← Back to context

Comment by chr15m

8 days ago

If you don't like passkeys the solution is very simple. Resist using them. As long as a significant minority resist and refuse, they will have to keep other types of auth around.

6 comments

chr15m

Reply
cowlevel  8 days ago

Has to be a significant majority or else they'll just turn the other methods off.

I don't have the choice to use a bank card online without 2FA - it's mandated. I can either use one of the options provided or I will go to my bank in person and close my account. Those are the possibilities. Nothing else.

  • chr15m  8 days ago

    An uncompromising minority has surprising power. See Nassim Taleb's idea of assymetric minority rule.

    Passkeys are only one kind of 2FA.

    Yes, banks are particularly bad at this because their threat model is strong.

    My bank required installing an authenticator, but apparently recently they've allowed SMS based 2FA. It seems users complained/resisted and they had to accommodate them. Maybe you should give feedback to your bank. Be the uncompromising minority.

    I think 2FA is fine and a good idea, but I agree with the author that passkeys seem fraught as designed.

    • lxgr  7 days ago

      As somebody that’s had to deal with US banks and their bizarre “authentication” schemes: I wish.

      Many would actually rather you close their account with them than them making the tiniest compromise or offering any alternative to their SOP at all. That SOP strongly assumes things like “all customers have a mobile phone plan with the big three carriers”, “all customers own property or at least have car insurance” (that’s already their authentication fallback flow!) etc.

      1 reply →