We had originally planned to go all-in on passkeys for ONCE/Campfire, and we built the early authentication system entirely around that. It was not a simple setup! Handling passkeys properly is surprisingly complicated on the backend, but we got it done. Unfortunately, the user experience kinda sucked, so we ended up ripping it all out...
Just. Use. A. Fucking. Password. Manager.
It isn’t hard. People act like getting users to remember one password isn’t how it’s done already anyway. At least TFAing a password manager is way fucking easier than hoping every service they log into with “password123” has it’s own TFA. And since nearly every site uses shit TFA like a text or email message, it’s even better since they can use a Yubikey very easily instead.
Passkeys are a solution looking for a problem that hasn’t been solved already, and doing it badly.
Yes, use a password manager to store your passkeys.
You say that and then
That’s literally a problem passkeys solve and password managers don’t lol
I make the assumption people are using the password managers like they should, which is generating unique, complex passwords, which is kinda the point. Once you hit a certain number of characters on a random password, you might as well not try. And passkeys don’t solve any sort of MFA problem, same as passwords.
And tell me something, do you realize how cunty you come off when you end a comment with “lol”?
They do in fact solve this problem. Passkeys are something you have, and are secured by something you know, or something you are.
They also solve an age-old problem with passwords, which is that regardless of how complex your password is, it can be compromised in a breach. Because you have no say in how a company stores your password. And if that company doesn’t offer 2FA or only offers sms or email verification, then you’re even more at risk. This problem doesn’t exist with passkeys.
Edit: lol
Sure, and then that one password is compromised. Password managers make it trivial to use unique passwords for every service, so if a service is breached, you’re basically as screwed with passwords as passkeys.
The switching cost here is high, and the security benefits are marginal in practice IMO. I’m not against passkeys, but it should be something password managers handle, and I don’t have a strong preference between TOTP baked into your PW manager and passkeys.
Which means that entire service you used that password to login to is compromised. If you were using passkeys however, you would have nothing compromised.
No… with a passkey you would be not screwed at all. You’d be entirely unaffected.
I mean in your own example that’s a reduction of 100%. That’s kind of a huge difference.
You’re looking at this from the perspective of an educated end user. You’re pretty secure already from some common attack vectors. You’re also in the minority. Passkeys are largely about the health of the entire ecosystem. Not only do they protect against credentials being stolen, they also protect against phishing attacks because identity verification is built in. That is of huge value if you’re administering a site. Yes if everyone used a password manager there would be less value, but only about a third of users do that. And as an admin you can’t just say “well that guy got phished but it’s his own fault for not using a password manager.”
Password managers have only really taken off in the last half-decade, so one-third is kind of to be expected. I know they’ve been around a long time, but major adoption has been recent.
Passkeys will take a while to get wide adoption as well, especially with syncing problems that we’ve seen.
Password managers are never going to hit anywhere near 100% adoption rate. It requires knowledge on the part of the user and in many cases money. No grandma isn’t going to roll her own with keepass. Most likely she’ll never even know what a password manager is. And as long as those users are still out there, admins still have to deal with all the problems they bring.
Incidentally I looked and it’s been over a decade since I started using my first password manager. They’re not that new.
Password managers are too hard for the boomers