4 ms·
Exactly. That's why I'll never use passkeys: they're just another way to force us into a commercial walled garden. Passwords with 2FA are simply better and mor
by reddalo 10d ago
Exactly. That's why I'll never use passkeys: they're just another way to force us into a commercial walled garden.
Passwords with 2FA are simply better and more freedom friendly.
- apexalpha 10d agoI just bought a passkey... It's a USB device, completely separate from any big conglomerates.
- reddalo 10d agoBut then you need to phisically carry it along with you everywhere you go, if you want to log into a service :/
- apexalpha 10d agoYes, it’s like a key. :) Though realistically I use a passkey for services I care about and a password manager for the rest.
- eikenberry 10d agoKeys can be copied very easily. It’s one of their primary features. Can you easily copy your USB key?
- jazzyjackson 10d agoYubikeys are Secure Enclaves designed to not be copyable
- eikenberry 10d agoRight. That's the flaw I was pointing out.
- krupan 10d agoPhysical keys can easily be copied, and physical locks can easily be picked. That might be fine for your house or storage unit, but for your bank account or your car (newer cars no longer have simple physical keys/locks), we've moved beyond that tech.
- mrguyorama 10d agoThat any and all physical security measures can be defeated is a feature, not a bug. Almost no human beings actually need that level of security, and the tradeoffs are absolutely not worth it for those of us without Mossad as a threat. How often do people lock themselves out of their own house? Don't you know anyone with ADHD? Imagine any time that happens it is mathematically verifiably permanent as a fact of reality itself. It doesn't matter that the state still views you as the legal owner, you are never allowed in ever again.
- krupan 10d agoNo web service is like that. They all offer recovery options. We aren't talking about Bitcoin here.
- EvanAnderson 10d agoThe trend of companies becoming easier to contact and customer service becoming better is well-documented.
- Telaneo 10d agoTell that to the people who have lost access to their Google account.
- krupan 8d agoNow we aren't talking about a security problem, we're talking about who really owns what. Google can lock you out of your account no matter what kind of authentication they use for that account
- apexalpha 9d agoYou can 'copy' it by registering a new one to the service.
- SoftTalker 10d agoAnd hope you don't lose it, or leave it in a pocket when you do the laundry, or plug it into a faulty USB port that zaps it, etc.
- vel0city 10d agoMy yubikeys have survived dips in the ocean, spilled beers, run over by cars, dropped in pans of used motor oil, left out in thunderstorms, and multiple trips through the washer and dryer. They're still fine even after a decade.
- hnfong 10d agoNothing survives the xkcd 538 wrench attack.
- finaard 10d agoThat's not the problem for me - I carry a bunch of tokens with me anyway (all my banking stuff is on hardware tokens, for example). My problem is more: My browsers run in containers or VMs, intentionally without hardware access. Getting passkeys to work there would be quite a bit of effort.
- jwcrux 10d agoHow do you see passkeys as a walled garden but not 2FA? You presumably store your 2FA seed in a password manager.
- dsl 10d agoI can write my own authenticator implementation in a few hours by hand, maybe 5 minutes vibe coded. https://www.rfc-editor.org/info/rfc6238/ https://www.rfc-editor.org/info/rfc6238/ Even if you throw your phone into a volcano and buy a new one, you can still receive SMS verification.
- qlte 9d agoKeePassXC supports passkeys
- Groxx 10d agoPasswords can move between walled gardens generally very easily (export) or manually in all cases (enter by hand). Passkeys only very recently got relatively broad support for migrating data (after years of promise and no support at all), and they report (optionally with hardware attestation) what password manager you're using so sites can force specific ones.
- Shank 10d agoI store my passkeys in KeePassXC and I have absolutely no feeling of being walled into any garden, personally.
- EvanAnderson 10d agoWait until websites start demanding device-bound/attested passkeys. Big tech just needs to get enough adoption to make this change.
- nbobko 10d agoAs much as I hate to admit it (because I love passkeys UX), but I do think that device-bound/attested passkeys are going to happen in the future :( UPD: oh, heck, attested passkeys are actually already in the protocol. Why can't we just have nice things?
- Shank 9d agoNobody is going to do this because Apple’s devices don’t support this for the Passwords app out of the box, by design.
- tonoto 10d agobut what do passkeys offer in terms of security, when stored in password managers, compared to having a (password manager) generated password and a totp? I believe that by allowing password managers to store passkeys, the whole purpose of "device based security" got lost..
- flumpcakes 10d agoYes. I use hardware based passkeys and absolutely love them. I think it was a giant mistake having them 'software' based. It some ways it kind of defeats the entire purpose...
- qlte 9d agoThey are 100% immune to credentials phishing. You literally cannot authenticate to an impersonator site based on cryptographic guarantees. And yes, I know the happy path of password managers uses host-based autofill which does add some friction to phishing attempts, but given the prevalence of unexpected but legitimate urls with weird alternate subdomains/SSO/redirects in modern login flows, you have to manually autofill/add an exception often enough that it's possible to let your guard down once at the wrong time.