4 ms·
> Passkeys are a fantastic technology. Since they are bound to the site they are created for, they cannot be phished by a hacker’s fake login screen. The same
by account42 14d ago
> Passkeys are a fantastic technology. Since they are bound to the site they are created for, they cannot be phished by a hacker’s fake login screen.
The same is true for passwords with a password manager.
> If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details.
Also not really a problem with randomly generated site-specific passwords in a password manager.
Really all the browser vendors had to do was add an API to make automatically generate a password that is then stored in the user's password manager the low friction option.
- rcxdude 14d agoIf you're doing that you might as well use public/private keys. The issues with passkeys are around user experience and education about how they are stored, and a lack of good backup options like enrolling a not-present device as opposed to relying on syncing them through an external service.
- account42 14d agoThe difference is that no password manager I used ever tried to hide my passwords from me.
- fph 14d agoThe huge UX drawback of password managers vs. passkeys is sites that have arbitrary requirements. "Your password must be between 9 and 12 characters long, and include at least two capital letters and a special symbol". Well, my password is randomly generated, and enforcing that there are two capital letters would just reduce entropy. If sites fixed this issue instead of pestering me for a passkey I'd be happy.