4 ms·

It's not true at all. Not many apps support passkeys, but for the ones that do, it's a godsend. No longer do I have to worry about whether my password is stor

It's not true at all. Not many apps support passkeys, but for the ones that do, it's a godsend. No longer do I have to worry about whether my password is stored in Google, or Firefox, or if it's up to date, or what happens if I get hacked. I just plug my little key into the computer and tap it. It's like having a physical key instead of having your password written in a page of an obscure book in the library. Probably safe, but someone dedicated can find it. A physical key can only be taken if my house gets robbed.

eviks 1y ago
> No longer do I have to worry about whether my password is stored in Google, or Firefox You never have too worry about it with a password manager, and also don't need to worry whether your key is plugged in in the computer you're currently using
rcxdude 1y ago
> No longer do I have to worry about whether my password is stored in Google, or Firefox Once Google and Firefox start pushing their passkey implementation, you do. One issue with them is user confusion about where the passkey is stored. And do you have a backup solution for if you lose your physical key? That's the big problem I have in practice at the moment: I would like a physical device for storing credentials, but I 100% cannot have it as a single point of failure. Unfortunately at the moment it seems like I either have a cloud sync vendor lock-in or a single point of failure, or I have the completely impractical solution of enrolling multiple devices, which means I have to carry both around with me, thus making it far more likely I lose both of them!.
- tzs 1y ago
  > Unfortunately at the moment it seems like I either have a cloud sync vendor lock-in or a single point of failure, or I have the completely impractical solution of enrolling multiple devices, which means I have to carry both around with me, thus making it far more likely I lose both of them! • You can use multiple independent cloud sync vendors. When I add passkeys to an account I add two passkeys. One gets stored in 1Password and synced using their cloud. The other gets stored in Apple's Password and synced using Apple's cloud. This should give you enough redundancy to mitigate most vendor lock-in concerns. • If using devices that don't cloud sync I don't see why your would need to carry around two devices in order to enroll two devices. Carry around one device, and when you make a new account create a passkey for that account stored in the device. Later, back home, login into any accounts you created while away using the passkeys on the device you were carrying, and create a second passkey on each of those accounts and store it on the other device.
  - rcxdude 1y ago
    Manually enrolling multiple devices/apps is pretty much the main thing that I view as impractical (especially because I need a system that can handle a range of authentication options: not everything supports passkeys, some passkey implementations prevent enrolling multiple devices, and that's the standard for TOTP as well). I have a lot of accounts, and it's really not something I can manage reliably to make sure that two different systems are in sync. The thing is, this seems like an entirely solvable problem, from multiple angles: e.g. an end-to-end encrypted sync between devices (using some pairing process), or, even better, a way to enroll a non-present device as an alternative (though this has some of its own challenges, if not just using a persistent certificate). It suprises me a little that there's nothing that really attempts to address this.
    - tzs 1y ago
      > The thing is, this seems like an entirely solvable problem, from multiple angles: e.g. an end-to-end encrypted sync between devices (using some pairing process), or, even better, a way to enroll a non-present device as an alternative (though this has some of its own challenges, if not just using a persistent certificate). It suprises me a little that there's nothing that really attempts to address this Apple is adding that in iOS 26 and MacOS 26 [1], based on the FIDO specification for this [2]. Google is also in the midst of implementing it [3]. [1] https://fidoalliance.org/9to5mac-apple-work-passkey-portability-is-finally-here-in-ios-26-and-macos-tahoe-26/ https://fidoalliance.org/9to5mac-apple-work-passkey-portabil... [2] https://fidoalliance.org/specifications-credential-exchange-specifications/ https://fidoalliance.org/specifications-credential-exchange-... [3] https://fidoalliance.org/mobileidworld-google-developing-passkey-transfer-feature-for-android-password-manager/ https://fidoalliance.org/mobileidworld-google-developing-pas...

eviks 1y ago

> No longer do I have to worry about whether my password is stored in Google, or Firefox You never have too worry about it with a password manager, and also don't need to worry whether your key is plugged in in the computer you're currently using

rcxdude 1y ago

> No longer do I have to worry about whether my password is stored in Google, or Firefox Once Google and Firefox start pushing their passkey implementation, you do. One issue with them is user confusion about where the passkey is stored. And do you have a backup solution for if you lose your physical key? That's the big problem I have in practice at the moment: I would like a physical device for storing credentials, but I 100% cannot have it as a single point of failure. Unfortunately at the moment it seems like I either have a cloud sync vendor lock-in or a single point of failure, or I have the completely impractical solution of enrolling multiple devices, which means I have to carry both around with me, thus making it far more likely I lose both of them!.

tzs 1y ago
> Unfortunately at the moment it seems like I either have a cloud sync vendor lock-in or a single point of failure, or I have the completely impractical solution of enrolling multiple devices, which means I have to carry both around with me, thus making it far more likely I lose both of them! • You can use multiple independent cloud sync vendors. When I add passkeys to an account I add two passkeys. One gets stored in 1Password and synced using their cloud. The other gets stored in Apple's Password and synced using Apple's cloud. This should give you enough redundancy to mitigate most vendor lock-in concerns. • If using devices that don't cloud sync I don't see why your would need to carry around two devices in order to enroll two devices. Carry around one device, and when you make a new account create a passkey for that account stored in the device. Later, back home, login into any accounts you created while away using the passkeys on the device you were carrying, and create a second passkey on each of those accounts and store it on the other device.
- rcxdude 1y ago
  Manually enrolling multiple devices/apps is pretty much the main thing that I view as impractical (especially because I need a system that can handle a range of authentication options: not everything supports passkeys, some passkey implementations prevent enrolling multiple devices, and that's the standard for TOTP as well). I have a lot of accounts, and it's really not something I can manage reliably to make sure that two different systems are in sync. The thing is, this seems like an entirely solvable problem, from multiple angles: e.g. an end-to-end encrypted sync between devices (using some pairing process), or, even better, a way to enroll a non-present device as an alternative (though this has some of its own challenges, if not just using a persistent certificate). It suprises me a little that there's nothing that really attempts to address this.
  - tzs 1y ago
    > The thing is, this seems like an entirely solvable problem, from multiple angles: e.g. an end-to-end encrypted sync between devices (using some pairing process), or, even better, a way to enroll a non-present device as an alternative (though this has some of its own challenges, if not just using a persistent certificate). It suprises me a little that there's nothing that really attempts to address this Apple is adding that in iOS 26 and MacOS 26 [1], based on the FIDO specification for this [2]. Google is also in the midst of implementing it [3]. [1] https://fidoalliance.org/9to5mac-apple-work-passkey-portability-is-finally-here-in-ios-26-and-macos-tahoe-26/ https://fidoalliance.org/9to5mac-apple-work-passkey-portabil... [2] https://fidoalliance.org/specifications-credential-exchange-specifications/ https://fidoalliance.org/specifications-credential-exchange-... [3] https://fidoalliance.org/mobileidworld-google-developing-passkey-transfer-feature-for-android-password-manager/ https://fidoalliance.org/mobileidworld-google-developing-pas...