A rebuttal to an anti-passkey, pro-TOTP post that has made the rounds on Lemmy as well.

you are viewing a single comment's thread
view the rest of the comments
[–] 19 points 1 week ago (18 children)

Nah, lock-in is not a safety feature. 16+ random chars are plenty, and if cracking gets better I'll go to 20 or 30 chars. My pw manager doesn't care what strings go in it or which device opens it up.

  • source
  • hideshow 18 child comments
  • [–] 6 points 1 week ago (8 children)

    You can have passkeys on multiple devices. I use them on different platforms for the same sites.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 5 points 1 week ago (7 children)

    How do you transfer your passkey to a new device?

  • source
  • parent
  • hideshow 7 child comments
  • [–] 5 points 1 week ago

    If you use a self-hosted password manager like bitwarden, then its there. If you use a file-based password manager like keepass, then you can use any syncing method you choose, and its no different from passwords.

  • source
  • parent
  • [–] 0 points 1 week ago (4 children)

    You don’t, you can have multiple passkeys, one for each device.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 1 week ago (3 children)

    ok.

    How do you add a new device to your account without a password or the old device?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 week ago* (2 children)

    Password, then get a prompt about registering a new passkey.

    After that I can use the passkey registered on either device.

    Edit: to clarify, most sites still let you log in with a password after you’ve registered a passkey

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 1 week ago (5 children)

    That's my workflow as well 26 random characters, a yubikey (and Aegis TOTP for sites that don't have fido or similar) and I'm good.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 5 points 1 week ago (4 children)

    I like the idea of a Yubikey but there is no way it would survive more than a month on me due to the conditions where I work. And getting a physical key then not having it on my body at all times is a non-starter.

    I keep my keepass .kdbx in on a webdav server and that covers any device I can think of.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 3 points 1 week ago (3 children)

    Do you work in a blender? It's a pretty solid bit of plastic, should be fine in a pocket or wherever the device you're using it with is.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 9 points 1 week ago (2 children)

    Maintenance at a blast furnace. I am exposed to acidic vapours, caustic vapours, ambient heat in the 60c range, radiant heat in the 1000c range, rock from the nanometer up to 30cm size, phenolic resins, oil mists, and metal powders. And then there's the crawling around over, under, and between equipment.

    Not every tech-savvy person works in an office.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 1 week ago (1 child)

    Cool. Hope it's ok on your health. I suppose you have some way to keep your phone safe, and don't need to do 2FA while exposed to all of those things. You could probably wrap one up pretty well and still have the NFC work too.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 0 points 1 week ago (2 children)

    Passkeys also aren't lock-in. You control them, and your FOSS password manager likely already supports them.

  • source
  • parent
  • hideshow 2 child comments