They really aren’t a trap. They’re a well designed standard. The tooling around them isn’t quite perfect yet, but they’re a huge improvement over passwords.
I’ve honestly not seen any benefits over passwords.
If I want to check my mail on a library computer, I can type in a password and I’m in. If it’s using passkeys I need an already logged-in smartphone - which I probably don’t have if I need that library computer in the first place. That’s just one example.
Personally I like Passkeys, and I enroll them in both my KeePassXC vault and on my two hardware keys (a primary Yubikey which I carry with me and a spare one at home).
It doesn’t absolve one from neglecting proper security best practices (don’t login on a system you don’t trust, logout / clear cookies when done, etc), but a Passkey on a hardware key is much more difficult to phish or extract if you’re using someone else’s computer.
Well if your using a pasword manger instead of easily remmbered passwords your screwed either way. And considering the fast majority of people use the same password eveywhere and use a simple passowrd they are a big improvement.
You’ve likely got dozens of accounts. You’re not going to memorize a password for every account. Re-using passwords is a serious security problem though. Poorly secured sites get their password databases leaked all the time. If you use the same password on lots of sites, it’s basically a sure thing that the hashes are out there on the darkweb already along with your email, and your password is compromised.
Also, typing your email password into an unsecured library computer is a terrible idea. It is ridiculously easy for someone to install a keylogger and gather emails and passwords. In the past, your main protection was that it wasn’t worth anyone’s time to break into the computers, install keyloggers, collect lists of passwords, then figure out how to use them to get money. But with LLMs that can all be automated. It has become ridiculously cheap, and can be done by someone with a bot farm in Russia.
A password manager largely fixes the first problem, but at that point you need a device with your password manager with you to log in anyway. And the password manager doesn’t fix the second problem at all.
I only dislike the ability for service providers to enforce a “security level”. Those should be the exclusively under my (the user) control. Sending preferred default (hints) would be cool, but not enforcement.
That a webpage can basically prevent me from using a passkey if the passkey is stored in software (a password manager for example) is complete bullshit. Especially if there is still username/password as alternative which is clearly worse. Sure, hardware tokens are the ultimate security. But it should be up to me and not them if I want that level of security.
But they already do enforce a “security level” for passwords through minimum character counts (e.g. must be at least 8 characters long), specific character requirements (e.g. at least one upper case + lower case + number), rotation schedules (e.g. must be changed every 90 days), etc. Some even enforce password sharing (e.g. Netflix IP/geolocation checks).
Yeah and certain password requirements are also dumb. But at least they still give me a degree of freedom how to generate the password and how I store the password.
Second factor is sometimes worse than Passkeys; with vendor specific apps (Steam Guard, Blizzard Authenticator, Microsoft Authenticator, etc) instead of following standard TOTP. But still. I want agency over my credentials.
I would say the people hate it, because they are exposed to the tooling and not the standard.
The standard might be the best there is, if the tooling is shit people won’t use it. And once you’ve been exposed to bad tools you make the connection between tools bad = passkey bad because they don’t know there’s a difference…
They really aren’t a trap. They’re a well designed standard. The tooling around them isn’t quite perfect yet, but they’re a huge improvement over passwords.
People upvote because they hate change.
I’ve honestly not seen any benefits over passwords.
If I want to check my mail on a library computer, I can type in a password and I’m in. If it’s using passkeys I need an already logged-in smartphone - which I probably don’t have if I need that library computer in the first place. That’s just one example.
Personally I like Passkeys, and I enroll them in both my KeePassXC vault and on my two hardware keys (a primary Yubikey which I carry with me and a spare one at home).
It doesn’t absolve one from neglecting proper security best practices (don’t login on a system you don’t trust, logout / clear cookies when done, etc), but a Passkey on a hardware key is much more difficult to phish or extract if you’re using someone else’s computer.
Well if your using a pasword manger instead of easily remmbered passwords your screwed either way. And considering the fast majority of people use the same password eveywhere and use a simple passowrd they are a big improvement.
Memorizing passwords doesn’t scale well.
You’ve likely got dozens of accounts. You’re not going to memorize a password for every account. Re-using passwords is a serious security problem though. Poorly secured sites get their password databases leaked all the time. If you use the same password on lots of sites, it’s basically a sure thing that the hashes are out there on the darkweb already along with your email, and your password is compromised.
Also, typing your email password into an unsecured library computer is a terrible idea. It is ridiculously easy for someone to install a keylogger and gather emails and passwords. In the past, your main protection was that it wasn’t worth anyone’s time to break into the computers, install keyloggers, collect lists of passwords, then figure out how to use them to get money. But with LLMs that can all be automated. It has become ridiculously cheap, and can be done by someone with a bot farm in Russia.
A password manager largely fixes the first problem, but at that point you need a device with your password manager with you to log in anyway. And the password manager doesn’t fix the second problem at all.
I only dislike the ability for service providers to enforce a “security level”. Those should be the exclusively under my (the user) control. Sending preferred default (hints) would be cool, but not enforcement.
That a webpage can basically prevent me from using a passkey if the passkey is stored in software (a password manager for example) is complete bullshit. Especially if there is still username/password as alternative which is clearly worse. Sure, hardware tokens are the ultimate security. But it should be up to me and not them if I want that level of security.
But they already do enforce a “security level” for passwords through minimum character counts (e.g. must be at least 8 characters long), specific character requirements (e.g. at least one upper case + lower case + number), rotation schedules (e.g. must be changed every 90 days), etc. Some even enforce password sharing (e.g. Netflix IP/geolocation checks).
Yeah and certain password requirements are also dumb. But at least they still give me a degree of freedom how to generate the password and how I store the password.
Second factor is sometimes worse than Passkeys; with vendor specific apps (Steam Guard, Blizzard Authenticator, Microsoft Authenticator, etc) instead of following standard TOTP. But still. I want agency over my credentials.
I would say the people hate it, because they are exposed to the tooling and not the standard.
The standard might be the best there is, if the tooling is shit people won’t use it. And once you’ve been exposed to bad tools you make the connection between tools bad = passkey bad because they don’t know there’s a difference…