Comment by qlte
8 days ago
TOTP/SMS 2FA is a gigantic pain, I've probably lost multiple 24 hour days worth of time added up from entering TOTP and SMS 2FA codes dozens of times per day on websites that mandate it despite having nothing meaningful worth securing.
With passkeys I click once and I'm in like the golden age of using the web with a password manager in 2012. It's a huge quality of life improvement. If people want to avoid passkeys for whatever reason, that's fine but not interested in reading the same slippery slope argument that gets reposted every week.
A recurring issue with these critiques is how they seemingly presuppose passkeys are an all or nothing thing, and losing your passkey means losing access entirely. Which isn't how it works basically anywhere. It's just another auth method, if you can't use a passkey you fall back to whatever recovery method is offered. If passkeys became some user hostile trap overnight I'd just unenroll them and use TOTP, SMS 2FA, email 2FA, or whatever else is supported.
So true.
And every critic always attacks this same thing. TOTP isn’t so bad, my password manager can do it. 2FA is fine it’s automatically pulled from my phone.
It’s still phishable. The password is still sent. You haven’t solved anything, you just piled more complexity on top to make it harder. People can still use the same password at 12 websites.
Passkeys never get transmitted. If you hack into a server and steal my credentials, all you get is a public key. You can’t use it at another website. A bad developer can store my password or TOTP secret in a way that makes it useful to a thief. That’s not possible with Passkeys.
No one ever offers an alternative other than saying it’s irrelevant. Despite practical experience showing otherwise.
Passkeys work and make my life better. These constant rants remind me of seeing people argue that the GUIs are a waste of time and no one will ever use them and it’s a fad that will go away and the only reason everyone’s talking about them is companies want to sell graphics cards and mice.
>Passkeys work and make my life better.
Not the concern, it's whether it's worth the time and energy to expand passkeys as the default and getting normies using them. Some people will always surrender and say they have nothing to hide, so be it. I'm more thinking about the practical rough edges that user bases will cut themselves on once you expand past the extremely-online.
From my experience, it's a nonstarter. The expectation that normies will understand and maintain a password manager layer to store their digital keys in and understand that concepts end such as sharing passwords or logging in on a new device without fully bootstrapping the password manager is just too far.
I think sometime after Q-Day when the dust settles and we've had to reissue all the keys today, we'll have a better answer on whether the specter of remote attestation is truly manifesting and in any event I bet there'll probably be an updated passkey concept by then.
Passkeys work because you always have the hardware for them.
Suppose I had only passkeys and Google Pay. I take a train into town and lose my phone. What then? I'm screwed.
I couldn't just go home because I'd need to buy a ticket or taxi using my phone. I couldn't buy a replacement phone. I wouldn't be able to online shop on a library computer or withdraw money unless I have a physical bank branch. (I do not.) I can't even contact anyone unless I know their number and borrow a phone or find a way to send an email.
My preferred balance of risk vs convenience is: passwords in a password manager, hardware-based 2FA only for making account changes, and confirmation emails (My email password is not in my password vault.) any time a site successfully or unsuccessfully processes a login attempt.
There is no hardware element. If someone phishes my password, I'll know right away from the login email, unless they're so talented or lucky that they also accessed my email or found a way to spoof my 2FA. If I lose my phone, I'm not totally helpless. I don't see an overall downside to my strategy that isn't worse than passkeys.
-----
Edit: One suggested alternative I can fathom is "passkeys managed by password manager". While this does provide better security than "passwords managed in a password manager", my experience has been that passkeys are not well-implemented across all platforms where they Just Work(TM) on every site. I don't know how you'd go about using passkeys in a shared public computer setting (university lab or library) unless you can install browser extensions (and why would you want to, even if you could?). At the end of the day, these passkeys are still secured by the password manager's single master password. Regardless of what I use, I want emails when a login attempt succeeds or fails. It takes one full second to swipe away at my convenience, and I would instantly become alert to an attempt or login I didn't execute.