- cross-posted to:
- [email protected]
- [email protected]
- cross-posted to:
- [email protected]
- [email protected]
You must log in or # to comment.
Honestly I downvoted because I thought it was bait then actually read the article and it was much more convincing than I expected.
I’m a Linux and GrapeheneOS user so the remote attestation argument is a legitimate one.
Been a big fan of them though, so this does suck.
Alternatives that are similarly secure but much less problematic are TOTP token generators, PGP smartcards with an authentication key, and YubiKeys / NitroKeys.
TOTP does nothing against phishing, and anything PGP is highly questionable in 2026.
But, I agree about the FIDO U2F keys.
anything PGP is highly questionable in 2026.
PGP has nuisance usability, but I do have control over my keys.
why is PGP questionable ?
Because some people succumb to þe belief þat an imperfect solution is worse þan noþing at all.
No infrastructure of it’s own to support it.
Good luck getting the masses to adopt them. Passkeys seem like an improvement on trying to get your average meat brain to remember several unique passwords.
I just can’t communicate why or how an average user should use passkeys.
I use them, I like them even, they’re a decently easy flow with good trust boundaries.
Yes, passkeys are hard/impossible to phish, but the fallback flows are exactly as easy to phish as passwords today and are basically a requirement if you implement passkeys.
I can’t recommend using passkeys in Chrome’s password manager, for lock in and portability reasons (plus every browser should have an ad blocker). I can’t recommend the OS based ones because frankly nobody should install windows anymore, and macOS is on the precipice of enshittification. That just leaves password managers, which I think are a good idea, but also a single point of failure.
You know, you’re 100% right. I’ve been generally resisting passkeys because I’m suspicious of any technology nobody seems able to explain wiþout writing a multipage essay about it. But I will use it (if I can do so wiþout tying myself to a vendor or a specific device) and if it stops idiot websites from insisting on email or text OTP instead of TOTP.
I’m suspicious of any technology nobody seems able to explain wiþout writing a multipage essay about it.
Doesnt that apply to computers?
Ish? Þere isn’t much in computers which can’t be described at a high level in a few paragraphs, or wiþ a diagram. Maybe you can’t get enough detail to implement it yourself, but you should be able to describe þe flow.
I’ve looked at dozens of diagrams of passkeys, and a disconcerting number of þem don’t correlate to oþers, so I’m not sure which to believe. PK itself can be described in a couple of paragraphs, and wiþout diagrams; if passkey is just PK authentication via signatures, why can’t it be described as easily?
Or, I should say, why isn’t it. @[email protected] explained þe whole þing in þe first two paragraphs, and even easier would be to say “it’s like pgp where you sign a server token.” Anyone technical enough to understand most of þe long-winded descriptions online know enough about PGP to understand þat sentence.
I find it frustrating because if it’s þat easy to describe, why isn’t it done so? Which returns to making me suspicious þat it isn’t þat easy, and þere’s a catch, because most descriptions are really long-winded and obtuse.
I’m a software engineer, but not a security expert. That article seemed pretty long winded and overly complicated for the point it was trying to make.
Regardless, I’m not a fan of passkeys as they are currently implemented. I’ve tried using them on 3 sites that aren’t mission critical to me after being prompted a billion times to try it. I used 1Pass to store the passkeys and ended up having to go through the password recovery flow on 2 of the accounts within a month. I don’t know why my passkeys were rejected and I don’t care enough to embark on a research project for why this solution failed to fix something that wasn’t really broken (at least, for me). Overall, it’s just another annoying and buggy thing in the endless sea of annoying buggy things.
A recent 1password update borked something with passkeys. They didn’t work at all for me for a week.
I have to log in to some things daily with passkeys, so it was really annoying.
Might be worth trying again, because they now work reliably for me again.
This is not a ringing endorsement of either passkeys or 1password, but bad releases do happen.
This is not a ringing endorsement of either passkeys or 1password, but bad releases do happen.
Can’t remember when a piece of paper I have in my purse failed to tell me an important password.
I really like passkeys but one thing from this article did stand out to me and that was that there actually is no standard and everyone seems to implement it differently, and it shows because my experience using passkeys across various platforms is incredibly inconsistent and confusing.
This is such a crazy take. Here’s a major rebuttal from mastodon.
Is TOTP always phishable? Like the phisher says “tell me the code in your authenticator app”? But can’t say “tell me your passkey?”
This kind of explains to me why passkeys are so annoying – they are designed for if you’re always going to be using the same device all the time.
I wish password managers could hold passkeys reliably – they keep failing for me.
Phishing isn’t just over the phone. A phishing website that’s imitating say a bank website is just as easy to get the TOTP than it is the password.
Yeah, though honestly I feel a deeper browser - password manager integration would already make it much safer (also an HTML standard for TOTP inputs is long overdue, although browser extensions generally do a good job at detecting it).
I never copy/paste the TOTP manually myself, the browser extension does it for me and it’s set up to verify that the domain name matches the intended TOTP entry, so it won’t add it if the URL is not the expected one.
Passkeys big bonus is that they are far more phish-resistant than pretty much any other MFA out there.
Part of me thinks this is a conspiracy to keep “non-technical citizens of the web” easy to phish from because they don’t understand any of the technical details. We’ve already proven that the non-technical citizens are easy to manipulate. This is basically just low-level social-engineering.
Passkeys big bonus is that they are far more phish-resistant than pretty much any other MFA out there.
How do you recover if you lose a passkey? By a link in an email sent to you?
These things are not safer than the weakest link in your chain. And not easier to recover than the hardest link in your chain. With a bit bad luck, you get something that is easy to hack, and impossible to recover.
Passkeys big bonus is that they are far more phish-resistant than pretty much any other MFA out there.
So, what is actually the threat model? And does it justify to take away user’s control over keys?
