129
Passkeys are not a trap. Use them! (hachyderm.io)
submitted 1 week ago by to c/privacy@lemmy.ml
173 comments fedilink hide all child comments
 

A rebuttal to an anti-passkey, pro-TOTP post that has made the rounds on Lemmy as well.

you are viewing a single comment's thread
view the rest of the comments
[–] 19 points 1 week ago* (6 children)

I'm using GNU pass, it doesn't support passkeys. I'm using Arch with Firefox. When a site requesting a passkey, Firefox says touch the key. I don't know what to do so I cancel the process and search for a workaround.

For example npmjs.org, they require passkey for publishing packages, so I rather have to create an API token which supposed to be for CICDs and publish the package with that instead.

It's f*cking awkward. I have a secure password manager, offline, nowhere shared, even the passwords are encrypted. Don't force passkeys on me for no reason, I was secure before as well. And even if you do, at least it should work. As always Linux users left behind.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 2 points 1 week ago

    I have a secure password manager, offline, nowhere shared, even the passwords are encrypted.

    How can the service provider tell, though?

    The point of passkeys is to create an authentication flow that is easier for users to keep secure. The question, then, becomes whether a service provider should make user authentication decisions based on the worst case scenario, best case scenario, or average case scenario. Passkeys are a reasonable way to make sure almost all of your users have secure login credentials, even if the best of the best users would have just as secure login credentials with traditional passphrases.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 1 week ago* (last edited 1 week ago) (1 child)

    I'm another gnu pass user, made a similar complaint in one of the other threads. I see dessalines claiming here that they use passkeys just fine with a 'FOSS" password manager. I guess that means it's up to us to contribute an implementation of some kind.

    There's a discussion/issue on the codeberg hosting of the passff extension that seems to lay out what is needed: https://codeberg.org/PassFF/passff/issues/581

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •