248
Passkeys are a trap. Do not use them (nonfunctional.substack.com)
submitted 2 days ago by to c/privacy@lemmy.ml
178 comments fedilink hide all child comments
 

cross-posted from: https://lemmy.bestiver.se/post/1390699

Comments

you are viewing a single comment's thread
view the rest of the comments
[–] 23 points 1 day ago (9 children)

Passkeys mean a spread of enshittification to ever more areas of life. Specifically, they

  • force me to use an extra OS on an extra device and keep it around just to use a site with passkeys.
  • add insecurity and inconvenience. I neither can backup the passkeys nor use them on another device. (That's not implemented on Windows.) This user experience is laughable in 2026. The passkeys are forever locked on the device where I created them. I am forever chained to exactly one device. If it breaks down, my life ends because our lives depend on digital technology.
  • take away control from me and force me to trust third parties. I have to trust the hardware, the OS, the proprietary software, which makes me feel very uncomfortable as someone used to use Free software. Security by obscurity was always a bad idea.
  • deny me anonymity and control over my accounts. I can have only one account per domain.
  • are a black box with no user interface. With passwords I know exactly what account name and password I enter at which site. With passkeys I get asked for a PIN. That is all. There is no indication what exactly I authorize. This is a lot like clicking links in emails and giving your banking details to everyone who asks.

The recommendation “do not use them” is cute. They are forced on people. I can't choose.

  • permalink
  • fedilink
  • source
  • hideshow 9 child comments
    •
  • [–] 20 points 1 day ago* (1 child)

    I'm not familiar with any of these limitations that you described. Those might be limitations of the specific credentials manager(s) that you're using. You might want to try a different one.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 16 points 1 day ago (6 children)

    some of this is disingenuous. For example you’re supposed to make multiple passkeys for your devices so that you can still Access your Accounts even if you lose your Main device (Ofc its still shitty because this forces you into the cloud if you only have 1). Also thats why the passkeys being bound to their „birthplace“ is Not really more of an issue than the others. Also im Not sure where they are forced? In fact i wish it would be more supported in certain apps

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 8 points 1 day ago (3 children)

    Indeed. Every device should get a passkey. Its like client certs where you can lose a device and just remove that passkey from your account. Also, you /can/ store passkeys in pure software. Bitwarden can store passkeys for example. Lots of options for FIDO keys too. I have never heard a non technical person give me a secure password strategy. That is 100% of nontechnical people I have asked use bad password schemes. Passkeys at least enforce a truly randomly generated key.

    They still suck at usability but it is an attempt to solve a real problem. Basically the only thing standing between 99% of people and having all their accounts compromised is service password attempt rate limiting.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 0 points 1 day ago (2 children)

    You think an everyday user will think this way?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 day ago

    Regardless of if a regular user will think this way or not, it is good to have options, precisely for providing them as an option to a regular user, even if they end up not implementing them. The other option is NOT having the option. Which one do you think is more beneficial across the board?

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 1 day ago* (last edited 1 day ago)

    That's how they work, regardless of how users think. Though you're correct: the majority of computer users don't understand what they're doing and do feel threatened by change, even if that change is positive by any measure other than "I feel uneasy about changing something I have no grasp on".

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 1 day ago (1 child)

    For example you’re supposed to make multiple passkeys for your devices How do I do this? Can you link to a guide?

    Also im Not sure where they are forced? The big transition is underway. Switch to passkeys or you are out.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 1 day ago*

    Log in to a website that supports passkeys, go to the account security page, press add passkey. Your browser looks for connected security keys to add the passkey to or if you have an extension installed, it might start your password manager. in the security key case; It asks for your pin and it's done. If you use a password manager to store it, it will ask you where to put it. Once done; you can repeat and add any number of passkeys to your security keys or database. You should do at least two, for redundancy.

    I would not tie my passkey to windows/ios/android or whatever. I won't let a third party manage or sync them. Only on a security key I own or my password database.

  • permalink
  • fedilink
  • source
  • parent