3 ms·

This. In theory, passkeys should be great. Sort of an SSH-for-the-masses. Unfortunately, the industry has mangled the implementation, making them basically use

This. In theory, passkeys should be great. Sort of an SSH-for-the-masses. Unfortunately, the industry has mangled the implementation, making them basically useless.

Spivak 2y ago
I mean they're not totally useless, in the current implementation they just can't replace passwords. I have a bunch of passkeys in my Bitwarden and they function as a "log in bypassing the 2FA screen" button. I get to skip the "we sent a code to your phone/email/butthole" flow.
dcow 2y ago
Funny how that always happens. Passkeys were supposed to be great and what you ended up with is platform players abusing their position to push lock in to their own passkey solutions over fair access to arbitrary 3rd party providers. When they do work smoothly they aren’t useless though.
- gclawes 2y ago
  Android has been surprisingly awesome with cross-platform passkeys (i.e. google lets you use BitWarden/1Password/etc pretty transparently). Anything Apple related is another story... There's some good movement in the linux desktop space I'm excited about: https://github.com/linux-credentials/linux-webauthn-platform-api https://github.com/linux-credentials/linux-webauthn-platform...
  - ziml77 2y ago
    I'm using iOS and Passkeys from 1Password work there too. No problems with any browser on macOS either. On iOS I can even see a list of password & passkey providers, so I can ensure that the Apple one is toggled off (as well as MS Authenticator which can also provide those it seems)
  - dcow 2y ago
    Apple have been the best in my experience. On apple devices all 3rd party passkey providers are shown at the same time in the same UX where you’d choose iCloud (their native provider) Google Android may be good, but Chrome is not doing right yet. Chrome still tries to get you to use itself i stead of delegating to the platform selection box.
koakuma-chan 2y ago
Why are they useless? I log into GitHub, Google and Discord using passkeys, and it's very convenient being a single mouse click.

This. In theory, passkeys should be great. Sort of an SSH-for-the-masses. Unfortunately, the industry has mangled the implementation, making them basically useless.

Spivak 2y ago

I mean they're not totally useless, in the current implementation they just can't replace passwords. I have a bunch of passkeys in my Bitwarden and they function as a "log in bypassing the 2FA screen" button. I get to skip the "we sent a code to your phone/email/butthole" flow.

dcow 2y ago

Funny how that always happens. Passkeys were supposed to be great and what you ended up with is platform players abusing their position to push lock in to their own passkey solutions over fair access to arbitrary 3rd party providers. When they do work smoothly they aren’t useless though.

gclawes 2y ago
Android has been surprisingly awesome with cross-platform passkeys (i.e. google lets you use BitWarden/1Password/etc pretty transparently). Anything Apple related is another story... There's some good movement in the linux desktop space I'm excited about: https://github.com/linux-credentials/linux-webauthn-platform-api https://github.com/linux-credentials/linux-webauthn-platform...
- ziml77 2y ago
  I'm using iOS and Passkeys from 1Password work there too. No problems with any browser on macOS either. On iOS I can even see a list of password & passkey providers, so I can ensure that the Apple one is toggled off (as well as MS Authenticator which can also provide those it seems)
- dcow 2y ago
  Apple have been the best in my experience. On apple devices all 3rd party passkey providers are shown at the same time in the same UX where you’d choose iCloud (their native provider) Google Android may be good, but Chrome is not doing right yet. Chrome still tries to get you to use itself i stead of delegating to the platform selection box.

koakuma-chan 2y ago

Why are they useless? I log into GitHub, Google and Discord using passkeys, and it's very convenient being a single mouse click.