3 ms·
> Unfortunately by tying into the marketing of passkeys, there is going to be a pervasive assumption that ecosystem/on-device passkeys are just as secure. Pass
by Shank 1y ago
> Unfortunately by tying into the marketing of passkeys, there is going to be a pervasive assumption that ecosystem/on-device passkeys are just as secure.
Passkeys are an improvement over passwords. Security keys have a place for high security applications like enterprise deployments or the security paranoid. Passkeys stored on security keys can be trivially made worse by allowing users to set bad PINs (like 0000). If you use an iPhone and iCloud Keychain, iOS won’t permit you to store or use Passkeys with such an obvious passcode, but a Yubikey 5 will.
- sam_lowry_ 1y agoPasskeys are improvements over passwords in that login/password tuple is replaced by a single string. Everything else, including hardware tokens, is marketing vendor lock-in.
- Shank 1y agoA passkey is not a single string? A passkey is a public private key pair where the private key is never sent to a server and signs things.
- frollogaston 1y agoYep. There is still a lock-in issue though, cause passkeys as implemented are hard to transfer across walled gardens. But at least it's not like early TOTP impls which often had no playbook for when you get a new phone even in the same ecosystem.
- frollogaston 1y agoI feel similarly, improvement is better than no improvement. So far the evolution of mainstream auth was just password -> email/sms, the 2FA stuff in between was niche. Most sites just want that to be someone else's job, passkey is a simple and robust way to do that, unlike oauth.
- burnt-resistor 1y agoThe problem is that passkeys are opaque, non-portable, inaccessible, magic boxes lacking a backup or a portability mechanism. Passwords can be shared, stored, backed-up. Passkeys are locked away and hidden.