262
Passkeys might really kill passwords
(www.theverge.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 14 Feb 2024
262 points (88.8% liked)
Technology
59670 readers
1629 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
Passkeys feel so much more worse. It becomes one central point to lose everything.
it's objectively a downgrade to have to get my phone out just to sign into youtube. i broke my phone screen and couldn't sign into my damn bank until i got it fixed because they making me verify with a text. bullshit world these days
And than there’s Google itself, notorious for blocking people’s accounts for nothing and offering zero recourse to get it back.
Exactly, which is why passkeys are so good.
Exactly. You could have access to your password manager on your computer or a backup hardware security key instead. It doesn't have to all be tied to just one phone, just like you don't have to have just one house or car key.
It certainly feels dangerous if forced upon users not aware of the trade-offs. For people already accustomed to using hardware keys, it's very much an improvement, as more services will support them too. The problem is in the awareness. On the other hand, people already treat regular passwords as throwaway data and expect services to just let them in, or even never log them out. In this scenario, maybe passkeys can still be an improvement: roughly just as much as enforcing using a password manager.
If you already have a central point to lose everything in the form of a password manager, is it any worse? What's the difference between a random password stored in your password manager that you don't remember versus a private key stored in your password manager that you're not expected to remember? You've always needed to make backups or have alternative ways to get in (recovery codes, customer support channels, etc), nothing about that has changed when going from passwords to passkeys. When passkeys are supported on sites, there can be no autofill issues (password or TOTP), no password complexity requirements, no worries about how they are hashing them on the server side, no phishing issues, etc. That's an improvement over the system we have now.
And for those that don't have a password manager, they are likely reusing passwords. Passkeys prevent the risk of password reuse and the risk of phishing.
I use a password manager and the database is automatically synchronized to multiple devices. I use syncthing for that, but a public cloud would be fine as well, because it's encrypted (well, as long as the master password is strong enough)
I export my passwords from my manager regularly and keep them on paper in a secure place. At worst, it would be massively annoying if the password manager somehow blew up. But you can't hack a paper. On the other hand, like some other person wrote, it's incredibly easy to break your phone screen and then you're screwed until you can fix it.
The person who broke their phone screen wasn't mad about not being able to access the data on it in this case, but rather that they couldn't receive a text message as the second factor to log in to their bank. Having a backup wouldn't have mattered, they couldn't receive the text. Like it or not, having two-factor authentication on accounts is a necessity with the phishing and malware problems out there. Having multiple (secure) factors attached to your account is the best protection against getting locked out.
The breaking of a phone and loss of the data on it can still be protected against by having backups in other locations or offline, like you have.
A huge amount of people use the same password everywhere.
It's much easier for someone to get your password than your phone.
And it’s much easier for me to lose or break my phone than it is to lose my password.
It's automatically backed up. This is no different than MFA in that regard. Which I hope you're using.
Backed up to where and to who?