129
Passkeys are not a trap. Use them! (hachyderm.io)
submitted 1 week ago by to c/privacy@lemmy.ml
173 comments fedilink hide all child comments
 

A rebuttal to an anti-passkey, pro-TOTP post that has made the rounds on Lemmy as well.

you are viewing a single comment's thread
view the rest of the comments
[–] 15 points 1 week ago (3 children)

After reading both of the posts, I'm kind of back where I started with passkeys: neutral. I'm pretty happy with my current setup of a self-hosted password manager, diceware master passphrase and strong, unique passwords for every account, along with an open source app for TOTP. I only ever see passkeys pushed on me for work-related accounts anyway, but I'm not using them there either. I do have a question though if someone can answer: are passkey protected logins also vulnerable to stolen session cookies?

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 2 points 1 week ago (1 child)

    So it's fair that you are neutral about them for your own use, clearly you know what you're doing. It doesn't make sense to be neutral about them, generally. On usability alone they are not good. There are so many people who don't have a clue how they work, or their consequences, and just click okay when continually harassed into using them. Some will even go ahead and save one on a shared computers, or someone else's, 'because the website says so'.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 week ago

    Honestly, I don't understand them well enough to recommend them either. I do IT, and I set my users up with a (managed) password manager and MS Authenticator. If I encounter a situation where a user has ended up with a passkey for a given service, I just leave it be. On the other hand, if someone is locked out because of a passkey, I reset it and get them set back up with the Authenticator app.

  • permalink
  • fedilink
  • source
  • parent