4 ms·

It’s really not that hard. Most of your devices are in the Apple ecosystem and when you are prompted to create a passphrase it will ask you to put it in your i

It’s really not that hard. Most of your devices are in the Apple ecosystem and when you are prompted to create a passphrase it will ask you to put it in your iCloud Keychain. Boom, now it is available across all of those This is how it will work for most people who don’t care about security and just casually use their devices. My boomer mom does this. It’s better than the notebook full of handwritten passwords she was using. You have chosen lastpass and a multi-ecosystem environment with windows and multiple browsers on each. You have chosen complexity and this is not a limitation of passsphrases as they have been designed for a more common use case. I use Linux and apple. I have chosen protonpass for my vault. I just tell my OS to save the passkey there and everything works pretty well. If not, my password is right there as fallback. It’s really not that hard.

juancn 2mo ago
What if I lose all my apple devices? House break-in and they steal my mac and my phone? You're basically fucked even if you buy a new one because you need one of the other two to log in.
- gretch 2mo ago
  No technology in the world can protect you against every threat model and unlikely scenario. What if the robber hits you in the head and you get brain damage and forget your password?
  - deejaaymac 2mo ago
    Master password to password vault stored on metal, buried in my backyard and I tell a family member where it is in case I ever get brain damage
    - gretch 2mo ago
      Family member gossips "that crazy [deejaaymac] always burying secrets in the backyard..." Or straight up betrays you (you slighted them at some family event)
      - iamnothere 2mo ago
        If you marry someone you don’t trust, you’re going to have a lot more problems than password compromise.
  - pavon 2mo ago
    That is not a rare threat model. Many people use iPhones and Windows computers. Fortunately, Apple has released iCloud Passwords which lets you access passwords and passkeys from a Windows computer.
    - Melatonic 2mo ago
      Did not know that - how well does it work?
  - TeMPOraL 2mo ago
    That's the point: passkeys, and even 2FA, address rare and unlikely threat scenarios, while defeating most common use cases (delegation by sharing credentials), and making people vulnerable to most common threats (like, losing or breaking your phone).
  - juancn 2mo ago
    A password has the best recovery process. Period. Write it down somewhere. It's up to me, no third party. I had more trouble with a failed 2FA than with a password.
- dfabulich 2mo ago
  Then you'll login to your Apple iCloud account using your password. Passkeys are just passwords that require a password manager; you can't login to a password manager without something outside the password manager, usually a password. (That's why they call it "LassPass" and "1Password"; there's one last password you'll still have to maintain.) No password manager tries to get you to login with a passkey without setting a password, for precisely that reason. Apple, Google, and Microsoft do invite you to login to their password managers via passkey, because it's convenient and unphishable, but they always also allow you to login via password (or "backup codes", which are just backup passwords).
coldpie 2mo ago
Proton Pass is on the official Passkey client naughty list[1]. I hope the services you log in to don't choose to ban it because of those big, scary X's. [1] https://passkeys.dev/docs/reference/known-issues/ https://passkeys.dev/docs/reference/known-issues/
- corndoge 2mo ago
  The fact that services can ban passkey providers is a major red flag in the protocol and the real issue that nobody talks about well, people are talking about it but it's not making a difference https://lucumr.pocoo.org/2025/9/2/passkeys/ https://lucumr.pocoo.org/2025/9/2/passkeys/
  - duskdozer 2mo ago
    This is why I am so concerned about passkeys. They could be a good improvement, but in practice I already see how it's going to result in Google/Apple/Microsoft/whoever seizing even more control. The document there is laughable too, because KeepassXC is listed as "not performing User Verification" when it demands manual authorization per request. But this isn't good enough for the passkey people. Ultimately, I see any FOSS option being effectively banned from most services and all important ones. It's a parallel to how you must now be on Cloudflare's nice list or be banned from the majority of the internet.
    - corndoge 2mo ago
      Yeah they're really trying to solve problems that should be solved at a technical level with soft solutions in porcelain. See also this issue asking keepassxc to disable plaintext exports, which is completely technically feasible https://github.com/keepassxreboot/keepassxc/issues/10407 https://github.com/keepassxreboot/keepassxc/issues/10407
      - mlfreeman 2mo ago
        The author of this ticket seems to come across as an arrogant know-it-all that thinks "the threats i thought of (or personally face) are the only threats that are significant, fuck anyone in a different situation." I proudly print my entire KDBX file including passkey private keys and I encourage my elderly parents to do so too. Lightning strikes (and assisting people with cleanup and repair from them) have taught me that there are definitely a class of threats that will leave me with paper but possibly no technology until I can go buy a cheap laptop to restart my digital life, SO BEING ABLE TO BACK EVERYTHING UP IS ABSOLUTELY ESSENTIAL. His website says he's in Boston, so I seriously doubt he's ever seen what lightning can do or dealt with a hurricane or tornado. In general, if you're in the FIDO Alliance and had anything to do with the kind of micromanagement that passkeys can allow, FUCK YOU. Go get a job at Walmart as a greeter. We'll all be better off.

juancn 2mo ago

What if I lose all my apple devices? House break-in and they steal my mac and my phone? You're basically fucked even if you buy a new one because you need one of the other two to log in.

gretch 2mo ago
No technology in the world can protect you against every threat model and unlikely scenario. What if the robber hits you in the head and you get brain damage and forget your password?
- deejaaymac 2mo ago
  Master password to password vault stored on metal, buried in my backyard and I tell a family member where it is in case I ever get brain damage
  - gretch 2mo ago
    Family member gossips "that crazy [deejaaymac] always burying secrets in the backyard..." Or straight up betrays you (you slighted them at some family event)
    - iamnothere 2mo ago
      If you marry someone you don’t trust, you’re going to have a lot more problems than password compromise.
- pavon 2mo ago
  That is not a rare threat model. Many people use iPhones and Windows computers. Fortunately, Apple has released iCloud Passwords which lets you access passwords and passkeys from a Windows computer.
  - Melatonic 2mo ago
    Did not know that - how well does it work?
- TeMPOraL 2mo ago
  That's the point: passkeys, and even 2FA, address rare and unlikely threat scenarios, while defeating most common use cases (delegation by sharing credentials), and making people vulnerable to most common threats (like, losing or breaking your phone).
- juancn 2mo ago
  A password has the best recovery process. Period. Write it down somewhere. It's up to me, no third party. I had more trouble with a failed 2FA than with a password.
dfabulich 2mo ago
Then you'll login to your Apple iCloud account using your password. Passkeys are just passwords that require a password manager; you can't login to a password manager without something outside the password manager, usually a password. (That's why they call it "LassPass" and "1Password"; there's one last password you'll still have to maintain.) No password manager tries to get you to login with a passkey without setting a password, for precisely that reason. Apple, Google, and Microsoft do invite you to login to their password managers via passkey, because it's convenient and unphishable, but they always also allow you to login via password (or "backup codes", which are just backup passwords).

coldpie 2mo ago

Proton Pass is on the official Passkey client naughty list[1]. I hope the services you log in to don't choose to ban it because of those big, scary X's. [1] https://passkeys.dev/docs/reference/known-issues/ https://passkeys.dev/docs/reference/known-issues/

corndoge 2mo ago
The fact that services can ban passkey providers is a major red flag in the protocol and the real issue that nobody talks about well, people are talking about it but it's not making a difference https://lucumr.pocoo.org/2025/9/2/passkeys/ https://lucumr.pocoo.org/2025/9/2/passkeys/
- duskdozer 2mo ago
  This is why I am so concerned about passkeys. They could be a good improvement, but in practice I already see how it's going to result in Google/Apple/Microsoft/whoever seizing even more control. The document there is laughable too, because KeepassXC is listed as "not performing User Verification" when it demands manual authorization per request. But this isn't good enough for the passkey people. Ultimately, I see any FOSS option being effectively banned from most services and all important ones. It's a parallel to how you must now be on Cloudflare's nice list or be banned from the majority of the internet.
  - corndoge 2mo ago
    Yeah they're really trying to solve problems that should be solved at a technical level with soft solutions in porcelain. See also this issue asking keepassxc to disable plaintext exports, which is completely technically feasible https://github.com/keepassxreboot/keepassxc/issues/10407 https://github.com/keepassxreboot/keepassxc/issues/10407
    - mlfreeman 2mo ago
      The author of this ticket seems to come across as an arrogant know-it-all that thinks "the threats i thought of (or personally face) are the only threats that are significant, fuck anyone in a different situation." I proudly print my entire KDBX file including passkey private keys and I encourage my elderly parents to do so too. Lightning strikes (and assisting people with cleanup and repair from them) have taught me that there are definitely a class of threats that will leave me with paper but possibly no technology until I can go buy a cheap laptop to restart my digital life, SO BEING ABLE TO BACK EVERYTHING UP IS ABSOLUTELY ESSENTIAL. His website says he's in Boston, so I seriously doubt he's ever seen what lightning can do or dealt with a hurricane or tornado. In general, if you're in the FIDO Alliance and had anything to do with the kind of micromanagement that passkeys can allow, FUCK YOU. Go get a job at Walmart as a greeter. We'll all be better off.