187
Passkeys are a trap. Do not use them (nonfunctional.substack.com)
submitted 1 day ago by to c/privacy@lemmy.ml
126 comments fedilink hide all child comments
 

cross-posted from: https://lemmy.bestiver.se/post/1390699

Comments

you are viewing a single comment's thread
view the rest of the comments
[–] 12 points 10 hours ago (5 children)

some of this is disingenuous. For example you’re supposed to make multiple passkeys for your devices so that you can still Access your Accounts even if you lose your Main device (Ofc its still shitty because this forces you into the cloud if you only have 1). Also thats why the passkeys being bound to their „birthplace“ is Not really more of an issue than the others. Also im Not sure where they are forced? In fact i wish it would be more supported in certain apps

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 6 points 8 hours ago (2 children)

    Indeed. Every device should get a passkey. Its like client certs where you can lose a device and just remove that passkey from your account. Also, you /can/ store passkeys in pure software. Bitwarden can store passkeys for example. Lots of options for FIDO keys too. I have never heard a non technical person give me a secure password strategy. That is 100% of nontechnical people I have asked use bad password schemes. Passkeys at least enforce a truly randomly generated key.

    They still suck at usability but it is an attempt to solve a real problem. Basically the only thing standing between 99% of people and having all their accounts compromised is service password attempt rate limiting.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 9 hours ago (1 child)

    For example you’re supposed to make multiple passkeys for your devices How do I do this? Can you link to a guide?

    Also im Not sure where they are forced? The big transition is underway. Switch to passkeys or you are out.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 7 hours ago*

    Log in to a website that supports passkeys, go to the account security page, press add passkey. Your browser looks for connected security keys to add the passkey to or if you have an extension installed, it might start your password manager. in the security key case; It asks for your pin and it's done. If you use a password manager to store it, it will ask you where to put it. Once done; you can repeat and add any number of passkeys to your security keys or database. You should do at least two, for redundancy.

    I would not tie my passkey to windows/ios/android or whatever. I won't let a third party manage or sync them. Only on a security key I own or my password database.

  • permalink
  • fedilink
  • source
  • parent