip and can't log into anything. or when you realize nobody cares for the 5 nerds using those and require an apple or google passkey.