Typing a password slows you down, so now you'll need to enter a 2fa and a password. Fucking brilliant!

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 1 day ago (10 children)

A lot of people in here don't understand security fundamentals.

Passkeys are not bad things. They are good things. 2FA in general is a good thing, and passkeys are a particular type of 2FA.

The principle behind this type of security is, in loose terms, "one thing you have and one thing you know". Historically this has meant a device and a password.

The idea is that stealing just a physical object is easy (lost item, cloned, or theft), and stealing just a single piece of information is easy (leaked database, phishing, etc). Stealing both is much harder.

Passkeys satisfy both by requiring a piece of information to unlock the passkey (a fingerprint, or your phone's password, or your hardware key's unlock code). You need both the physical object where the passkey is stored and the means to unlock that device.

Password managers are not a replacement for passkeys because they are not hardware-bound. A compromised service or server provides full access.

Please use passkeys. They are genuinely more secure than passwords without 2FA.

  • source
  • hideshow 10 child comments
  • [–] 10 points 1 day ago (5 children)

    I've seen the argument that passkeys solve a lot of problems with passwords, but I havent heard a good explanation on how you set up on a new device? At some point you need some way to authenticate that is not a passkey and so you end up back to square one passwords/MFA.

    So now we've created a whole additional layer of security while not solving the initial problem. Not to mention how do you access an account if you lose your phone/don't have it on you if it's only accessible via passkey.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 3 points 1 day ago (3 children)

    Some password managers, like bitwarden, allow you to save Passkeys in them, and use them on multiple devices. That's the only practicable way I've found of using them. I need to use most services on multiple devices.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 1 day ago (2 children)

    Syncable passkeys do make it easier to handle new devices, but break one of the key values of passkeys - device atteststion. Syncable passkeys are effectively just long passwords as they aren't tied to a device, meaning anyone who gets ahold of the passkey can access your accounts.

    At least with syncable passkeys you can't have a website leak your passkey (as they asymmetric keys), but with password+MFA a leaked password doesn't give direct access to your accounts.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 day ago* (1 child)

    Too many services don't allow multiple passkeys per account. If they are supposed to be device level attestation, you need to be able to enroll one per device. I know that there are some frameworks to connect an enrolled device to attest, but that a) plain doesn't work well for some configs, and b) is annoying. I understand having a hardware security key for some stuff, but I feel like having that be a random ass phone for most people isn't really that desirable.

    I feel like syncable passkeys are a band aid on top of most services having no idea how to implement passkeys well.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 16 hours ago

    That's good to know, I've honestly been avoiding them as I find the rollout and concept from to be questionable at best.

    Given those issues I'll be curious to see if passkeys keep up their momentum. It sounds a lot like a solution that solves some problems while creating other problems.

  • source
  • parent
  • [–] 1 point 1 day ago

    A) log in with passkey prior to device replacement, remove passkey temporarily, then re-add with new device

    B) Set up multiple valid passkeys using separate devices, so that a single device failure does not prevent access

    C) Use a portable passkey store like a Yubikey that is portable to any computing device

    Personally I own two yubikeys; one stays on my person at all times, the other stays at my home at all times. I always add both when creating new passkeys for a service

  • source
  • parent
  • [–] 3 points 1 day ago (3 children)

    Passkey's are good in theory. But the amount of them that have implemented incorrectly and don't save. Or can't find the passkey and let you just input a password or email a link is dumb.

    I'm sticking with MFA using a different service for my MFA from my password manager.

    I'll maybe use passkey's for more sensitive information like banks.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 1 day ago* (2 children)

    I have literally never had this problem. Passkeys are a strictly defined protocol as far as I'm aware.

    I'd be really curious to know what services you've used that had this problem. Or what hardware you tried to save it on that didn't work.

    And yeah, implementing passkeys but allowing login with a password or email link is just wrong. No defending that.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 day ago (1 child)

    My issue with passkeys is that they're tied to devices and ecosystems, and I don't always use the same devices or browsers. I also want to keep work and personal stuff separate. I deliberately store my passwords and MFA in different services so one breach doesn't expose both.

    I use different systems for different things. I sometimes work from home and pay bills at work, but I absolutely don't want personal access stored on my work machine.

    I've also had passkeys fail to register properly and had to remove them and start over. Even Microsoft documents registration issues.

    Maybe passkeys will get there, but between setup issues and keeping everything working across devices and browsers, they're not as simple as they're made out to be. I prefer having control over where my credentials are stored and backed up. Everyone is different, but this new passkey push is not a good fit for me until things get smoothed out.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 day ago

    For your specific use case I recommend Yubikey for for passkey storage. It works everywhere a local device-stored passkey works but it's portable.

    It's what I personally use for the exact reasons you describe

  • source
  • parent