271
Passwords have problems, but passkeys have more
(world.hey.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 16 Oct 2024
271 points (86.3% liked)
Technology
59598 readers
4583 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
Agreed, in its current state I wouldn‘t teach someone less technically inclined to solely rely on passkeys saved by the default platform if you plan on using different devices, it just leads to trouble.
Using a password manager is still the solution. Pick one where your passkeys can be safed and most of the authors problems are solved.
The only thing that remains is how to log in if you are not on a device you own (and don’t have the password manager). The author mentions it: the QR code approach for cross device sign in. I don’t think it’s cumbersome, i think it’s actually a great and foolproof way to sign in. I have yet to find a website which implements it though (Edit: Might be my specific setup‘s fault).
people will pick the corporate options that are shoved on their faces, not the sensible open source user-respecting ones.
vendor lockin will happen if we adopt passkeys as they are right now.
Bitwarden just announced a consortium with Apple, Google, 1Password, etc to create a secure import/export format for credentials; spurred by the need for passkeys to be portable between password managers (but also works for passwords/other credential types)
I'm definitely holding off on passkeys until that project is finished. I also don't want vendor lock in and while that seems like the solution, it seems like they just started working on it.
Import export is not the same as interoperability
The interoperability already exists in the protocol webauthn, part of FIDO2 which has been around for almost a decade. Interoperability is not remotely an issue with passkeys. Imported/export is/was and also already has a solution in the works.
So I can use the same passkey from say, bitwarden and windows hello? Why do you even need import export then?
Yes you can use a passkey set up on any given service to authenticate to a service that supports passkeys. You’d need import/export to move a given passkey from bitwarden to Windows.
QR codes are good 50% of the time; when you're trying to log in on a pc.
The reverse case is extremely annoying
Could you elaborate? I am assuming that everbody would have the password manager on their mobile phone with them, which is used to scan the qr code. I think that’s a reasonable assumption.
I agree that if you wanted the pc to act as the authenticator (device that has the passkey) it wouldn’t work with qr codes. But is that a usecase that happens at all for average people? Does anyone login to a mobile device that you don’t own, and you only have your pc nearby and not your own mobile phone?
I'm thinking of phone recovery, where you're trying to get all your stuff back on a new device.
With a password manager, simply logging in will get you there and until passkeys can be synced automatically just like passwords this will need to be handled somehow.
I hope I am not misunderstanding you. What you are worried about is passkeys in the password manager not syncing to new devices? They are though, with password managers that support passkeys like Bitwarden, ProtonPass, 1Password etc..
Currently using it on Bitwarden, if I log in to a new device, the passkeys are there.
You understood correctly. Seems like I missed some news on the syncing front.
It could be your browser / system that is struggling to show it. When I use my work computer and Microsoft edge, I don’t think I’ve ever had a situation where the QR code didn’t work. When I use flatpak’d Firefox on my Linux laptop, I experience more trouble, probably because of the sandboxing.
According to the device support page i should be ok, but yeah there might be something weird going on.