you are viewing a single comment's thread
view the rest of the comments
[–] 8 points 1 day ago (3 children)

Indeed. Every device should get a passkey. Its like client certs where you can lose a device and just remove that passkey from your account. Also, you /can/ store passkeys in pure software. Bitwarden can store passkeys for example. Lots of options for FIDO keys too. I have never heard a non technical person give me a secure password strategy. That is 100% of nontechnical people I have asked use bad password schemes. Passkeys at least enforce a truly randomly generated key.

They still suck at usability but it is an attempt to solve a real problem. Basically the only thing standing between 99% of people and having all their accounts compromised is service password attempt rate limiting.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 0 points 23 hours ago (2 children)

    You think an everyday user will think this way?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 16 hours ago

    Regardless of if a regular user will think this way or not, it is good to have options, precisely for providing them as an option to a regular user, even if they end up not implementing them. The other option is NOT having the option. Which one do you think is more beneficial across the board?

  • source
  • parent
  • [–] 2 points 23 hours ago* (last edited 22 hours ago)

    That's how they work, regardless of how users think. Though you're correct: the majority of computer users don't understand what they're doing and do feel threatened by change, even if that change is positive by any measure other than "I feel uneasy about changing something I have no grasp on".

  • source
  • parent