Comment on Passkeys Explained: The End of Passwords
Engywuck@lemmy.zip 3 weeks ago
No, thanks. I’ll keep using password+2FA and I hope that passkeys never become “mandatory”.
Comment on Passkeys Explained: The End of Passwords
Engywuck@lemmy.zip 3 weeks ago
No, thanks. I’ll keep using password+2FA and I hope that passkeys never become “mandatory”.
TotalCourage007@lemmy.world 3 weeks ago
Thanks to our dystopian hellscape we live in it’ll become mandatory just like useless online ids. I hate having to explain passkeys to my family. Some fuckface suit who doesn’t use it properly pushed for a portfolio addition.
sonofearth@lemmy.world 3 weeks ago
But what’s dystopian about passkeys. They are actually more secure than Password + TOTP. Phishing out a passkey is practically impossible.
TotalCourage007@lemmy.world 3 weeks ago
If its not fully functional it feels more like a vendor lock in than anything actually useful. Use a Google device but want to change? Oh I’m sorry you have to do all this work first thanks to passkeys.
Some websites are better about it but they can also have support in-fighting over which service works better. Its the Password Manager scenario all over again but worse.
sonofearth@lemmy.world 3 weeks ago
That’s why it’s important to avoid vendor lock-in and use actual reputable password managers to secure your passkeys such as Bitwarden, 1Password, or KeePass. On Android 14+ and iOS, you can even set your preferred password manager as the default passkey provider.
If you don’t fully trust Bitwarden servers, you can self-host a Vaultwarden instance, which is compatible with Bitwarden clients. Alternatively, using a yubikey is also a great hardware based option. Just because Google & Microsoft are heavily promoting passkeys doesn’t mean they’re inherently bad.
Passkeys work flawlessly for me across platforms:
Personally, I use passkeys everywhere. I host my own Vaultwarden instance to store all my passkeys, and for redundancy, I also keep separate ones in my Keepass database, which I use for TOTPs. My self-hosted stack is secured by Authentik, running completely passwordless and uses passkeys for authentication and other apps integrate via OAuth and Proxy Auth.
I still don’t quite understand the issue you mentioned with websites. Typically, the passkey mechanism is triggered directly by the browser or OS (if you’re on mobile). You’ll be prompted to either save a new passkey or sign in with an existing one. If your password manager is correctly set up as the default credential provider, it should work seamlessly. Even without a browser extension, most Chromium-based browsers let you scan a QR code with another device that has your passkeys or you can simply insert a yubikey to authenticate.
What infuriates me is that some services like Amazon use passkeys only as second factor and asks for an OTP anyways which defeats the whole purpose. But for services that do it right, passkeys works seamless!
Sl00k@programming.dev 3 weeks ago
What portfolio does passkeys push?