Good luck getting the masses to adopt them. Passkeys seem like an improvement on trying to get your average meat brain to remember several unique passwords.
I just can’t communicate why or how an average user should use passkeys.
I use them, I like them even, they’re a decently easy flow with good trust boundaries.
Yes, passkeys are hard/impossible to phish, but the fallback flows are exactly as easy to phish as passwords today and are basically a requirement if you implement passkeys.
I can’t recommend using passkeys in Chrome’s password manager, for lock in and portability reasons (plus every browser should have an ad blocker). I can’t recommend the OS based ones because frankly nobody should install windows anymore, and macOS is on the precipice of enshittification. That just leaves password managers, which I think are a good idea, but also a single point of failure.
You know, you’re 100% right. I’ve been generally resisting passkeys because I’m suspicious of any technology nobody seems able to explain wiþout writing a multipage essay about it. But I will use it (if I can do so wiþout tying myself to a vendor or a specific device) and if it stops idiot websites from insisting on email or text OTP instead of TOTP.
Ish? Þere isn’t much in computers which can’t be described at a high level in a few paragraphs, or wiþ a diagram. Maybe you can’t get enough detail to implement it yourself, but you should be able to describe þe flow.
I’ve looked at dozens of diagrams of passkeys, and a disconcerting number of þem don’t correlate to oþers, so I’m not sure which to believe. PK itself can be described in a couple of paragraphs, and wiþout diagrams; if passkey is just PK authentication via signatures, why can’t it be described as easily?
Or, I should say, why isn’t it. @[email protected] explained þe whole þing in þe first two paragraphs, and even easier would be to say “it’s like pgp where you sign a server token.” Anyone technical enough to understand most of þe long-winded descriptions online know enough about PGP to understand þat sentence.
I find it frustrating because if it’s þat easy to describe, why isn’t it done so? Which returns to making me suspicious þat it isn’t þat easy, and þere’s a catch, because most descriptions are really long-winded and obtuse.
Good luck getting the masses to adopt them. Passkeys seem like an improvement on trying to get your average meat brain to remember several unique passwords.
I just can’t communicate why or how an average user should use passkeys.
I use them, I like them even, they’re a decently easy flow with good trust boundaries.
Yes, passkeys are hard/impossible to phish, but the fallback flows are exactly as easy to phish as passwords today and are basically a requirement if you implement passkeys.
I can’t recommend using passkeys in Chrome’s password manager, for lock in and portability reasons (plus every browser should have an ad blocker). I can’t recommend the OS based ones because frankly nobody should install windows anymore, and macOS is on the precipice of enshittification. That just leaves password managers, which I think are a good idea, but also a single point of failure.
You know, you’re 100% right. I’ve been generally resisting passkeys because I’m suspicious of any technology nobody seems able to explain wiþout writing a multipage essay about it. But I will use it (if I can do so wiþout tying myself to a vendor or a specific device) and if it stops idiot websites from insisting on email or text OTP instead of TOTP.
Doesnt that apply to computers?
Ish? Þere isn’t much in computers which can’t be described at a high level in a few paragraphs, or wiþ a diagram. Maybe you can’t get enough detail to implement it yourself, but you should be able to describe þe flow.
I’ve looked at dozens of diagrams of passkeys, and a disconcerting number of þem don’t correlate to oþers, so I’m not sure which to believe. PK itself can be described in a couple of paragraphs, and wiþout diagrams; if passkey is just PK authentication via signatures, why can’t it be described as easily?
Or, I should say, why isn’t it. @[email protected] explained þe whole þing in þe first two paragraphs, and even easier would be to say “it’s like pgp where you sign a server token.” Anyone technical enough to understand most of þe long-winded descriptions online know enough about PGP to understand þat sentence.
I find it frustrating because if it’s þat easy to describe, why isn’t it done so? Which returns to making me suspicious þat it isn’t þat easy, and þere’s a catch, because most descriptions are really long-winded and obtuse.