Comment by happyopossum
5 days ago
Almost every complaint I see about passkeys seems to be based on behavior and configurations I just do not see in the real world.
“Once I set up a passkey I can’t log in from another device” - have never seen this to be the case. Existing password / OTP codes have always worked as a fallback if syncing somehow breaks.
“I don’t want to trust Apple/MS/Google with my logins” - so don’t. Use bitwarden or 1Password or lastpass or whatever you want to store your passkeys.
“If I lose my phone I’m screwed” - see #1 and enable sync maybe?
Boils down to I believe a lot of folks looked at passkey implementation at a high level, saw some potential pitfalls, and never actually used them to discover those pitfalls have all been accounted for.
Go ahead and skip passkeys if you want, but stop preaching about evils that don’t exist.
People used to complain that some password managers like Keychain don't let you transfer passkeys at all, but this was fixed. The problem is, passkeys can designate themselves as non-syncable and/or only allowed to be stored in certain password managers / hardware.
There are comments here about companies that already force the use of Microsoft Authenticator, which forces you to use a locked-down phone.
“Once I set up a passkey I can’t log in from another device”
This literally happened to my grandfather yesterday (well, I found out about yesterday, anyway). Dude just casually mentions that he can only log into his webmail on his iPad, and I immediately knew what was up.
"so don’t. Use bitwarden or 1Password or lastpass or whatever you want to store your passkeys." -- All fine and dandy until they decide to start using that attestation feature that they 'pinky promise' they won't use for nefarious purposes.
Passkeys are literally evil, and exist exclusively because 1) companies are evil, and want nothing short of complete and utter domination of their users' lives and 2) one CEO is embarrassed that he was too stupid to realize that "my password manager isn't autofilling" means "I'm on the wrong website".