Comment by molind

Hmm. Passkeys are advertised as secure because they are difficult to hack. And since they use the same API as hardware security keys, I can store passkeys on my YubiKey for critical infrastructure.

They’re secure, stored in iCloud, and can be used from any of my Apple devices. And if I need extra security, I can use a hardware key instead. What more could I ask for?

I understand why passkeys are being promoted so heavily. They’re secure by design. Otherwise, companies have to think about all the possible ways their authentication systems could be compromised. And even then, they can still get hacked.

Passwords are weak. People can be tricked into revealing time-based authentication codes. But passkeys? They just work. Your grandma can’t read one out over the phone or write it on a sticky note next to her monitor.