5 ms·

>your hardware dies Or your backpack gets stolen. Oops. I swear, people who idolize passkey security must never travel anywhere. PS: "just have more devices

by alterom 5mo ago

>your hardware dies Or your backpack gets stolen. Oops. I swear, people who idolize passkey security must never travel anywhere. PS: "just have more devices with passkeys", they invariably say. Yeah right because people are made of money, everyone has the forethought, and a 2nd laptop in the US is a great asset when you're in Poland and can't login anywhere.

StilesCrisis 5mo ago
I've been avoiding passkeys but more and more websites are trying to push them, and one website I use now requires them. I've already got a password manager! I don't need to change everything again!
- stouset 5mo ago
  Your password manager almost certainly already has baked-in passkey support.
  - StilesCrisis 5mo ago
    It does, but what's your point? Why should I redo everything?
    - stouset 5mo ago
      Nobody is asking you to?
      - crazygringo 5mo ago
        The subject here is literally websites trying to push passkeys on users. That is who is asking us to. About every week now Amazon tries to trick me into creating a passkey. It doesn't even ask, it just goes ahead and triggers my browser passkey creation mechanism without my consent. PayPal recently tried to force me to create one too and I had to kill and restart the app because that was the only way to skip it. I'll stick to my password with 2FA, thanks.
        Marsymars 5mo ago
        It's wildly obnoxious that browsers don't let you generally suppress these prompts. And if you take the nuclear option and strip your browser of WebAuthn support, then you obviously can't use any passkeys, which doesn't work for me - I have two sites where I do want to use passkeys (because it's the only way to avoid SMS-based MFA on every login), but I never want to see passkey prompts for any other sites.
        stouset 5mo ago
        We have now gone from having to “redo everything” to being asked to switch to a passkey by a grand total of one website. I’ll be honest I’ve heard a lot of griping about passkeys but I have gone out of my way to switch over to them and have had precisely zero issues over the dozens of sites that I’ve bothered to make the switch on. Login flow is simpler and doesn’t rely on a browser extension guessing at login fields or trying to figure out when passwords change. Sometimes the new thing really is just better.
        alterom 5mo ago
        >We have now gone from having to “redo everything” to being asked to switch to a passkey by a grand total of one website. Yeah right. When passkeys were rolled out, I was told it's OK because "passwords are always going to be required to be an available alternative". Now we've moved the goalposts to "it's just one website". >Sometimes the new thing really is just better. And sometimes your backpack is stolen when you're traveling, with your phone and laptop (happened to me in Poland), and you need to log into your accounts while having none of your devices or your phone number available. Pray tell then what.
        stouset 5mo ago
        What if I told you I was not one of the people saying that? You can’t take two different people with two different opinions and say “Look! You’ve moved the goalposts!” If passkeys are significantly better, passwords will gradually stop existing. If passwords are, passkeys probably won’t catch on. > And sometimes your backpack is stolen when you're traveling, with your phone and laptop (happened to me in Poland), and you need to log into your accounts while having none of your devices or your phone number available. I personally keep a separate YubiKey that—along with a memorized password—is sufficient for me to retrieve my password manager database and unlock it. If this is a sufficiently motivating use-case for you, you too can take these kinds of steps to mitigate the risk. But since we’re playing the “what if” game, what happens if you get early onset dementia and forget your passwords? Pray tell then what?
      - bartvk 5mo ago
        Of course they are. Lots of websites are pushing it, including while using dark patterns. You need to sometimes explicitly cancel an onboarding flow to avoid Passkeys.
    - fragmede 5mo ago
      "redo" just press yes when the site offers and your password manager asks you to.
- dboreham 5mo ago
  The good thing about this is they thereby also support FIDO2 hard tokens such as Yubikey. The UI is often confusing but you can always tell it to provision the key to your Yubikey rather than the OS enclave.
  - Arainach 5mo ago
    That doesn't help if my machine (with only a few USB ports) gets stolen/lost with the token in it. It doesn't help if some of my devices only have USB-C and some only have USB-A. It's absolutely more annoying than letting my password manager fill things in or typing in a 6 digit code from my authenticator app.
    - nightski 5mo ago
      Get a better password manager? Most store passkeys.
      - Arainach 5mo ago
        If the passkey can be stored in the password manager, then there's no second factor and what's the point?
        deleted 5mo ago
        [deleted]
        nightski 5mo ago
        Passkeys are password replacements that can't be breached/leaked/etc... I don't think they are necessarily supposed to replace 2-factor, however it's probably more secure than some of the weaker forms of 2-factor auth. Given that in order to access your password manager's vault often requires 2-factor (or should at least) it's a level of security that I am comfortable with. I take it a step further and host the password manager vault within my home network. My home network does not expose anything publicly except a WireGuard port, it's completely locked down. I have to VPN in to access the vault.
slau 5mo ago
I travel a lot. By train, plane, and car. I also use passkeys when possible. I have multiple Yubikeys, stored in different locations. I also have a password manager, where I typically keep track of which logins aren’t yet backed up across physical tokens. It takes a bit of effort, but it’s not impossible. Yes, it means that in the event of catastrophic failure I might not be able to log in to some services until I get to one of the backups. I haven’t been able to imagine a scenario where that would be truly problematic.
- Joker_vD 5mo ago
  > It takes a bit of effort That's a wild understatement. For most users, having a password manager is already very near to the upper bound of acceptable friction.
- alterom 5mo ago
  >Yes, it means that in the event of catastrophic failure I might not be able to log in to some services until I get to one of the backups. I haven’t been able to imagine a scenario where that would be truly problematic. No need to imagine! Remove all passkeys from your phone and laptop, then go somewhere overseas without any of those Yubikeys. Have fun enjoy a "not truly problematic" scenario of getting your Yibikeys from "multiple locations" you don't have access to, while being cut off from your messengers, email, bank account, etc. Bonus points for having your card locked or stolen at the same time. Or, imagine the backpack with your passkeys devices being stolen on an overseas trip. Again: pray tell, then what?
  - slau 5mo ago
    > Remove all passkeys from your phone and laptop I don't have any passkeys on my phone or laptop. They're all on the Yubikeys. I don't really see a difference with (some) password managers, though. If you use one of the keepasses, and you lose access to the file, you're in the same situation right? And yeah, you're right, there is a risk of inconvenience. I'm not debating that. I just choose to organise my life in such a way that it is just an inconvenience.
Barbing 5mo ago
>"just have more devices with passkeys" Confirms that strategy then For people who only use passwords having an extra device can help too. Google does not necessarily permit a login with a backup code, so to me it seems ideal to grab a spare phone, log into important accounts, and store it with a trusted party/friend. It could be very difficult to login to an account like Gmail from overseas in the event of PC+phone[+hardware key] theft. Maybe no big deal if you can port your number to a new phone right away. Or maybe the trusted friend can help (unless Google still finds the login suspicious after all, no idea there)
- alterom 5mo ago
  >It could be very difficult to login to an account like Gmail from overseas in the event of PC+phone[+hardware key] theft Literally happened to me in Poland, which is why I avoid passkeys like the plague. (The thief got caught months later. That didn't help me.) >Maybe no big deal if you can port your number to a new phone right away. T-Mobile won't mail a SIM card overseas, and I doubt others will either. There is no "maybe", it's a certainty that you won't be able to. >Or maybe the trusted friend can help Yeah, my wife literally mailed me SIM card to Poland. It took over week. And a "trusted friend" would first have had to get it somehow. >Or maybe the trusted friend can help (unless Google still finds the login suspicious after all, no idea there) At least I logged into my accounts from that city before the laptop and phone were stolen, so my logins were not "suspicious". That's with a password. _____ PS: screw Citibank's mandatory phone -based "2FA".
  - Barbing 5mo ago
    Oh my goodness, what are we supposed to do?! Edit: and near 0 customer support too

by alterom 5mo ago

StilesCrisis 5mo ago

I've been avoiding passkeys but more and more websites are trying to push them, and one website I use now requires them. I've already got a password manager! I don't need to change everything again!

stouset 5mo ago
Your password manager almost certainly already has baked-in passkey support.
- StilesCrisis 5mo ago
  It does, but what's your point? Why should I redo everything?
  - stouset 5mo ago
    Nobody is asking you to?
    - crazygringo 5mo ago
      The subject here is literally websites trying to push passkeys on users. That is who is asking us to. About every week now Amazon tries to trick me into creating a passkey. It doesn't even ask, it just goes ahead and triggers my browser passkey creation mechanism without my consent. PayPal recently tried to force me to create one too and I had to kill and restart the app because that was the only way to skip it. I'll stick to my password with 2FA, thanks.
      - Marsymars 5mo ago
        It's wildly obnoxious that browsers don't let you generally suppress these prompts. And if you take the nuclear option and strip your browser of WebAuthn support, then you obviously can't use any passkeys, which doesn't work for me - I have two sites where I do want to use passkeys (because it's the only way to avoid SMS-based MFA on every login), but I never want to see passkey prompts for any other sites.
      - stouset 5mo ago
        We have now gone from having to “redo everything” to being asked to switch to a passkey by a grand total of one website. I’ll be honest I’ve heard a lot of griping about passkeys but I have gone out of my way to switch over to them and have had precisely zero issues over the dozens of sites that I’ve bothered to make the switch on. Login flow is simpler and doesn’t rely on a browser extension guessing at login fields or trying to figure out when passwords change. Sometimes the new thing really is just better.
        alterom 5mo ago
        >We have now gone from having to “redo everything” to being asked to switch to a passkey by a grand total of one website. Yeah right. When passkeys were rolled out, I was told it's OK because "passwords are always going to be required to be an available alternative". Now we've moved the goalposts to "it's just one website". >Sometimes the new thing really is just better. And sometimes your backpack is stolen when you're traveling, with your phone and laptop (happened to me in Poland), and you need to log into your accounts while having none of your devices or your phone number available. Pray tell then what.
        stouset 5mo ago
        What if I told you I was not one of the people saying that? You can’t take two different people with two different opinions and say “Look! You’ve moved the goalposts!” If passkeys are significantly better, passwords will gradually stop existing. If passwords are, passkeys probably won’t catch on. > And sometimes your backpack is stolen when you're traveling, with your phone and laptop (happened to me in Poland), and you need to log into your accounts while having none of your devices or your phone number available. I personally keep a separate YubiKey that—along with a memorized password—is sufficient for me to retrieve my password manager database and unlock it. If this is a sufficiently motivating use-case for you, you too can take these kinds of steps to mitigate the risk. But since we’re playing the “what if” game, what happens if you get early onset dementia and forget your passwords? Pray tell then what?
    - bartvk 5mo ago
      Of course they are. Lots of websites are pushing it, including while using dark patterns. You need to sometimes explicitly cancel an onboarding flow to avoid Passkeys.
  - fragmede 5mo ago
    "redo" just press yes when the site offers and your password manager asks you to.
dboreham 5mo ago
The good thing about this is they thereby also support FIDO2 hard tokens such as Yubikey. The UI is often confusing but you can always tell it to provision the key to your Yubikey rather than the OS enclave.
- Arainach 5mo ago
  That doesn't help if my machine (with only a few USB ports) gets stolen/lost with the token in it. It doesn't help if some of my devices only have USB-C and some only have USB-A. It's absolutely more annoying than letting my password manager fill things in or typing in a 6 digit code from my authenticator app.
  - nightski 5mo ago
    Get a better password manager? Most store passkeys.
    - Arainach 5mo ago
      If the passkey can be stored in the password manager, then there's no second factor and what's the point?
      - deleted 5mo ago
        [deleted]
      - nightski 5mo ago
        Passkeys are password replacements that can't be breached/leaked/etc... I don't think they are necessarily supposed to replace 2-factor, however it's probably more secure than some of the weaker forms of 2-factor auth. Given that in order to access your password manager's vault often requires 2-factor (or should at least) it's a level of security that I am comfortable with. I take it a step further and host the password manager vault within my home network. My home network does not expose anything publicly except a WireGuard port, it's completely locked down. I have to VPN in to access the vault.

slau 5mo ago

I travel a lot. By train, plane, and car. I also use passkeys when possible. I have multiple Yubikeys, stored in different locations. I also have a password manager, where I typically keep track of which logins aren’t yet backed up across physical tokens. It takes a bit of effort, but it’s not impossible. Yes, it means that in the event of catastrophic failure I might not be able to log in to some services until I get to one of the backups. I haven’t been able to imagine a scenario where that would be truly problematic.

Joker_vD 5mo ago
> It takes a bit of effort That's a wild understatement. For most users, having a password manager is already very near to the upper bound of acceptable friction.
alterom 5mo ago
>Yes, it means that in the event of catastrophic failure I might not be able to log in to some services until I get to one of the backups. I haven’t been able to imagine a scenario where that would be truly problematic. No need to imagine! Remove all passkeys from your phone and laptop, then go somewhere overseas without any of those Yubikeys. Have fun enjoy a "not truly problematic" scenario of getting your Yibikeys from "multiple locations" you don't have access to, while being cut off from your messengers, email, bank account, etc. Bonus points for having your card locked or stolen at the same time. Or, imagine the backpack with your passkeys devices being stolen on an overseas trip. Again: pray tell, then what?
- slau 5mo ago
  > Remove all passkeys from your phone and laptop I don't have any passkeys on my phone or laptop. They're all on the Yubikeys. I don't really see a difference with (some) password managers, though. If you use one of the keepasses, and you lose access to the file, you're in the same situation right? And yeah, you're right, there is a risk of inconvenience. I'm not debating that. I just choose to organise my life in such a way that it is just an inconvenience.

Barbing 5mo ago

>"just have more devices with passkeys" Confirms that strategy then For people who only use passwords having an extra device can help too. Google does not necessarily permit a login with a backup code, so to me it seems ideal to grab a spare phone, log into important accounts, and store it with a trusted party/friend. It could be very difficult to login to an account like Gmail from overseas in the event of PC+phone[+hardware key] theft. Maybe no big deal if you can port your number to a new phone right away. Or maybe the trusted friend can help (unless Google still finds the login suspicious after all, no idea there)

alterom 5mo ago
>It could be very difficult to login to an account like Gmail from overseas in the event of PC+phone[+hardware key] theft Literally happened to me in Poland, which is why I avoid passkeys like the plague. (The thief got caught months later. That didn't help me.) >Maybe no big deal if you can port your number to a new phone right away. T-Mobile won't mail a SIM card overseas, and I doubt others will either. There is no "maybe", it's a certainty that you won't be able to. >Or maybe the trusted friend can help Yeah, my wife literally mailed me SIM card to Poland. It took over week. And a "trusted friend" would first have had to get it somehow. >Or maybe the trusted friend can help (unless Google still finds the login suspicious after all, no idea there) At least I logged into my accounts from that city before the laptop and phone were stolen, so my logins were not "suspicious". That's with a password. _____ PS: screw Citibank's mandatory phone -based "2FA".
- Barbing 5mo ago
  Oh my goodness, what are we supposed to do?! Edit: and near 0 customer support too