A post called Passkeys are a trap. Do not use them. has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've had it sent to me many times with an 'is this true?' kind of vibe. It's written for
  • eightys3v3n@lemmy.caEnglish
    1·
    7 hours ago

    I personally hate how passkeys have been implemented, how they frequently break for me making them an unreliable 2FA, and how they are being crammed down my throat.

    Also, if the passkey is being synchronized between devices it is functionally useless as a 2FA method in the first place. In order for something to be two factor authentication it needs to be a different type than the primary factor. The primary factor is something I know and the secondary factor is supposed to be something that only I have. As soon as I can just log in to a password manager to get the thing on any device it’s no longer a thing that only I have; it’s as useful as just having two passwords and requiring both.
    At least with TOTP codes I can choose which ones go in the password manager and which ones go in a dedicated app that is not synchronized. You can’t do that on Android with passkeys because you have to pick one provider for all the passkeys on your Android device. If I want every service to use pass keys and the majority of those services do not need the additional security then I would pick my password manager as the storage. Then for more secure services it’s a nuisance to change the system setting from my password manager to the built-in system implementation so that I can get to the more secure passkey. Whereas with my TOTP codes I just open the password manager and see it’s not there and then open the TOTP code app and copy it from there. The alternative of course is I pick the more secure option for every service even ones that I don’t care about at all and then it’s just an additional nuisance to fix it when my device breaks.

    But I do recognize being able to be tricked into entering a 2FA code into the wrong area is a problem.

    • misk@piefed.socialOPEnglish
      1·
      6 hours ago

      I wonder if the implementation impressions are dependent on the platform. I’m using Apple devices for my phone and laptop, also Apple Passwords and Safari. Whenever I see Passkeys prompts it’s very seamless and almost the same as if I was filling in a password. It’s very confusing to read what people write about it online, I can only imagine people hurting themselves on purpose dramatically like in an old teleshopping ad. That said, there’s maybe 5 websites I frequent that do Passkeys and I never decline creating one so the adoption isn’t going great.

      • assaultpotato@sh.itjust.worksEnglish
        1·
        6 hours ago

        It’s very dependent on RP ime. Most (90%+) are really easy to work with and “it just works”. But sometimes I go to use my passkey and it wants a hardware key when I saved my key onto my password manager and so I can’t actually respond to the request for the passkey at all. It’s not super common but it does happen.

        Firefox/Windows/ProtonPass