186
The War on Passwords Is One Step Closer to Being Over
(www.wired.com)
This is a most excellent place for technology news and articles.
Literally just use a password manager and 2/MFA. It’s not a problem. We have a solution.
Actually, it is still a problem, because passwords are a shared secret between you and the server, which means the server has that secret in some sort of form. With passkeys, the server never has the secret.
The shared secret with my Vaultwarden server? Add mfa and someone needs to explain to me how passkeys do anything more than saving one single solitary click.
When a website gets hacked they only find public keys, which are useless without the private keys.
Private keys stored on a password manager are still more secure, as those services are (hopefully!) designed with security in mind from the beginning.
If a website with old-school passwords gets hacked, the hacker only gets salted hashes of passwords - this does not seem to be much worse?
(Websites that store plaintext passwords surely won't implement passkeys either...)