Passkeys are great because they get sync'ed to all your devices, which makes it really easy to share access to those websites with other people ( who have access to devices on your account ). Like a spouse.
Passkeys: They're not perfect but they're getting better
41–50 of 145 posts
Re: Passkeys: They're not perfect but they're getting better
#42Earlier quoted context omitted.
lock-in to which vendor? Passkeys support transfer to any vendor you want.
Is it really "any" vendor, or is it just the big ones? Can you transfer your Apple passkeys to KeePassXC?
I can't even find documentation on how to do the simplest transfer, from Apple iCloud Keychain to Google Chrome or vice versa.
Re: Passkeys: They're not perfect but they're getting better
#43How are passkeys different from API keys or just random chains of characters? And why can't we have the use of such keys enforced by an EU legislation so that all businesses allow users to login using such strings of random characters? The world would then be a better place.
> How are passkeys different from API keys or just random chains of characters?
As far as I understand it, in the same way that a public/private keypair differs from a random chain of characters you are used to shoving into the "Authorization: Bearer XXXXXXX" header.
Re: Passkeys: They're not perfect but they're getting better
#44Earlier quoted context omitted.
Just not having the right device with you is crippling. IMO Passkeys need more work. I'd really like to see accounts support multiple passkeys. I'd prefer biometrics that are device independent. I just don't like the idea of replacing something someone can steal (a password) with something else someone can steal (a phone).
Would be nice, but biometrics have also been systematically made less secure. Apple, for example, no longer sells a phone with Touch ID.
At first I read this as "Apple doesn't implement Touch ID, because they found it to be insecure", which really confused me. Was that the intent?
On second reading, I'm thinking this might mean, "since Apple only implements Face ID, biometrics on Apple devices is less secure", which makes more sense (to me).
Re: Passkeys: They're not perfect but they're getting better
#45At its core, the main drawbacks that need to be solved for them to be a viable option are imo: * Improving OS flows. Every passkey implementer that's also an OS gets really excited about enrolling you into their proprietary clouds, and using alternate flows to respect the users wish to use their own manager is usually hidden in confusing UI forms that don't feel consistent if you don't already know what you're doing.…
> * Improving OS flows. Every passkey implementer that's also an OS gets really excited about enrolling you into their proprietary clouds, and using alternate flows to respect the users wish to use their own manager is usually hidden in confusing UI forms that don't feel consistent if you don't already know what you're doing. You're kidding yourself if you think that this is something Microsoft, Apple, or Google are…
I never said they had an incentive to solve it. I said that it's one of the big blockers to getting regular adoption. It ought to be obvious that all these issues aren't a problem if you look at it through the big tech lens: why is it a problem when we're providing the service. They're a problem when you're a normal person with a healthy distrust of big tech companies.
In practice, I expect someone to figure out a way to break into/bypass the OS flow entirely with a less "big tech wants your private details" solution and that's what winds up getting adoption.
Re: Passkeys: They're not perfect but they're getting better
#46How are passkeys different from API keys or just random chains of characters? And why can't we have the use of such keys enforced by an EU legislation so that all businesses allow users to login using such strings of random characters? The world would then be a better place.
If you are not careful, you'll enter the random chains of characters into a phishing site.
But a phishing site can't steal your passkey and forward it to the real site, the passkey will just not work with the phishing site if you try using it there, it's locked to the authentic domain.
Re: Passkeys: They're not perfect but they're getting better
#47Earlier quoted context omitted.
Needed for whom? As others have said, without export it's a recipe for vendor lock-in.
lock-in to which vendor? Passkeys support transfer to any vendor you want.
Can you send some documentation on how? For example, I tried googling for transferring a passkey out of popular systems and it doesn't seem possible[1][2] other than through JSON export[3] which is what some sites want to block as I understand.
[1] https://old.reddit.com/r/Bitwarden/comments/1efs5d2/how_can_...
[2] https://old.reddit.com/r/Bitwarden/comments/1di8nbz/import_p...
Re: Passkeys: They're not perfect but they're getting better
#48How are passkeys different from API keys or just random chains of characters? And why can't we have the use of such keys enforced by an EU legislation so that all businesses allow users to login using such strings of random characters? The world would then be a better place.
Passkeys are a private key stored on your device with the public key registered with the server. Servers should allow multiple passkeys per user (so you can register multiple devices), but many don't.
That's an implementation detail users should not care about.
The bigger question is... why don't we replace the login/password combination with just a string of randomly generated characters and call it a day?
Why protect these strings of random characters from users, call them passkeys and advertise them on all street corners?
Feels like a devil's plot to strip us from all the rights to our devices.
Re: Passkeys: They're not perfect but they're getting better
#49Speaking of passkeys, could they be used to authenticate to a local application - say for unlocking a password vault (perhaps through a Yubikey)?
Probably not.
But YubiKey supports multiple protocols, one of them surely could work for your use case.
Re: Passkeys: They're not perfect but they're getting better
#50How are passkeys different from API keys or just random chains of characters? And why can't we have the use of such keys enforced by an EU legislation so that all businesses allow users to login using such strings of random characters? The world would then be a better place.
If you are not careful, you'll enter the random chains of characters into a phishing site. But a phishing site can't steal your passkey and forward it to the real site, the passkey will just not work with the phishing site if you try using it there, it's locked to the authentic domain.
That's mumbo jumbo to me so far.
What's an authentic domain?
How is my passkey locked to it?