Comment by skybrian
8 days ago
Ideally, passkeys should be cattle, not pets. You should have more than one per account, saved to more than one password manager. Then it's fine if they're not copyable because you can get another.
8 days ago
Ideally, passkeys should be cattle, not pets. You should have more than one per account, saved to more than one password manager. Then it's fine if they're not copyable because you can get another.
Those are not passkeys then. The idea of passkeys is that they’re synchronizable, since having to manually manage multiple credentials per account is extremely tedious.
To avoid lockout, you want to have more than one key to open a door however you do it. At least, for accounts that are important to you. It might be that one is a passkey and one is something else, though.
If I can sync from phone (Android and also iOS), to Linux / browser (Firefox), that's fine. Or is it?
The problem here is not about them being copyable, it's about the "attested" keys which depend on a 3rd party.
> more than one password manager
I'm sorry, what? Who has more than one password manager (other than a personal/work split)? That's absurd and not something anyone I've heard of would put up with
Want to guess how many non-tech individuals save passwords in Chrome on desktop and in iOS on their iPhone?
At that point you don't have a password manager, you have a bunch of passwords you know and you just left "remember this" checked.
1 reply →
I actually use both. Bitwarden with a strong password and auto-locking for anything that needs actual security, or can manage to keep a session logged in. Chrome's built-in password manager is nice for a few sites that are not really that important at all (a few forums and local activity groups), yet for some reason keep requiring password reentry all the time.
It's not that hard. Chrome and something else. (Such as iOS.) A different kind of backup authentication method would work too.
if I can't have two password managers for redundancy then none it is.