Comment by elteto
1 month ago
While the technology itself may be great (I don't really know since I don't use them) it has been co-opted by the tech conglomerates as another form of isolating and walling off users into their ecosystems.
And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny. One of those "if you see them running that way you run the opposite way".
Exactly. That's why I'll never use passkeys: they're just another way to force us into a commercial walled garden.
Passwords with 2FA are simply better and more freedom friendly.
I store my passkeys in KeePassXC and I have absolutely no feeling of being walled into any garden, personally.
but what do passkeys offer in terms of security, when stored in password managers, compared to having a (password manager) generated password and a totp?
I believe that by allowing password managers to store passkeys, the whole purpose of "device based security" got lost..
2 replies →
Wait until websites start demanding device-bound/attested passkeys. Big tech just needs to get enough adoption to make this change.
2 replies →
I just bought a passkey... It's a USB device, completely separate from any big conglomerates.
But then you need to phisically carry it along with you everywhere you go, if you want to log into a service :/
19 replies →
How do you see passkeys as a walled garden but not 2FA? You presumably store your 2FA seed in a password manager.
I can write my own authenticator implementation in a few hours by hand, maybe 5 minutes vibe coded. https://www.rfc-editor.org/info/rfc6238/
Even if you throw your phone into a volcano and buy a new one, you can still receive SMS verification.
1 reply →
Passwords can move between walled gardens generally very easily (export) or manually in all cases (enter by hand).
Passkeys only very recently got relatively broad support for migrating data (after years of promise and no support at all), and they report (optionally with hardware attestation) what password manager you're using so sites can force specific ones.
I did a deep dive on this since progressively more places are taking a hard line about Passkeys.
The most flexible, independence preserving thing to do is to use a third party password manager like Bitwarden, and make that the default passkey flow for your devices. If desired, you can self-host something like Vaultwarden so that you can both keep the keys independent of third parties and walled gardens and also propagate them to other client devices.
To be clear I'd much rather not have learned / implemented any of this, and I don't use passkeys unless forced, but this seems like a valid coping strategy.
It’s a bit ironic that Apple is the one that lets you export them.
They're also not supporting device attestation which would allow websites to insist on particular implementations of passkeys.
That's more because attestation breaks their passkey cross-device sync process, rather than out of benevolence.
But only to other approved apps
Not as far as I’m aware? They of course require the target app to be compatible with the way they export them, but I don’t think they vet them manually. At the very least, on my phone, the apps it agrees to export to include Chrome and Bitwarden (the latter of which lets me export them further).
> And honestly, nowadays, if tech companies are pushing really hard for something then that is an immediate red flag for me and it bears more scrutiny.
The reason is the ever increasing number of hijacks of social media presences and code hosting portals, with the latter being a serious financial threat. Done right, passkeys stay in the Secure Enclave, at least for anything Apple and most of the Android sphere. There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
The doubt is more "how will tech companies use passkeys as an excuse to do something stupid" than "passkeys themselves must have inherent problems because tech companies are pushing them".
Passkeys could be the savior of all security problems worldwide from a capability point of view and tech companies would still ruin it by trying to force ways it pushes you into their ecosystem instead of just being whats both secure and convenient.
As an example, I have 3 different passkey _APPS_ on my phone and cannot go down to one because of various reasons with each (such as MS authenticator, forced for integrating to Microsoft at work).
> There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).
Click "I lost my device", enter contact, get a reset link via email/sms
Email and SMS are not reasonable and both have an extraordinary number of flaws.
6 replies →
[dead]