9 ms·

I have yet to see a compelling argument for passkeys that is strong enough to overpower it's negatives. - I want to be able to share passwords for accounts wit

I have yet to see a compelling argument for passkeys that is strong enough to overpower it's negatives. - I want to be able to share passwords for accounts with my family (some, but not all of them) - I want to be able to load up my login information from whatever device I am currently working on; my phone, my home computer, my work computer, my wife's phone, etc - I don't want to risk my phone breaking and losing access to all my accounts Something like 1Password or Bitwarden fits all of that perfectly.

Avicebron 1y ago
> see a compelling argument for passkeys It's tied to vendor lock in. Which increases the ability of companies who develop certain technologies for the masses to increase the friction of interacting with things outside of the ecosystem. The argument is that if a user is unable to use an alternative, by hook or crook they will pay increasingly high subscriptions to access the services provided by that ecosystem. This increases a number on a spreadsheet, the only true compelling argument one could say
- re 1y ago
  > It's tied to vendor lock in If you're referring to the inability to transfer passkeys across systems, that should be improving soon. https://blog.1password.com/fido-alliance-import-export-passkeys-draft-specs/ https://blog.1password.com/fido-alliance-import-export-passk... https://arstechnica.com/security/2025/06/apple-previews-new-import-export-feature-to-make-passkeys-more-interoperable/ https://arstechnica.com/security/2025/06/apple-previews-new-...
  - ls612 1y ago
    As long as the passkey spec includes remote snitching (attestation) your keepass open source alternative will exist only because big tech allows it, and it will end when big tech demands it. The entire import/export standard is a red herring.
    - rantallion 1y ago
      On one side of the pond, we have the EU's Digital Markets Act to protect consumers. It has teeth and it's already being used to ensure consumers have choice.
      - zombot 1y ago
        But only in the EU. You can already see iOS behave differently depending on which side of the pond you're from.
      - holowoodman 1y ago
        Not so sure that EU bureaucrats will understand and fix that problem. With NIS2, they let the IT-security-crapware lobby dictate draconian and mostly stupid security laws. Could be that the security-paranoid part of the bureaucracy overrides the consumer protection part in that case.
    - ortekk 1y ago
      It's sort of happening already. Members of FIDO threatening to block KeepassXC users [0] from logging in, unless KeepassXC complies with FIDO demands regarding specific implementation [0] https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994182200 https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
  - dspillett 1y ago
    > that should be improving soon Then _soon_ I might reconsider using passkeys. I'm not making changes to my security workflows now based on promises that the lock-in potential will be reduced as some unspecific point in the future.
vanviegen 1y ago
I think a password manager like bitwarden still meets all of those criteria when it's managing passkeys for you.
- thayne 1y ago
  But companies like Google, Microsoft, and Apple have a vested interest in making third party tools like bitwarden not work as well, or not at all on their platforms.
  - deleted 1y ago
    [deleted]
  - ChadNauseam 1y ago
    iOS and Android both have APIs for plugging in custom password managers into password entry fields in every app, and for using passkeys with those custom password managers. I use 1password on my iPhone and my Android and it integrates perfectly with both. I agree that those corporations have an interest in making those tools work poorly to stop you from leaving the platform, but they seem to have done the right thing and put some effort into allowing them to work well.
  - ashdksnndck 1y ago
    iOS third-party password manager integration has gotten better over the years. It went from nonexistent, to half-working but constantly pushing me to use iCloud passwords instead, to allowing third-party to be the default once I set it up and never mentioning iCloud passwords to me during normal use.
    - close04 1y ago
      If blocking this integration will ever be in their interest (I can't say much about this though), then they'll just tighten the grip as soon as passkeys are the norm and other auth methods are deprecated. It's always easy to invoke generic or obscure "security" reasons, even if it means creating the problems themselves so they come with the solution just in time.
microflash 1y ago
I do use Bitwarden to store passkeys and it works across devices just fine.
t_mann 1y ago
You can do all of those using Passkeys in Keepass, eg though KeepassXC, including import/export. However, Keepass applications have already been flagged as non-compliant for this reason. What you also currently can't do afaik is use them on mobile.
darkwater 1y ago
> I have yet to see a compelling argument for passkeys that is strong enough to overpower it's negatives. > - I want to be able to share passwords for accounts with my family (some, but not all of them) This, but for another reason. To all those "I can do this with Keepass/Bitwarden etc", how can you share your Netflix password with your parents 100 miles away to use it in their smart TV? You cannot and will never be able to do it. Yes, passkeys improve security in some contexts but also tighten the grip of service providers.
- Freak_NL 1y ago
  Since sharing Netflix passwords is a breach of their terms of use, that's not really a compelling argument. I doubt streaming services are looking to make passkeys the only way to authenticate devices though. Too much competition, and too many valid use cases for use outside of a personal device.
  - darkwater 1y ago
    > Since sharing Netflix passwords is a breach of their terms of use, that's not really a compelling argument. Since when "you are not supposed to do it" works? :) Most videogames cannot be freely copied or modified/tampered with, according to their ToS; still, companies implement draconian DRMs/anticheat to block people from doing it anyway. This is the same situation.
  - porridgeraisin 1y ago
    > breach of their terms of use I mean, it was an example. Replace it with an amazon account and the argument remains the same.
  - jjani 1y ago
    > Since sharing Netflix passwords is a breach of their terms of use, that's not really a compelling argument. Like the millions of "terms of use" breached by the exact trillion dollar companies pushing for passkeys (Google, Microsoft) while training their AI models? Sounds like terms of use are entirely irrelevant in the first place.
RataNova 1y ago
Right now, passkeys feel like they solve Google's and Apple's problems more than users
- al_borland 1y ago
  The “problem” they solve for Google and Apple is how to further lock people into their ecosystems. Microsoft too, they are part of it as well I believe.
  - RataNova 1y ago
    The core tech (WebAuthn/FIDO2) is open and cross-platform
Ferret7446 1y ago
> I want to be able to share passwords for accounts with my family No you don't, you want to share access, and the only way you can do it with passwords is by sharing the password itself. With passkeys you can have each person register their own passkey.
- blendergeek 1y ago
  I want to be able to share access without permission from Microsoft
  - Ferret7446 1y ago
    Huh? Microsoft doesn't own passkeys. I think you have a completely incorrect understanding of passkeys.
    - blendergeek 1y ago
      If I use Microsoft Authenticator, they do control the passkeys. It doesn't matter who "owns" them if they control them.
      - j_maffe 1y ago
        They can "control" them in any meaningful way if they use them for access of things that you do not allow or denies access for things that you do allow. If neither are happening, then you're effectively the one controlling, not them.
        blendergeek 1y ago
        The specific issue at hand is sharing. With passwords, I can easily share my passwords. Is it easy to share passkeys? And could doing so be prevented by Microsoft?
        IcyWindows 1y ago
8fingerlouie 1y ago
1Password also supports passkeys. I'm not sure if you can share them in a family vault, but considering they're just "passwords" in 1Password, i don't see why you wouldn't be able to. The portion of a passkey stored on device is just a private key, which is essentially just a string of bytes. The built in password manager in iOS/MacOS also supports synchronizing passkeys across devices (via iCloud), and again, i'm not sure if you can share those passkeys between uses, but same argument as for 1password.
- al_borland 1y ago
  This still doesn’t solve requirement 2, at least as far as I can tell. I’m a 1Password user. There are times I want to login with one of my personal accounts on my work laptop, auxiliary device I have, or family member’s device. On all these occasions, I’m not going to install 1Password and sync down my entire vault, just to delete it 5 minutes later. I simply reveal the password in my app and type it in. With passkeys there is no way to do this. It’s an edge case, but an important one. I’d feel much better about passkeys if it wasn’t some mysterious thing locked away in a vault. If it’s effectively a public/private key pair, I should be able to see the private in my password manager and copy/paste it wherever I want, and however I want. If I could do this I would instantly understand what’s going on and be more accepting of it, though I’d expect I’d still run into some edge cases.
  - dchest 1y ago
    > I simply reveal the password in my app and type it in. With passkeys there is no way to do this. After entering your username, you select an option to use your other device to sign in and scan a QR code with it.
    - al_borland 1y ago
      That assumes the device/app I’m logging into supports that. It also assumes I have my password manager on a device that can scan QR codes. Are passkeys ubiquitous? It doesn’t feel that way. Tech demos are nice, but they’re just tech demos. When I’m doing my taxes I don’t want to find out I can’t download my data in TurboTax because I can’t login to my bank with a passkey via their app. Or maybe I want to use some old hardware, where the apps haven’t been updated with QR codes and passkeys, I guess I’m out of luck. Too many edge cases. They are trying to sell passkeys as a magic way to login. I’m not going to entrust my ability to login to magic. Also, scanning QR codes to authenticate feels very janky. Isn’t that why CurrentC failed? No one wanted to do a QR code dance with their phone.

Avicebron 1y ago

> see a compelling argument for passkeys It's tied to vendor lock in. Which increases the ability of companies who develop certain technologies for the masses to increase the friction of interacting with things outside of the ecosystem. The argument is that if a user is unable to use an alternative, by hook or crook they will pay increasingly high subscriptions to access the services provided by that ecosystem. This increases a number on a spreadsheet, the only true compelling argument one could say

re 1y ago
> It's tied to vendor lock in If you're referring to the inability to transfer passkeys across systems, that should be improving soon. https://blog.1password.com/fido-alliance-import-export-passkeys-draft-specs/ https://blog.1password.com/fido-alliance-import-export-passk... https://arstechnica.com/security/2025/06/apple-previews-new-import-export-feature-to-make-passkeys-more-interoperable/ https://arstechnica.com/security/2025/06/apple-previews-new-...
- ls612 1y ago
  As long as the passkey spec includes remote snitching (attestation) your keepass open source alternative will exist only because big tech allows it, and it will end when big tech demands it. The entire import/export standard is a red herring.
  - rantallion 1y ago
    On one side of the pond, we have the EU's Digital Markets Act to protect consumers. It has teeth and it's already being used to ensure consumers have choice.
    - zombot 1y ago
      But only in the EU. You can already see iOS behave differently depending on which side of the pond you're from.
    - holowoodman 1y ago
      Not so sure that EU bureaucrats will understand and fix that problem. With NIS2, they let the IT-security-crapware lobby dictate draconian and mostly stupid security laws. Could be that the security-paranoid part of the bureaucracy overrides the consumer protection part in that case.
  - ortekk 1y ago
    It's sort of happening already. Members of FIDO threatening to block KeepassXC users [0] from logging in, unless KeepassXC complies with FIDO demands regarding specific implementation [0] https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994182200 https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
- dspillett 1y ago
  > that should be improving soon Then _soon_ I might reconsider using passkeys. I'm not making changes to my security workflows now based on promises that the lock-in potential will be reduced as some unspecific point in the future.

vanviegen 1y ago

I think a password manager like bitwarden still meets all of those criteria when it's managing passkeys for you.

thayne 1y ago
But companies like Google, Microsoft, and Apple have a vested interest in making third party tools like bitwarden not work as well, or not at all on their platforms.
- deleted 1y ago
  [deleted]
- ChadNauseam 1y ago
  iOS and Android both have APIs for plugging in custom password managers into password entry fields in every app, and for using passkeys with those custom password managers. I use 1password on my iPhone and my Android and it integrates perfectly with both. I agree that those corporations have an interest in making those tools work poorly to stop you from leaving the platform, but they seem to have done the right thing and put some effort into allowing them to work well.
- ashdksnndck 1y ago
  iOS third-party password manager integration has gotten better over the years. It went from nonexistent, to half-working but constantly pushing me to use iCloud passwords instead, to allowing third-party to be the default once I set it up and never mentioning iCloud passwords to me during normal use.
  - close04 1y ago
    If blocking this integration will ever be in their interest (I can't say much about this though), then they'll just tighten the grip as soon as passkeys are the norm and other auth methods are deprecated. It's always easy to invoke generic or obscure "security" reasons, even if it means creating the problems themselves so they come with the solution just in time.

microflash 1y ago

I do use Bitwarden to store passkeys and it works across devices just fine.

t_mann 1y ago

You can do all of those using Passkeys in Keepass, eg though KeepassXC, including import/export. However, Keepass applications have already been flagged as non-compliant for this reason. What you also currently can't do afaik is use them on mobile.

darkwater 1y ago

> I have yet to see a compelling argument for passkeys that is strong enough to overpower it's negatives. > - I want to be able to share passwords for accounts with my family (some, but not all of them) This, but for another reason. To all those "I can do this with Keepass/Bitwarden etc", how can you share your Netflix password with your parents 100 miles away to use it in their smart TV? You cannot and will never be able to do it. Yes, passkeys improve security in some contexts but also tighten the grip of service providers.

Freak_NL 1y ago
Since sharing Netflix passwords is a breach of their terms of use, that's not really a compelling argument. I doubt streaming services are looking to make passkeys the only way to authenticate devices though. Too much competition, and too many valid use cases for use outside of a personal device.
- darkwater 1y ago
  > Since sharing Netflix passwords is a breach of their terms of use, that's not really a compelling argument. Since when "you are not supposed to do it" works? :) Most videogames cannot be freely copied or modified/tampered with, according to their ToS; still, companies implement draconian DRMs/anticheat to block people from doing it anyway. This is the same situation.
- porridgeraisin 1y ago
  > breach of their terms of use I mean, it was an example. Replace it with an amazon account and the argument remains the same.
- jjani 1y ago
  > Since sharing Netflix passwords is a breach of their terms of use, that's not really a compelling argument. Like the millions of "terms of use" breached by the exact trillion dollar companies pushing for passkeys (Google, Microsoft) while training their AI models? Sounds like terms of use are entirely irrelevant in the first place.

RataNova 1y ago

Right now, passkeys feel like they solve Google's and Apple's problems more than users

al_borland 1y ago
The “problem” they solve for Google and Apple is how to further lock people into their ecosystems. Microsoft too, they are part of it as well I believe.
- RataNova 1y ago
  The core tech (WebAuthn/FIDO2) is open and cross-platform

Ferret7446 1y ago

> I want to be able to share passwords for accounts with my family No you don't, you want to share access, and the only way you can do it with passwords is by sharing the password itself. With passkeys you can have each person register their own passkey.

blendergeek 1y ago
I want to be able to share access without permission from Microsoft
- Ferret7446 1y ago
  Huh? Microsoft doesn't own passkeys. I think you have a completely incorrect understanding of passkeys.
  - blendergeek 1y ago
    If I use Microsoft Authenticator, they do control the passkeys. It doesn't matter who "owns" them if they control them.
    - j_maffe 1y ago
      They can "control" them in any meaningful way if they use them for access of things that you do not allow or denies access for things that you do allow. If neither are happening, then you're effectively the one controlling, not them.
      - blendergeek 1y ago
        The specific issue at hand is sharing. With passwords, I can easily share my passwords. Is it easy to share passkeys? And could doing so be prevented by Microsoft?
        IcyWindows 1y ago

8fingerlouie 1y ago

1Password also supports passkeys. I'm not sure if you can share them in a family vault, but considering they're just "passwords" in 1Password, i don't see why you wouldn't be able to. The portion of a passkey stored on device is just a private key, which is essentially just a string of bytes. The built in password manager in iOS/MacOS also supports synchronizing passkeys across devices (via iCloud), and again, i'm not sure if you can share those passkeys between uses, but same argument as for 1password.

al_borland 1y ago
This still doesn’t solve requirement 2, at least as far as I can tell. I’m a 1Password user. There are times I want to login with one of my personal accounts on my work laptop, auxiliary device I have, or family member’s device. On all these occasions, I’m not going to install 1Password and sync down my entire vault, just to delete it 5 minutes later. I simply reveal the password in my app and type it in. With passkeys there is no way to do this. It’s an edge case, but an important one. I’d feel much better about passkeys if it wasn’t some mysterious thing locked away in a vault. If it’s effectively a public/private key pair, I should be able to see the private in my password manager and copy/paste it wherever I want, and however I want. If I could do this I would instantly understand what’s going on and be more accepting of it, though I’d expect I’d still run into some edge cases.
- dchest 1y ago
  > I simply reveal the password in my app and type it in. With passkeys there is no way to do this. After entering your username, you select an option to use your other device to sign in and scan a QR code with it.
  - al_borland 1y ago
    That assumes the device/app I’m logging into supports that. It also assumes I have my password manager on a device that can scan QR codes. Are passkeys ubiquitous? It doesn’t feel that way. Tech demos are nice, but they’re just tech demos. When I’m doing my taxes I don’t want to find out I can’t download my data in TurboTax because I can’t login to my bank with a passkey via their app. Or maybe I want to use some old hardware, where the apps haven’t been updated with QR codes and passkeys, I guess I’m out of luck. Too many edge cases. They are trying to sell passkeys as a magic way to login. I’m not going to entrust my ability to login to magic. Also, scanning QR codes to authenticate feels very janky. Isn’t that why CurrentC failed? No one wanted to do a QR code dance with their phone.