4 ms·

I've been avoiding passkeys but more and more websites are trying to push them, and one website I use now requires them. I've already got a password manager! I

I've been avoiding passkeys but more and more websites are trying to push them, and one website I use now requires them. I've already got a password manager! I don't need to change everything again!

stouset 6mo ago
Your password manager almost certainly already has baked-in passkey support.
- StilesCrisis 6mo ago
  It does, but what's your point? Why should I redo everything?
  - stouset 6mo ago
    Nobody is asking you to?
    - crazygringo 6mo ago
      The subject here is literally websites trying to push passkeys on users. That is who is asking us to. About every week now Amazon tries to trick me into creating a passkey. It doesn't even ask, it just goes ahead and triggers my browser passkey creation mechanism without my consent. PayPal recently tried to force me to create one too and I had to kill and restart the app because that was the only way to skip it. I'll stick to my password with 2FA, thanks.
      - Marsymars 6mo ago
        It's wildly obnoxious that browsers don't let you generally suppress these prompts. And if you take the nuclear option and strip your browser of WebAuthn support, then you obviously can't use any passkeys, which doesn't work for me - I have two sites where I do want to use passkeys (because it's the only way to avoid SMS-based MFA on every login), but I never want to see passkey prompts for any other sites.
      - stouset 6mo ago
        We have now gone from having to “redo everything” to being asked to switch to a passkey by a grand total of one website. I’ll be honest I’ve heard a lot of griping about passkeys but I have gone out of my way to switch over to them and have had precisely zero issues over the dozens of sites that I’ve bothered to make the switch on. Login flow is simpler and doesn’t rely on a browser extension guessing at login fields or trying to figure out when passwords change. Sometimes the new thing really is just better.
        alterom 6mo ago
        >We have now gone from having to “redo everything” to being asked to switch to a passkey by a grand total of one website. Yeah right. When passkeys were rolled out, I was told it's OK because "passwords are always going to be required to be an available alternative". Now we've moved the goalposts to "it's just one website". >Sometimes the new thing really is just better. And sometimes your backpack is stolen when you're traveling, with your phone and laptop (happened to me in Poland), and you need to log into your accounts while having none of your devices or your phone number available. Pray tell then what.
        stouset 6mo ago
        What if I told you I was not one of the people saying that? You can’t take two different people with two different opinions and say “Look! You’ve moved the goalposts!” If passkeys are significantly better, passwords will gradually stop existing. If passwords are, passkeys probably won’t catch on. > And sometimes your backpack is stolen when you're traveling, with your phone and laptop (happened to me in Poland), and you need to log into your accounts while having none of your devices or your phone number available. I personally keep a separate YubiKey that—along with a memorized password—is sufficient for me to retrieve my password manager database and unlock it. If this is a sufficiently motivating use-case for you, you too can take these kinds of steps to mitigate the risk. But since we’re playing the “what if” game, what happens if you get early onset dementia and forget your passwords? Pray tell then what?
        6mo ago
    - bartvk 6mo ago
      Of course they are. Lots of websites are pushing it, including while using dark patterns. You need to sometimes explicitly cancel an onboarding flow to avoid Passkeys.
  - fragmede 6mo ago
    "redo" just press yes when the site offers and your password manager asks you to.
dboreham 6mo ago
The good thing about this is they thereby also support FIDO2 hard tokens such as Yubikey. The UI is often confusing but you can always tell it to provision the key to your Yubikey rather than the OS enclave.
- Arainach 6mo ago
  That doesn't help if my machine (with only a few USB ports) gets stolen/lost with the token in it. It doesn't help if some of my devices only have USB-C and some only have USB-A. It's absolutely more annoying than letting my password manager fill things in or typing in a 6 digit code from my authenticator app.
  - nightski 6mo ago
    Get a better password manager? Most store passkeys.
    - Arainach 6mo ago
      If the passkey can be stored in the password manager, then there's no second factor and what's the point?
      - deleted 6mo ago
        [deleted]
      - nightski 6mo ago
        Passkeys are password replacements that can't be breached/leaked/etc... I don't think they are necessarily supposed to replace 2-factor, however it's probably more secure than some of the weaker forms of 2-factor auth. Given that in order to access your password manager's vault often requires 2-factor (or should at least) it's a level of security that I am comfortable with. I take it a step further and host the password manager vault within my home network. My home network does not expose anything publicly except a WireGuard port, it's completely locked down. I have to VPN in to access the vault.

I've been avoiding passkeys but more and more websites are trying to push them, and one website I use now requires them. I've already got a password manager! I don't need to change everything again!

stouset 6mo ago

Your password manager almost certainly already has baked-in passkey support.

StilesCrisis 6mo ago
It does, but what's your point? Why should I redo everything?
- stouset 6mo ago
  Nobody is asking you to?
  - crazygringo 6mo ago
    The subject here is literally websites trying to push passkeys on users. That is who is asking us to. About every week now Amazon tries to trick me into creating a passkey. It doesn't even ask, it just goes ahead and triggers my browser passkey creation mechanism without my consent. PayPal recently tried to force me to create one too and I had to kill and restart the app because that was the only way to skip it. I'll stick to my password with 2FA, thanks.
    - Marsymars 6mo ago
      It's wildly obnoxious that browsers don't let you generally suppress these prompts. And if you take the nuclear option and strip your browser of WebAuthn support, then you obviously can't use any passkeys, which doesn't work for me - I have two sites where I do want to use passkeys (because it's the only way to avoid SMS-based MFA on every login), but I never want to see passkey prompts for any other sites.
    - stouset 6mo ago
      We have now gone from having to “redo everything” to being asked to switch to a passkey by a grand total of one website. I’ll be honest I’ve heard a lot of griping about passkeys but I have gone out of my way to switch over to them and have had precisely zero issues over the dozens of sites that I’ve bothered to make the switch on. Login flow is simpler and doesn’t rely on a browser extension guessing at login fields or trying to figure out when passwords change. Sometimes the new thing really is just better.
      - alterom 6mo ago
        >We have now gone from having to “redo everything” to being asked to switch to a passkey by a grand total of one website. Yeah right. When passkeys were rolled out, I was told it's OK because "passwords are always going to be required to be an available alternative". Now we've moved the goalposts to "it's just one website". >Sometimes the new thing really is just better. And sometimes your backpack is stolen when you're traveling, with your phone and laptop (happened to me in Poland), and you need to log into your accounts while having none of your devices or your phone number available. Pray tell then what.
        stouset 6mo ago
        What if I told you I was not one of the people saying that? You can’t take two different people with two different opinions and say “Look! You’ve moved the goalposts!” If passkeys are significantly better, passwords will gradually stop existing. If passwords are, passkeys probably won’t catch on. > And sometimes your backpack is stolen when you're traveling, with your phone and laptop (happened to me in Poland), and you need to log into your accounts while having none of your devices or your phone number available. I personally keep a separate YubiKey that—along with a memorized password—is sufficient for me to retrieve my password manager database and unlock it. If this is a sufficiently motivating use-case for you, you too can take these kinds of steps to mitigate the risk. But since we’re playing the “what if” game, what happens if you get early onset dementia and forget your passwords? Pray tell then what?
        6mo ago
  - bartvk 6mo ago
    Of course they are. Lots of websites are pushing it, including while using dark patterns. You need to sometimes explicitly cancel an onboarding flow to avoid Passkeys.
- fragmede 6mo ago
  "redo" just press yes when the site offers and your password manager asks you to.

dboreham 6mo ago

The good thing about this is they thereby also support FIDO2 hard tokens such as Yubikey. The UI is often confusing but you can always tell it to provision the key to your Yubikey rather than the OS enclave.

Arainach 6mo ago
That doesn't help if my machine (with only a few USB ports) gets stolen/lost with the token in it. It doesn't help if some of my devices only have USB-C and some only have USB-A. It's absolutely more annoying than letting my password manager fill things in or typing in a 6 digit code from my authenticator app.
- nightski 6mo ago
  Get a better password manager? Most store passkeys.
  - Arainach 6mo ago
    If the passkey can be stored in the password manager, then there's no second factor and what's the point?
    - deleted 6mo ago
      [deleted]
    - nightski 6mo ago
      Passkeys are password replacements that can't be breached/leaked/etc... I don't think they are necessarily supposed to replace 2-factor, however it's probably more secure than some of the weaker forms of 2-factor auth. Given that in order to access your password manager's vault often requires 2-factor (or should at least) it's a level of security that I am comfortable with. I take it a step further and host the password manager vault within my home network. My home network does not expose anything publicly except a WireGuard port, it's completely locked down. I have to VPN in to access the vault.