I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand:
I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use LastPass. If I accidentally set up a passkey on my phone (let’s say I use Safari one day instead of my go-to, Brave), can I still log in without that passkey on other devices? Is there a way to ensure that passkey can be used on other devices? Can I add another passkey on another device? How many passkeys can I set up for a particular site/app? I have at least 6 different combination of browser/devices in use.
I don’t want to use Passkeys because I don’t the answers to those questions, and I don’t know whether each website/app that has set up Passkeys has decided the answers to those questions in the same way as the others. For now, I’m going to stick with LastPass and use Passwords; because no matter whether I lose my device or not or whether I’m on my own devices or not, I can be sure I’ll be able to get into a site/app.
Edit: One final consideration, my spouse and I share user/name passwords for some things (notably Pandora and our Amazon Prime account) since they don’t handle things like family logins well; how do both my wife and I use amazon or Pandora with passkeys? Do we each set up passkeys? How do I get her Pass if that’s not an option?
This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email.
(But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.)
The weird part is that password managers provide no way for you to copy and paste your passkeys. To present a passkey, you have to use a password manager. This makes it impossible to copy and paste your passkey to the wrong person (someone trying to trick you).
Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourself. Instead, the password managers each have their own finicky app-to-app mechanism for transferring passkeys from one password manager to another. (I think all the password managers kinda like that lock in.)
Finally, note that for logging into your password manager itself, you'll always require something outside your password manager to login, probably a password, but possibly a YubiKey; your choice. (It's your one "last password," as they call it.)
P.S. It's past time to move off of LastPass. LastPass lost all of your passwords again last month, just like they did in 2022. The most similar service is 1Password. If you like LastPass, you'll like 1Password about the same, but 1Password hasn't had multiple terrible security breaches.
>This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager.
The issue isn't what passkeys _are_ (e.g. explaining they are like public/private "ssh keys" and hoping that type of explanation ends the confusion).
Instead, it's the workflow around passkeys. The websites show very confusing dialog popups and choices that a lot of normal people will not understand. This is a good article with screenshots showing the confusion: https://arstechnica.com/security/2024/12/passkey-technology-...
I have senior citizens asking me about passkeys because their bank and medical websites keep reminding them about switching to passkeys every time they login into their accounts. My recommendation to them is not to do it unless they have a simplistic single vendor setup such as only Apple iPhone and MacBook with iCloud Passwords app. If instead they have a mixed Windows + Apple setup with 3rd-party password manager, they could accidentally put a new passkey into the os or browser instead of their external password manager and not realize what has happened. This happens because the different parties implementing passkeys all have different agendas that suits their interests and that's what makes the workflow confusing for normal people.
I don't think you're giving those seniors good advice. When the banks ask people to "switch" to passkeys, they're not removing the passwords; they're adding passkeys as an alternate login mechanism.
If you lose your bank passkey, (e.g. if you put it in the wrong password manager and you can't figure out where it is) you can just sign in with your bank password.
In the worst case, banks actually don't make it very hard for seniors to reset your password/passkey; just show up at a branch with photo ID, your bank card, and your PIN, and a teller will help you reset your credentials. They do it all the time.
And, remember, seniors could also put a randomly generated password into the wrong password manager. In that case, they'll either have to reset their password, or they'll have figure out what they did, retrieve their password from the OS password manager, and transfer that password to their preferred password manager.
The exact same story applies to passkeys, except, because passkeys can't be copied and pasted, you'd have to figure out how to use the finicky app-to-app transfer system ("Credential Exchange Protocol"). That's probably too complicated for most seniors, so falling back to a password is almost certainly their best bet.
I am an engineer and have some insights on the discussions and developments around it.
ITS NOT SIMPLE AT ALL
1. The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing).
2. Majority of industry players shared the vision of a credential which is available across the platforms and browsers
3. The vision for collaboration never materialized so everyone went their own way to implement it. Examples would be google rolling out browser (Chrome) managed authentication which led to this situation where even on the same machine you have to remember which browser you used to create the Passkey credential.
4. Interestingly enough the earlier popular name was WebAuthn, Apple started calling it Passkey on fly, given Apple's popularity everyone just caved in.
5. My personal interpretation is that in some sense Apple wanted to be the default password manager on Apple devices.
6. This is when all password manager companies jumped in strongly to save their business and the protocol went into a direction where you can use your existing password manager to store the credential/Passkey as well
Personally its a mess, the phishing resistant aspect has its own benefits though. If you are using it with security in mind then my recommendation would be to use a hardware backed security key with NFC enabled. Everything else is pretty much lipstick on pig, they are worse than passwords in some sense from usage perspective.
> Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourself
That's a red flag to me. It's enough that phone backup systems go out of their way to prevent you from accessing your own data, too, for unexplained "sekhurity" reasons.
> P.S. It's past time to move off of LastPass. LastPass lost all of your passwords again last month, just like they did in 2022. The most similar service is 1Password. If you like LastPass, you'll like 1Password about the same, but 1Password hasn't had multiple terrible security breaches.
That's the most annoying thing about password managers, and a major reason I still don't use them: there exists no password manager that is cross-platform (desktop/mobile in particular), local-first, and isn't sketchy or enshittified or otherwise on HN's current "don't use it, use <whatever> instead" list.
For core security tool class, that doesn't inspire confidence.
Apple, Google, Microsoft, Mozilla, and 1Password don’t let you export passkeys to a file that you can read and backup, but Bitwarden, Proton Pass, and KeepassXC do.
I think Bitwarden is on HN's current happy list. (I just use Apple iCloud myself.)
Allowing passkeys to be exported to a plaintext file undermines the phishing protections, at least somewhat. It’s possible to trick you into exporting your passkeys from Bitwarden and sending the file to an attacker.
The major password managers say that this is the reason they don’t allow exporting passkeys, and it’s not false, but they’re also making it harder to switch password managers, which may be their ulterior motive. (You can’t even import those exported passkey files into any of the major password managers, which they would be incentivized to do, if those smaller players had significant marketshare.)
It’s up to you to decide whether protecting yourself from being tricked into exporting your passkeys is worth sacrificing your ability to read them.
> This makes it impossible to copy and paste your passkey to the wrong person (someone trying to trick you).
It also, unfortunately, means it's not possible (via most passkey implementations) to back those passkeys up to paper. Which is quite unfortunate: backing up to paper is one of the most stable and human accessible ways of ensuring redundancy and continuity, an inevitable but also oft-ignored part of credential management.
Security folks would like to pretend "solving continuity" isn't a problem, or is a problem that doesn't need to be accessible.
If you save it via Passwords app, it'll be iOS / macOS mainly, but you can unlock with any Apple device that supports Passkey / Passwords app (so likely modern + reasonably updated) the easiest. If you want it to work "everywhere" then you CAN use your iOS / MacOS Passkey, it will show you a QR code, some places poorly support this, I believe both devices need bluetooth, and then it will authenticate it.
Linux is the only oddball here, I had issues getting this flow to work.
If the UX for Passkey improves, I will go all-in on it, I'm at the point I'd love to just completely block passwords from accessing my account, unless I explicitly enable it temporarily by logging on via passkey, I wish some sites would let me lock my account to this level, it would be better. Passwords feel like they just wind up all over the web.
Weirdly enough you can store multiple passkeys for a given domain, which can get confusing in some cases if they dont have normal names tied to them.
Edit: Originally I thought Passwords from Apple was iOS / macOS only, but its not! So I have been editing my original message, sorry for the confusion, I had forgotten that I can login on Windows with my Passkeys from Apple's ecosystem.
As another poster noted, you can transfer them out of Apple's ecosystem too!
Firefox just didn't support it cleanly, I think Chrome did, I don't remember. Apparently it's just due to Linux not having a native passkey implementation. Dang.
Edit:
Apparently BitWarden should work, but my particular passkey was not on there.
Unpopular opinion but correct the whole thing has been designed to lock you to devices they make and have themselves be the arbiter of your authentication.
If that wasn't the intent they could have make the thing work like ssh keys, encrypted at rest, you can take them wherever you want.
Only to other proprietary systems within the FIDO Alliance that you don't own or control.
Additionally passkeys allow services to detect and ban specific password managers, so have fun when the only approved managers that works consistently across all services are Google/Apple/Microsoft. There is already a list of "bad" clients here https://passkeys.dev/docs/reference/known-issues/
I didn't realize this was supported, I'm kind of favoring Apple's Passwords app since you can lockdown your account and they are very on top of someone accessing anything of yours. Any time I power on an iPad I havent used for months they tell me a new device can read my texts type of thing, which is a nice paper trail.
I wouldn't favor an application that is locked to a big player account (Microsoft, Apple, Google) where a ToS violation for something unrelated may lock you out of all services, passwords/keys included.
This is the main reason I've avoided passkeys. I have these exact questions and there's no a clear explanation given for these. I don't want to lose access to important accounts.
I think the point is that Passkeys are not supposed to be as precious as passwords. You're supposed to have a brand new one for every device/application combination. So they are just login cookies at this point, and haven't even come close to replacing passwords because you need to know your password to get a new passkey every time you log in.
Now, is that the official stance? I don't know; but it's _absolutely_ what every current implementation suggests the companies deploying this stuff want.
You can make passkeys better. Like me, you can install a well-funded password manager (well-funded, because it needs the engineering effort behind it to keep up with the ever-changing passkey apis on every platform in the world; screw up and oos, can't log in today!). Then you have one passkey per remote service, and just have to make sure 1password is _always_ installed and perfectly integrated. Easy!
I can safely write down a password on a piece of paper and keep it somewhere phyisically safe.
Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.
Sounds like something security services would love people to use. Instead of using wrench to extract the password - and distressed person may lose memory, they can just locate the passkey.
Nobody is safe from a nation-state "attack" they'll just go threaten your providers to give up your data. Passwords written on paper are probably safer than a centralized password manager for almost every circumstance other than a government coming after you.
That's all I want to know. How do I restore from a backup? Specifically, a backup that I make to a medium I control, like a piece of paper or a burned CD-R in a safe deposit box. If I could get a good answer to that, I could be onboard. But from the conversations that I am getting here, it looks like only certain managers allow it, and with device attestation, they could be banned at any moment by any website with no recourse.
I think the intended workflow is you login with your phone and that device is now the authority that allows other devices to issue their own passkeys.
In my opinion it's a bad plan, because it elevates certain devices to privileged status, if you lose your phone you are hosed.
Passkeys should be allowed to be synced between devices and stored on password managers in the cloud. I am making my own password manager for my personal use, but have not delved into passkeys.
Listening to Yubikey and OnePassword talk about this, they actually say "One Person, One Device". Which really speaks to their failure to understand their users.
Because the original FIDO/WebAuthn standard was built for device bound credentials. They imagined unique keypairs tied strictly to a specific piece of hardware. Synced passkeys were a compromise, mostly driven by Apple and Google, because per-device credentials are too much friction for general use. It's not that they failed to understand users, it's that they incorrectly assumed the level of inconvenience people are willing to tolerate to be textbook secure (the answer is almost zero inconvenience).
The device bound model also completely falls apart in the enterprise, fails to address shared devices and shift workers where employees share the same PC under the same OS profile, now you're back to needing good old fashioned SSO w/ physical MFA (Yubikey) to attest who the user is in addition to attesting the device itself.
Before synced passkeys, the actual standard is a unique key pair per device. The key pair on my phone shouldn't be synced to my laptop, my laptop should generate it's own key pair.
My issue is that they're touted to the consumer as secure, and they're not really doing much more than a complex password.
How do you generate a new key if you need one? Same process as a password reset. Does it prevent session stealers? Not at all.
Its "benefit" is grandma can't read it to an attacker. OK, well can grandma click a link and have a session stealer bork her life instead? Yeah, and attackers know that and just shift methods. Session stealing isn't a sophisticated attack, and so all that's being done is shaving a cost on PW resets in the interest of shareholder value, at the cost of security theater and locking up your keys in a single domain that holds control over our access to everything.
You can store your passkeys in Bitwarden or Keepass vault. Then you can use them through Bitwarden or Keepass apps on any other device. Been using passkeys like this for several years, and it works pretty seamlessly. With Keepass vault, I even have an offline copy as backup.
They are bigger. Not as easy to guess. More like pretty impossible. It's like not letting the user choose the password. That way they can't have a bad password.
Copying / syncing passkeys between password managers is still work in progress, but you can usually work around it by making multiple keys. For important websites, I recommend saving additional passkeys to Keychain, etc, as backup, assuming the website allows that. (It should, but some websites might not have a good implementation.)
Also, nothing says you have to delete passwords (or alternate means of logging in) if you already have them set up. Having multiple ways in will help prevent lockout.
> If I accidentally set up a passkey on my phone (let’s say I use Safari one day instead of my go-to, Brave), can I still log in without that passkey on other devices?
N=1 and I'm sure I'm holding it wrong, but I can only log in to ADP to request PTO from my personal laptop because I set up an iCloud passkey, work laptop does not allow access to iCloud keychain, and you can't request PTO from mobile.
Answer to almost all of your questions is that it entirely depends on the service what kind of auth implementation they offer. I personally have completely adopted passkeys and use them with every service that allows it.
I use ProtonPass and have made it the default password store on every device and browser. This way all passkeys get stored in proton and I can login from any other personal device with proton setup.
Also from experience, most sites will implement it in every wrong way possible.
For example, all the major sites that allow the total of 1 active TotP authenticator app - trying to add one forces to delete the other. Which is fine while you have only one phone and aren't in the process of switching to another one.
> These are all answerable questions, but getting those answers is confusing for most people.
It's the same answer when someone asks 'how am I supposed to have a different password for every site' and 'how am I supposed to remember a password of X+ characters.' Use a password manager. Pretty sure every major one supports passkeys by now.
Password managers are themselves cross-device footguns and I could easily write the same headline for them myself. I've been working in tech for 20 years now, and I don't use them.
ETA: Well I do use auto-fill in browsers/mobile, but funny thing about this, I have three running on my phone[0], they all activate at the same time, and they contain mostly non-overlapping set of credentials, and I got tired of trying to sync them together, so I just look up passwords manually one by one in each and use clipboard to transfer the credential once I find it.
And I had to stop using passkeys because they interact with this split-brain system in unpredictable ways.
--
[0] - Specifically: Google Password Manager / Google Autofill / whatever they call it, Samsung Pass / Samsung Wallet (they're sort of but not the same?), and auto-fill built into Firefox.
Write it down on a sheet of paper and put the paper in a safe place. As a bonus, I can have multiple copies in multiple places. It is simple, easy, and I have been doing it all my life. I see no reason why it has to be more complicated than that.
I use ProtonPass and afaiu it just syncs the passkeys private part everywhere you need it. So it “just works”. This is better than just old fashioned credentials because the passkey only “triggers” on the correct domain, so they can’t be phished by other domains… Right?
I recognize the point of your post is more about the lack of clarity and details around passkeys. That's real, and I don't really have an answer for that - other than, I think maybe the quest for making them simple and "just work" has maybe made them nebulous enough that we've wound up in the current situation where a lot of even technically savvy people don't really understand them. But I feel like answering your questions might sort of help explain why that's the case, so I'm going to take a stab at it:
> If I accidentally set up a passkey on my phone (let’s say I use Safari one day instead of my go-to, Brave), can I still log in without that passkey on other devices?
Assuming you have LastPass set up to be an iOS password manager, and it fully supports iOS' passkey implementation: when you create a passkey in Safari, it will ask you if you want to store it in LastPass or in the iOS Passwords app (previously known as iCloud Keychain). If you say LastPass, then it's up to them, but I assume it'll sync to all your devices - it's how 1Password works. If you were to accidentally say Apple Passwords, it'll sync to all your Apple devices automatically, and you can either use Apple's password browser extension on Windows, or you can use the "another device flow" I'm about to detail.
> Is there a way to ensure that passkey can be used on other devices?
As mentioned above, passkeys are intended to sync via your password manager of choice as the primary use case. If for any reason you don't have that passkey synced to that device, _and that passkey is on a mobile device with a camera_, most browsers will give you the option to scan a QR code with your phone. This kicks off a flow that will authenticate you via your phone's biometrics or passkey, then use Bluetooth to first ensure device proximity and then handle the authentication exchange. In the case of iOS, this includes any passkey-supporting password manager, so the passkey itself can be in 1Password; it doesn't have to be in the iOS password system for this to work.
When I first read the above, my hackles were raised given how well Bluetooth operates at times; but every time I've used it so far, it's been fast and flawless. Still, I can see a lot of scenarios where this might not work - e.g., the first one I thought of was a public computer at a library where Bluetooth might be locked down; corporate computers or remote servers could also be troublesome. As far as I know, passkeys don't yet have answers to those scenarios; other than to just use your password + 2FA as you would without a passkey.
As far as I know, both of the above apply to every passkey-consuming site.
> Can I add another passkey on another device? How many passkeys can I set up for a particular site/app?
This touches on your last paragraph, where it indeed could change based on the website. In my experience, every website where passkeys are fully supported - e.g., not ones that are using passkeys as a substitute for FIDO/U2F keys - has let me add multiple passkeys and have not _appeared_ to have a limit. I typically will create a passkey in both 1Password and Apple Passwords just to have a backup, and I can't recall any cases where that's been a problem. Still, I can't say for sure that isn't a problem on any website.
I went all in on trying passkeys when they started to be an option, and I don't have any notable regrets. For me, passkeys have generally worked well when the site is designed to use them well; and at no point have they been a _major_ hindrance. That isn't to say there are _no_ annoyances, though:
- Most websites that support passkeys tend to use them as a replacement for both the password _and_ 2FA, which makes them more convenient. However, a few - Amazon being the most notable I can recall - only use them as a second factor, which just makes them feel a little useless.
- A passkey can _also_ be used as the proof of identity, meaning you can log in in one fell swoop and don't need to enter a username or email address, which is IMO the best showcase for passkeys. Like above, this makes websites that ask you to enter an email address before letting you use a passkey also feel annoying.
- Most web browsers I've used support the QR + Bluetooth flow I mentioned above (otherwise known as Hybrid Transport or caBLE) without issue; Linux has been the odd duck out. Firefox doesn't seem to support it at all on Linux, and Chrome-based browsers do but sometimes are missing what they need and in that case don't show it as an option. Since I sync just about every passkey with 1Password this typically isn't a problem; the exception is the passkey for Apple Accounts, which Apple creates automatically, and (AFAIK) doesn't allow you to enroll your own. Apple Accounts are the only service I've found that does this, though.
- Some websites seem to only offer passkeys as an option if you're on a mobile device, or at least did so at the time of enrolling. eBay and PayPal I think are the two that jump out at me as having done this. Why they did it this way instead of simply detecting if the browser supported passkeys, I have no idea.
All of the above issues have gone down over time, so it's generally been a net decrease in friction over time. And, at least as far as I can recall, passwords themselves continue to be an option in every instance I've enrolled a passkey. So if you like your passwords, generally speaking, you can keep them :P
> passkeys are intended to sync via your password manager of choice as the primary use case.
The sync was actually a compromise to the standard. The idea was unique, device-bound credentials. One person, one device. The private key/passkey on your phone should not be the same one on your laptop, or your tablet, etc. Each device was supposed to have it' own unique credential.
Allowing sync is a security downgrade to the standard, in terms of threat-model guarantees. Pure WebAuthn credentials should be sealed in hardware (TPM or Secure Enclave or equivalent) and be mathematically non-exportable which guarantees zero remote blast radius, an attacker must physically posses the device.
Allowing sync and storing passkeys in a password manager reintroduces cloud account compromise risk and recovery flow hijacks. You lose non-repudiation.
Still more secure than passphrase + TOTP, but doesn't eliminate account takeover attacks against your cloud credential vault, which purely hardware based, per-device credentials do.
I'm using bitwarden, but it's possible to use passkeys from multiple devices and if it's not available for whatever reason, you can just login with username/password/token/biological probe/whatever you used before. As an example: GitLab gives you both options right from the start, so you can use whatever you fancy in that particular moment.
Passkeys basically MITM the 2FA process so that they can track and deplatform you with a single click across all your accounts.
The biometric verification also allows to confirm that a certain person is holding the device, and they can easily be matched to existing passport/travel databases.
Great system if the good guys have it, a bit problematic if it's abused by nepo kids to hide their crimes.
Most of your devices are in the Apple ecosystem and when you are prompted to create a passphrase it will ask you to put it in your iCloud Keychain. Boom, now it is available across all of those
This is how it will work for most people who don’t care about security and just casually use their devices. My boomer mom does this. It’s better than the notebook full of handwritten passwords she was using.
You have chosen lastpass and a multi-ecosystem environment with windows and multiple browsers on each. You have chosen complexity and this is not a limitation of passsphrases as they have been designed for a more common use case.
I use Linux and apple. I have chosen protonpass for my vault. I just tell my OS to save the passkey there and everything works pretty well. If not, my password is right there as fallback. It’s really not that hard.
That is not a rare threat model. Many people use iPhones and Windows computers. Fortunately, Apple has released iCloud Passwords which lets you access passwords and passkeys from a Windows computer.
That's the point: passkeys, and even 2FA, address rare and unlikely threat scenarios, while defeating most common use cases (delegation by sharing credentials), and making people vulnerable to most common threats (like, losing or breaking your phone).
Then you'll login to your Apple iCloud account using your password.
Passkeys are just passwords that require a password manager; you can't login to a password manager without something outside the password manager, usually a password. (That's why they call it "LassPass" and "1Password"; there's one last password you'll still have to maintain.)
No password manager tries to get you to login with a passkey without setting a password, for precisely that reason. Apple, Google, and Microsoft do invite you to login to their password managers via passkey, because it's convenient and unphishable, but they always also allow you to login via password (or "backup codes", which are just backup passwords).
Proton Pass is on the official Passkey client naughty list[1]. I hope the services you log in to don't choose to ban it because of those big, scary X's.
This is why I am so concerned about passkeys. They could be a good improvement, but in practice I already see how it's going to result in Google/Apple/Microsoft/whoever seizing even more control.
The document there is laughable too, because KeepassXC is listed as "not performing User Verification" when it demands manual authorization per request. But this isn't good enough for the passkey people. Ultimately, I see any FOSS option being effectively banned from most services and all important ones. It's a parallel to how you must now be on Cloudflare's nice list or be banned from the majority of the internet.
(I might be wrong, please correct me if I am) What I'm gathering from this page is that the Passkey spec can specify whether the app handling the passkey should prompt the user for biometric scan, PIN code, etc. but some apps simply ignore that flag. This makes sense though. I've already logged into my password manager and it hasn't timed out yet, so why would my password manager prompt me again? I'm glad that they don't prompt me again when I'm already logged in. I don't see this as a problem.
Your understanding is correct and I agree with you. The Passkey spec authors, however, think services should be allowed to ban your client for behaving this way:
> [When UV is required, KeePassXC must request user verification or not handle the request]
> This implementation is not spec compliant and has the potential to be blocked by relying parties.
Right, not only are you authorized, but you are also prompted to manually complete the request, which will fail if you do not accept. However, this isn't considered sufficient by the passkey people, who do in fact want you to retype your password at each prompt.
these questions all have easy answers that could be quite easily discovered by simply trying to use passkeys, instead of trying to find reasons not to use them.
But since there's a potential nonzero risk of permanent account loss, I don't want to experiment, and since I can still log in with email/password I'm going to keep doing that.
Like some folks already commented here, even as someone who has been working in tech for 20+ years, I find Passkey confusing. I understand the key aspect in computer science term, but I don't know how to use it across devices. Another big worry is that if I tie that to a physical key, then I might lose it (because it's physical) and never get it back.
FWIW: I find passkeys to be a very simple and easy to use concept.
Simple: it's like a password that I don't have to type in
Easy to use: because I use 1Password and just have it installed on everything. On Android, it can be set as the default passkey provider so, even on mobile, I am using passkeys shared across devices.
Is this "less secure" because I'm sharing the keys through 1Password. I suppose, at some level. But before that, I was simply sharing passwords through 1Password in the exact same way. So, I don't think my security posture has changed any.
What has changed is the UX and IMO for the better. Now I don't have to generate/fill/copy-paste text strings for user names or passwords. 1Password knows what site I'm on and usually responds automatically when I'm in a passkey context. If I have more than one passkey available, because I have multiple accounts (for something like Google Workspace), it shows me options and I pick the one I want.
Honestly, it's mostly a "just works" system and I like it a lot better than passwords.
This is a big problem I have with "just works". Everyone is used to services only allowing a single password. I know the answer to this, but it's not clear in the marketing or how it's explained to normie end-users: Won't creating a passkey erase my password? How do you sign in on another device? Won't that change the passkey and lock me out from the first device?
OK now say you're on a work/library/friend's computer and you want to look up an account in 1password on your phone so you can type in the password. Passkeys don't support this very basic and common workflow. Meanwhile there's no real security benefit over password manager generated complex and not reused passwords.
If I'm on someone else's computer and I want to use a passkey on my phone, it'll display a QR code. I scan the QR code with my phone, it signs the login request and posts it to their callback. Then I'm logged in on that device.
If my phone's camera is broken but both devices have bluetooth, it can do the handshake over bluetooth.
If I'm on someone else's computer and I want to use a passkey on my authenticator on my keychain, I'll just plug it in and then tap the button on the authenticator.
Meanwhile, if I logged in with the password and the account only has a password then they have a full copy of my entire authenticator to the account. With the passkey, once the session is invalidated the access is gone.
With physical U2F key, I could explain to my 78 year-old-parents "this is a physical key needed to access your account. Think of it like the front door key to your house. Don't lose it or lend it to anyone. We should have a couple of backup keys too." And they got completely understood and added it to all of their accounts. This was not hard. People assumed consumers were too stupid to do this without even giving them a chance.
And/or maybe the vendors were annoyed that people would lend the keys anyway, refusing to accept that it is normal because that's how delegation of authority works in real life too. House keys are also things you often lend to a third party that you want/need to access your house in your absence, and in fact making extra duplicated for trusted third parties is normal.
Software vendors continue to refuse to support, or even accept the existence of, this entire class of use cases for regular consumers (they are, however, more than happy to milk enterprises on convoluted implementations of those).
I never found a comfortable way to ensure all of my accounts had more than one U2F key associated with them. I always wished there was a way to have 2 physical U2F keys, one on me, and by adding one to an account, both would work.
As is, I had to either:
- Keep both on me, and add both - I am at risk of losing both at the same time
- Keep one one me, one in a safe - I have to keep track of which device I've added to which service, and periodically take the backup one out of the safe and iterate through the "new" services
I was never satisfied with either approach, so I ended up with an OTP app with backups.
Passkeys are just SSH keys in how they work. We've been doing this since the 90's. The only people that use SSH keys are the Linux savvy users and those who are forced to via an enterprise solution for vaulting.
The average person doesn't know anything about this stuff nor do they care. I also have yet to see a Passkey solution that didn't also have a password on it and a nice little box letting people choose to use the password instead of the passkey. They just added a new layer on top of all the old ones and created confusion. Now people use password and passkey interchangably in conversations and no one knows what they are talking about.
Aren't they effectively locked in the database of whatever password manager is used? I know you can export them, sort of, but that feature may blacklist your password manager and make it useless. Are they portable? I thought passkeys are locked to the device.
I was answering to the storage part. Blacklisting is the attestation part which is definitely a concern. Again, you can use passkeys as a yet another way to login. You can still use passwords. It doesn’t have to be one or other.
I mostly love passkeys to be honest even though I use multiple browsers across multiple devices and OSes (iOS, Chromebook, Linux, macOS, Xbox, etc). Bitwarden’s support is (finally) pretty good.
My problem is that I manage a lot of accounts for my family which makes passkeys a nightmare. If I’m out and a kid gets chucked into a login flow that happens to require a passkey, I can’t text a password and TOTP code to the adult with them. I know that’s terrible opsec but the reality is people share accounts and passkeys are designed to thwart that.
Passkeys are a mitigation against users being bad at password hygiene and phishing being a real issue to users.
You can't phish a passkey, and you don't rely on the user providing you 'hunter2' on every site.
As for vendor lock in? No. The specs are open. You can run the code on a microcontroller, or, you can keep it in your arm with something like the Vivokey Apex. Note that the FIDO2 for the Apex is an open source Javacard applet.
The UX on the other hand is not great. If you have a password manager, your OS may prompt you which target to store the passkey with.
I don’t understand this point at all. I think the author has himself confused with the average consumer. For the first time in a decade or so you can buy a PHYSICAL key and use it to sign into websites. I can explain this to any grandma out there. Likewise, I’m an Apple user. Once you’re in Apple universe passkeys are extremely easy. Tap your thumb on the scanner, done.
Now we can put on the tinfoil hat and say how this fosters vendor lock in yadda yadda but the last thing I would say is that it has terrible user ergonomics. LOL
And there's your blocker. Being limited to only devices from a single vendor is horrible, and a firm no from a lot of people.
> Now we can put on the tinfoil hat and say how this fosters vendor lock
The fact that you call it a tinfoil hat type issue is just insane to me. Literally every person in my household has some apple devices and some other ones (android, windows, etc). And some of them have switched back and forth.
Plus, the "ergonomics" of logging into a website on a random device to check something are awful.
I literally presented you with the solution in the sentence before. Buy a usb c dongle key. You pay 20 euros to NEVER have to remember a single password ever again. Seems like an ok trade off to me.
Likewise you can register multiple passkeys for multiple devices, so long as you do it in sequence (first Apple, then Android) etc.
Really it takes very little getting used to.
Ever tried to fill out a crap password form which wants 7 special characters but no dashes but uppercase but not uppercase Y and so forth.
I think portability is very confusing: they rolled out passkeys with no device portability (device-bound) and only recently added it (CXP). So for anyone with multiple devices it was a relative disaster - why should my Windows PC hold a device-bound passkey to anything? How do I login on Linux or macOS?
Picking a password manager to do portability also means another kind of lockin, though maybe you can live with that kind if you really trust the company. Even so, the password managers all seem to be competing to have relaxed security, so that vault and account passwords are the same, or you are asked to type your master password into a webpage - surely we didn't replace per-site passwords with this?
The website for my HSA required me to set up a passkey last time I logged in. I set it up on my work laptop and my work password manager, which means I can now no longer access my account from my personal computer. This is fantastic, just what I wanted
I only use pass keys by storing them in 1password. Then I don't have to worry about the whole "lose/broke/replace a device" thing, which is inevitable. Then just be really good about keeping your backup codes etc with 1pass solid.
Passkeys are a vector for locking your logins to Big Tech ecosystems. They support device attestation, which means the service you are logging in to can require you to only use certain Passkey clients such as those provided by Google, Apple or Microsoft. The Passkey spec authors also maintain a list of "naughty clients"[1], which are clients that allow the user to manage their own data how they want. Services could choose to block those clients for "security reasons," justifying the decision to force you to use one of the Big Tech providers.
Until device attestation is removed or strongly curtailed in the spec, I suggest you do not create any Passkeys. Which sucks, because it's otherwise a pretty cool tech.
The cumbersome and poorly designed workflows surrounding passkeys are a significant hindrance to their adoption as well. It surprised me how bad they were when they emerged -- it was as if the UX was intentionally designed to kill passkey adoption.
I don't know how to rationalize it: is passkey so good that even the banking apps start pushing it, or is it all a big conspiracy theory with a hidden agenda?
I find it difficult to explain how to use password manager to non-IT person. Whatever I say, they say it is not secure. No amount of explanation will change their mind. They prefer to keep their passwords in their physical note book hidden in the safe (yes, they open the safe etc each time they need to log in somewhere when they get logged out).
As someone with ADHD a passkey is something I can lose easily and I don't want my accounts to be tied to any specific device. What if I have to upgrade my laptop tomorrow because one I use got bricked? Sounds like an absolute nightmare.
Password on the other hand I can remember for dozens of services, each very long.
If the person you describe really is doing that for all their passwords, then they are correct. Their password store is more secure than a password manager by nearly every metric that counts.
The one thing I would ding that approach on is recoverability, though. If a fire burns that down, it's gone.
It just so happened that Microsoft sent an email today to our M365 tenant administrators that SMS and voice for 2FA is being removed 1-Feb-2027 and that automatic enrollment to passkeys starts 1-Sep-2026. Bring on the passkey overlords. Although, LLMs say that passkeys are superior to passwords since it includes a public/private key setup with the private key saved to a device that requires a PIN or biometric to access the private key.
Passkeys were invented so hacked sites could brush off their leaks with "no credentials were leaked" and minimise any regulatory fines. This is the reason why its being pushed by the big players.
Additionally this puts the same players in control of your logins - want to sync your passkeys? - enable "iCloud Keychain", or some other 'trust me bro' app that will 'securely store/sync your data' - no thank you.
In perfect world users should be able to generate a certificate, upload it to a couple nfc capable ubikey like devices that blow a fuse afterwards preventing from additional writes/reads and use that to login to every app ever. You would buy such devices in packs of 3, upload same cert to all, hide the other, burry the third.
My tinfoil hat take is that there's significant interest to keep everything digital, always-online and connected to the major providers, so it can easily be snooped by five eyes using their omnipresent backdoors.
Passkey biometrics also allow you to confirm certain person is holding the device right in this very moment, and not receiving a TOTP via walkie-talkie. Especially important for kinetic sanctions.
If you check out their Terramare group of companies those guys are still using typewriters. Unless you're US/UK millionaire I recommend to stay as analog as possible with physical password book and TOTP/yubikey.
Same with the push for "post-quantum crypto" and elliptic curves. I feel my systems get significantly more attention when using 8k RSA than any of its modern replacements. While I love wireguard the transition to ED25519 felt way too smooth..
Diversity is resilience; no need to standardize on curves or "post-quantum" IBM bullshit if other approaches still work perfectly fine.
And if the pros are using typewriters in 2026 it's not a signal for me to put even more eggs into the US-megacorp dominated basket who treat me like an NPC who can be droned at will.
I think there are probably sinister motives behind some of the push to pass keys, but you'd think that if that were true, they would make it really quite easy to add one and to use.
That is not the case. The entire setup/enrollment/add a passkey to your account processing is DMV inspired.
I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand:
I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use LastPass. If I accidentally set up a passkey on my phone (let’s say I use Safari one day instead of my go-to, Brave), can I still log in without that passkey on other devices? Is there a way to ensure that passkey can be used on other devices? Can I add another passkey on another device? How many passkeys can I set up for a particular site/app? I have at least 6 different combination of browser/devices in use.
I don’t want to use Passkeys because I don’t the answers to those questions, and I don’t know whether each website/app that has set up Passkeys has decided the answers to those questions in the same way as the others. For now, I’m going to stick with LastPass and use Passwords; because no matter whether I lose my device or not or whether I’m on my own devices or not, I can be sure I’ll be able to get into a site/app.
Edit: One final consideration, my spouse and I share user/name passwords for some things (notably Pandora and our Amazon Prime account) since they don’t handle things like family logins well; how do both my wife and I use amazon or Pandora with passkeys? Do we each set up passkeys? How do I get her Pass if that’s not an option?
This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email.
(But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.)
The weird part is that password managers provide no way for you to copy and paste your passkeys. To present a passkey, you have to use a password manager. This makes it impossible to copy and paste your passkey to the wrong person (someone trying to trick you).
Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourself. Instead, the password managers each have their own finicky app-to-app mechanism for transferring passkeys from one password manager to another. (I think all the password managers kinda like that lock in.)
Finally, note that for logging into your password manager itself, you'll always require something outside your password manager to login, probably a password, but possibly a YubiKey; your choice. (It's your one "last password," as they call it.)
https://danfabulich.medium.com/passkeys-are-just-passwords-t...
P.S. It's past time to move off of LastPass. LastPass lost all of your passwords again last month, just like they did in 2022. The most similar service is 1Password. If you like LastPass, you'll like 1Password about the same, but 1Password hasn't had multiple terrible security breaches.
>This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager.
The issue isn't what passkeys _are_ (e.g. explaining they are like public/private "ssh keys" and hoping that type of explanation ends the confusion).
Instead, it's the workflow around passkeys. The websites show very confusing dialog popups and choices that a lot of normal people will not understand. This is a good article with screenshots showing the confusion: https://arstechnica.com/security/2024/12/passkey-technology-...
I have senior citizens asking me about passkeys because their bank and medical websites keep reminding them about switching to passkeys every time they login into their accounts. My recommendation to them is not to do it unless they have a simplistic single vendor setup such as only Apple iPhone and MacBook with iCloud Passwords app. If instead they have a mixed Windows + Apple setup with 3rd-party password manager, they could accidentally put a new passkey into the os or browser instead of their external password manager and not realize what has happened. This happens because the different parties implementing passkeys all have different agendas that suits their interests and that's what makes the workflow confusing for normal people.
I don't think you're giving those seniors good advice. When the banks ask people to "switch" to passkeys, they're not removing the passwords; they're adding passkeys as an alternate login mechanism.
If you lose your bank passkey, (e.g. if you put it in the wrong password manager and you can't figure out where it is) you can just sign in with your bank password.
In the worst case, banks actually don't make it very hard for seniors to reset your password/passkey; just show up at a branch with photo ID, your bank card, and your PIN, and a teller will help you reset your credentials. They do it all the time.
And, remember, seniors could also put a randomly generated password into the wrong password manager. In that case, they'll either have to reset their password, or they'll have figure out what they did, retrieve their password from the OS password manager, and transfer that password to their preferred password manager.
The exact same story applies to passkeys, except, because passkeys can't be copied and pasted, you'd have to figure out how to use the finicky app-to-app transfer system ("Credential Exchange Protocol"). That's probably too complicated for most seniors, so falling back to a password is almost certainly their best bet.
I am an engineer and have some insights on the discussions and developments around it.
ITS NOT SIMPLE AT ALL
1. The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing).
2. Majority of industry players shared the vision of a credential which is available across the platforms and browsers
3. The vision for collaboration never materialized so everyone went their own way to implement it. Examples would be google rolling out browser (Chrome) managed authentication which led to this situation where even on the same machine you have to remember which browser you used to create the Passkey credential.
4. Interestingly enough the earlier popular name was WebAuthn, Apple started calling it Passkey on fly, given Apple's popularity everyone just caved in.
5. My personal interpretation is that in some sense Apple wanted to be the default password manager on Apple devices.
6. This is when all password manager companies jumped in strongly to save their business and the protocol went into a direction where you can use your existing password manager to store the credential/Passkey as well
Personally its a mess, the phishing resistant aspect has its own benefits though. If you are using it with security in mind then my recommendation would be to use a hardware backed security key with NFC enabled. Everything else is pretty much lipstick on pig, they are worse than passwords in some sense from usage perspective.
I looked up the June 2026 breach and there is no mention of passwords being stolen. Only some PII (Phone, name, email, address) through a third party.
> Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourself
That's a red flag to me. It's enough that phone backup systems go out of their way to prevent you from accessing your own data, too, for unexplained "sekhurity" reasons.
> P.S. It's past time to move off of LastPass. LastPass lost all of your passwords again last month, just like they did in 2022. The most similar service is 1Password. If you like LastPass, you'll like 1Password about the same, but 1Password hasn't had multiple terrible security breaches.
That's the most annoying thing about password managers, and a major reason I still don't use them: there exists no password manager that is cross-platform (desktop/mobile in particular), local-first, and isn't sketchy or enshittified or otherwise on HN's current "don't use it, use <whatever> instead" list.
For core security tool class, that doesn't inspire confidence.
Apple, Google, Microsoft, Mozilla, and 1Password don’t let you export passkeys to a file that you can read and backup, but Bitwarden, Proton Pass, and KeepassXC do.
I think Bitwarden is on HN's current happy list. (I just use Apple iCloud myself.)
Allowing passkeys to be exported to a plaintext file undermines the phishing protections, at least somewhat. It’s possible to trick you into exporting your passkeys from Bitwarden and sending the file to an attacker.
The major password managers say that this is the reason they don’t allow exporting passkeys, and it’s not false, but they’re also making it harder to switch password managers, which may be their ulterior motive. (You can’t even import those exported passkey files into any of the major password managers, which they would be incentivized to do, if those smaller players had significant marketshare.)
It’s up to you to decide whether protecting yourself from being tricked into exporting your passkeys is worth sacrificing your ability to read them.
> This makes it impossible to copy and paste your passkey to the wrong person (someone trying to trick you).
It also, unfortunately, means it's not possible (via most passkey implementations) to back those passkeys up to paper. Which is quite unfortunate: backing up to paper is one of the most stable and human accessible ways of ensuring redundancy and continuity, an inevitable but also oft-ignored part of credential management.
Security folks would like to pretend "solving continuity" isn't a problem, or is a problem that doesn't need to be accessible.
If you save it via Passwords app, it'll be iOS / macOS mainly, but you can unlock with any Apple device that supports Passkey / Passwords app (so likely modern + reasonably updated) the easiest. If you want it to work "everywhere" then you CAN use your iOS / MacOS Passkey, it will show you a QR code, some places poorly support this, I believe both devices need bluetooth, and then it will authenticate it.
Linux is the only oddball here, I had issues getting this flow to work.
If the UX for Passkey improves, I will go all-in on it, I'm at the point I'd love to just completely block passwords from accessing my account, unless I explicitly enable it temporarily by logging on via passkey, I wish some sites would let me lock my account to this level, it would be better. Passwords feel like they just wind up all over the web.
Weirdly enough you can store multiple passkeys for a given domain, which can get confusing in some cases if they dont have normal names tied to them.
Edit: Originally I thought Passwords from Apple was iOS / macOS only, but its not! So I have been editing my original message, sorry for the confusion, I had forgotten that I can login on Windows with my Passkeys from Apple's ecosystem.
As another poster noted, you can transfer them out of Apple's ecosystem too!
> Linux is the only oddball here, I had issues getting this flow to work.
Take a guess why.
Passkeys are just a trick for vendor lock-in disguised as a security practice.
Firefox just didn't support it cleanly, I think Chrome did, I don't remember. Apparently it's just due to Linux not having a native passkey implementation. Dang.
Edit:
Apparently BitWarden should work, but my particular passkey was not on there.
They are, however, completely unphishable, which is a big plus IMHO
Unpopular opinion but correct the whole thing has been designed to lock you to devices they make and have themselves be the arbiter of your authentication.
If that wasn't the intent they could have make the thing work like ssh keys, encrypted at rest, you can take them wherever you want.
What are you talking about? I can literally export all that data to another OS or password manager. Takes a whopping single click.
Only to other proprietary systems within the FIDO Alliance that you don't own or control.
Additionally passkeys allow services to detect and ban specific password managers, so have fun when the only approved managers that works consistently across all services are Google/Apple/Microsoft. There is already a list of "bad" clients here https://passkeys.dev/docs/reference/known-issues/
I didn't realize this was supported, I'm kind of favoring Apple's Passwords app since you can lockdown your account and they are very on top of someone accessing anything of yours. Any time I power on an iPad I havent used for months they tell me a new device can read my texts type of thing, which is a nice paper trail.
I wouldn't favor an application that is locked to a big player account (Microsoft, Apple, Google) where a ToS violation for something unrelated may lock you out of all services, passwords/keys included.
Windows also has the Apple Password app.
https://support.apple.com/guide/icloud-windows/set-up-icloud...
This is the main reason I've avoided passkeys. I have these exact questions and there's no a clear explanation given for these. I don't want to lose access to important accounts.
Agreed, it's the exact same as me, I haven't seen someone put it into such succint words before, so bravo.
I think the reason is because I've anchored passkeys into my understanding of how 2FA works, and the pain of migrating 2FA from one phone to another.
So, I don't want to bother with it.
I think the point is that Passkeys are not supposed to be as precious as passwords. You're supposed to have a brand new one for every device/application combination. So they are just login cookies at this point, and haven't even come close to replacing passwords because you need to know your password to get a new passkey every time you log in.
Now, is that the official stance? I don't know; but it's _absolutely_ what every current implementation suggests the companies deploying this stuff want.
You can make passkeys better. Like me, you can install a well-funded password manager (well-funded, because it needs the engineering effort behind it to keep up with the ever-changing passkey apis on every platform in the world; screw up and oos, can't log in today!). Then you have one passkey per remote service, and just have to make sure 1password is _always_ installed and perfectly integrated. Easy!
Same here, also what if I lose the device?
I can safely write down a password on a piece of paper and keep it somewhere phyisically safe.
Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.
Sounds like something security services would love people to use. Instead of using wrench to extract the password - and distressed person may lose memory, they can just locate the passkey.
Nobody is safe from a nation-state "attack" they'll just go threaten your providers to give up your data. Passwords written on paper are probably safer than a centralized password manager for almost every circumstance other than a government coming after you.
Papers: Safe - yes. Easy to lose/misplace: also yes.
Humanity having millennia of experience securing them: also yes.
You do the same as you do when you lose your SSH key. Restore from backup and move on with your life.
Why is there so much misinformation nonsense around passkeys?
How do you use a restored passkey from backup? Aren't they locked to the device?
That's all I want to know. How do I restore from a backup? Specifically, a backup that I make to a medium I control, like a piece of paper or a burned CD-R in a safe deposit box. If I could get a good answer to that, I could be onboard. But from the conversations that I am getting here, it looks like only certain managers allow it, and with device attestation, they could be banned at any moment by any website with no recourse.
I think the intended workflow is you login with your phone and that device is now the authority that allows other devices to issue their own passkeys.
In my opinion it's a bad plan, because it elevates certain devices to privileged status, if you lose your phone you are hosed.
Passkeys should be allowed to be synced between devices and stored on password managers in the cloud. I am making my own password manager for my personal use, but have not delved into passkeys.
Listening to Yubikey and OnePassword talk about this, they actually say "One Person, One Device". Which really speaks to their failure to understand their users.
Because the original FIDO/WebAuthn standard was built for device bound credentials. They imagined unique keypairs tied strictly to a specific piece of hardware. Synced passkeys were a compromise, mostly driven by Apple and Google, because per-device credentials are too much friction for general use. It's not that they failed to understand users, it's that they incorrectly assumed the level of inconvenience people are willing to tolerate to be textbook secure (the answer is almost zero inconvenience).
The device bound model also completely falls apart in the enterprise, fails to address shared devices and shift workers where employees share the same PC under the same OS profile, now you're back to needing good old fashioned SSO w/ physical MFA (Yubikey) to attest who the user is in addition to attesting the device itself.
Before synced passkeys, the actual standard is a unique key pair per device. The key pair on my phone shouldn't be synced to my laptop, my laptop should generate it's own key pair.
I would love to see what you’re referencing, can you provide a link or citation to that quote?
the video requires signing up for Yubikey spam. https://app.livestorm.co/yubico-y/securing-trusted-actions-a...
My issue is that they're touted to the consumer as secure, and they're not really doing much more than a complex password.
How do you generate a new key if you need one? Same process as a password reset. Does it prevent session stealers? Not at all.
Its "benefit" is grandma can't read it to an attacker. OK, well can grandma click a link and have a session stealer bork her life instead? Yeah, and attackers know that and just shift methods. Session stealing isn't a sophisticated attack, and so all that's being done is shaving a cost on PW resets in the interest of shareholder value, at the cost of security theater and locking up your keys in a single domain that holds control over our access to everything.
You can store your passkeys in Bitwarden or Keepass vault. Then you can use them through Bitwarden or Keepass apps on any other device. Been using passkeys like this for several years, and it works pretty seamlessly. With Keepass vault, I even have an offline copy as backup.
If you store the key in Bitwarden or Keepass, what makes it different from a password?
The difference is you can't just copy and paste the private key into a phishing website. The login process validates your private key and logs you in.
Also since the service does not store your private key, it is more resistant to data-breaches as that is one less potential breach source.
They are bigger. Not as easy to guess. More like pretty impossible. It's like not letting the user choose the password. That way they can't have a bad password.
Copying / syncing passkeys between password managers is still work in progress, but you can usually work around it by making multiple keys. For important websites, I recommend saving additional passkeys to Keychain, etc, as backup, assuming the website allows that. (It should, but some websites might not have a good implementation.)
Also, nothing says you have to delete passwords (or alternate means of logging in) if you already have them set up. Having multiple ways in will help prevent lockout.
> If I accidentally set up a passkey on my phone (let’s say I use Safari one day instead of my go-to, Brave), can I still log in without that passkey on other devices?
N=1 and I'm sure I'm holding it wrong, but I can only log in to ADP to request PTO from my personal laptop because I set up an iCloud passkey, work laptop does not allow access to iCloud keychain, and you can't request PTO from mobile.
Answer to almost all of your questions is that it entirely depends on the service what kind of auth implementation they offer. I personally have completely adopted passkeys and use them with every service that allows it.
I use ProtonPass and have made it the default password store on every device and browser. This way all passkeys get stored in proton and I can login from any other personal device with proton setup.
> ...it entirely depends on the service what kind of auth implementation they offer.
I think that's exactly the problem. These are all answerable questions, but getting those answers is confusing for most people.
Also from experience, most sites will implement it in every wrong way possible.
For example, all the major sites that allow the total of 1 active TotP authenticator app - trying to add one forces to delete the other. Which is fine while you have only one phone and aren't in the process of switching to another one.
> These are all answerable questions, but getting those answers is confusing for most people.
It's the same answer when someone asks 'how am I supposed to have a different password for every site' and 'how am I supposed to remember a password of X+ characters.' Use a password manager. Pretty sure every major one supports passkeys by now.
Password managers are themselves cross-device footguns and I could easily write the same headline for them myself. I've been working in tech for 20 years now, and I don't use them.
ETA: Well I do use auto-fill in browsers/mobile, but funny thing about this, I have three running on my phone[0], they all activate at the same time, and they contain mostly non-overlapping set of credentials, and I got tired of trying to sync them together, so I just look up passwords manually one by one in each and use clipboard to transfer the credential once I find it.
And I had to stop using passkeys because they interact with this split-brain system in unpredictable ways.
--
[0] - Specifically: Google Password Manager / Google Autofill / whatever they call it, Samsung Pass / Samsung Wallet (they're sort of but not the same?), and auto-fill built into Firefox.
Write it down on a sheet of paper and put the paper in a safe place. As a bonus, I can have multiple copies in multiple places. It is simple, easy, and I have been doing it all my life. I see no reason why it has to be more complicated than that.
So passkeys achieve nothing if you can already use strong, secure, random passwords stored in a password manager?
I use ProtonPass and afaiu it just syncs the passkeys private part everywhere you need it. So it “just works”. This is better than just old fashioned credentials because the passkey only “triggers” on the correct domain, so they can’t be phished by other domains… Right?
I recognize the point of your post is more about the lack of clarity and details around passkeys. That's real, and I don't really have an answer for that - other than, I think maybe the quest for making them simple and "just work" has maybe made them nebulous enough that we've wound up in the current situation where a lot of even technically savvy people don't really understand them. But I feel like answering your questions might sort of help explain why that's the case, so I'm going to take a stab at it:
> If I accidentally set up a passkey on my phone (let’s say I use Safari one day instead of my go-to, Brave), can I still log in without that passkey on other devices?
Assuming you have LastPass set up to be an iOS password manager, and it fully supports iOS' passkey implementation: when you create a passkey in Safari, it will ask you if you want to store it in LastPass or in the iOS Passwords app (previously known as iCloud Keychain). If you say LastPass, then it's up to them, but I assume it'll sync to all your devices - it's how 1Password works. If you were to accidentally say Apple Passwords, it'll sync to all your Apple devices automatically, and you can either use Apple's password browser extension on Windows, or you can use the "another device flow" I'm about to detail.
> Is there a way to ensure that passkey can be used on other devices?
As mentioned above, passkeys are intended to sync via your password manager of choice as the primary use case. If for any reason you don't have that passkey synced to that device, _and that passkey is on a mobile device with a camera_, most browsers will give you the option to scan a QR code with your phone. This kicks off a flow that will authenticate you via your phone's biometrics or passkey, then use Bluetooth to first ensure device proximity and then handle the authentication exchange. In the case of iOS, this includes any passkey-supporting password manager, so the passkey itself can be in 1Password; it doesn't have to be in the iOS password system for this to work.
When I first read the above, my hackles were raised given how well Bluetooth operates at times; but every time I've used it so far, it's been fast and flawless. Still, I can see a lot of scenarios where this might not work - e.g., the first one I thought of was a public computer at a library where Bluetooth might be locked down; corporate computers or remote servers could also be troublesome. As far as I know, passkeys don't yet have answers to those scenarios; other than to just use your password + 2FA as you would without a passkey.
As far as I know, both of the above apply to every passkey-consuming site.
> Can I add another passkey on another device? How many passkeys can I set up for a particular site/app?
This touches on your last paragraph, where it indeed could change based on the website. In my experience, every website where passkeys are fully supported - e.g., not ones that are using passkeys as a substitute for FIDO/U2F keys - has let me add multiple passkeys and have not _appeared_ to have a limit. I typically will create a passkey in both 1Password and Apple Passwords just to have a backup, and I can't recall any cases where that's been a problem. Still, I can't say for sure that isn't a problem on any website.
I went all in on trying passkeys when they started to be an option, and I don't have any notable regrets. For me, passkeys have generally worked well when the site is designed to use them well; and at no point have they been a _major_ hindrance. That isn't to say there are _no_ annoyances, though:
- Most websites that support passkeys tend to use them as a replacement for both the password _and_ 2FA, which makes them more convenient. However, a few - Amazon being the most notable I can recall - only use them as a second factor, which just makes them feel a little useless.
- A passkey can _also_ be used as the proof of identity, meaning you can log in in one fell swoop and don't need to enter a username or email address, which is IMO the best showcase for passkeys. Like above, this makes websites that ask you to enter an email address before letting you use a passkey also feel annoying.
- Most web browsers I've used support the QR + Bluetooth flow I mentioned above (otherwise known as Hybrid Transport or caBLE) without issue; Linux has been the odd duck out. Firefox doesn't seem to support it at all on Linux, and Chrome-based browsers do but sometimes are missing what they need and in that case don't show it as an option. Since I sync just about every passkey with 1Password this typically isn't a problem; the exception is the passkey for Apple Accounts, which Apple creates automatically, and (AFAIK) doesn't allow you to enroll your own. Apple Accounts are the only service I've found that does this, though.
- Some websites seem to only offer passkeys as an option if you're on a mobile device, or at least did so at the time of enrolling. eBay and PayPal I think are the two that jump out at me as having done this. Why they did it this way instead of simply detecting if the browser supported passkeys, I have no idea.
All of the above issues have gone down over time, so it's generally been a net decrease in friction over time. And, at least as far as I can recall, passwords themselves continue to be an option in every instance I've enrolled a passkey. So if you like your passwords, generally speaking, you can keep them :P
> passkeys are intended to sync via your password manager of choice as the primary use case.
The sync was actually a compromise to the standard. The idea was unique, device-bound credentials. One person, one device. The private key/passkey on your phone should not be the same one on your laptop, or your tablet, etc. Each device was supposed to have it' own unique credential.
Allowing sync is a security downgrade to the standard, in terms of threat-model guarantees. Pure WebAuthn credentials should be sealed in hardware (TPM or Secure Enclave or equivalent) and be mathematically non-exportable which guarantees zero remote blast radius, an attacker must physically posses the device.
Allowing sync and storing passkeys in a password manager reintroduces cloud account compromise risk and recovery flow hijacks. You lose non-repudiation.
Still more secure than passphrase + TOTP, but doesn't eliminate account takeover attacks against your cloud credential vault, which purely hardware based, per-device credentials do.
Why not use passkeys in LastPass? Then the passkey travels with you to your devices/apps.
I'm using bitwarden, but it's possible to use passkeys from multiple devices and if it's not available for whatever reason, you can just login with username/password/token/biological probe/whatever you used before. As an example: GitLab gives you both options right from the start, so you can use whatever you fancy in that particular moment.
Did [someone from the Working Group] ever back down from their implied threat to blacklist Bitwarden for allowing for the sharing/export of passkeys?
That really rubbed me the wrong way, and smacked very heavily of "the big players (MSFT, AAPL, GOOG) can do this - you can't".
I know KeePassXC faced the same threat. I don't know whatever became of it.
Passkeys basically MITM the 2FA process so that they can track and deplatform you with a single click across all your accounts.
The biometric verification also allows to confirm that a certain person is holding the device, and they can easily be matched to existing passport/travel databases.
Great system if the good guys have it, a bit problematic if it's abused by nepo kids to hide their crimes.
> Passkeys basically MITM the 2FA process so that they can track and deplatform you with a single click across all your accounts.
I use passkeys with a physical authenticator. How do "they" track and deplatform me with a single click? Can you explain?
It’s really not that hard.
Most of your devices are in the Apple ecosystem and when you are prompted to create a passphrase it will ask you to put it in your iCloud Keychain. Boom, now it is available across all of those
This is how it will work for most people who don’t care about security and just casually use their devices. My boomer mom does this. It’s better than the notebook full of handwritten passwords she was using.
You have chosen lastpass and a multi-ecosystem environment with windows and multiple browsers on each. You have chosen complexity and this is not a limitation of passsphrases as they have been designed for a more common use case.
I use Linux and apple. I have chosen protonpass for my vault. I just tell my OS to save the passkey there and everything works pretty well. If not, my password is right there as fallback. It’s really not that hard.
What if I lose all my apple devices? House break-in and they steal my mac and my phone?
You're basically fucked even if you buy a new one because you need one of the other two to log in.
No technology in the world can protect you against every threat model and unlikely scenario.
What if the robber hits you in the head and you get brain damage and forget your password?
That is not a rare threat model. Many people use iPhones and Windows computers. Fortunately, Apple has released iCloud Passwords which lets you access passwords and passkeys from a Windows computer.
That's the point: passkeys, and even 2FA, address rare and unlikely threat scenarios, while defeating most common use cases (delegation by sharing credentials), and making people vulnerable to most common threats (like, losing or breaking your phone).
Master password to password vault stored on metal, buried in my backyard and I tell a family member where it is in case I ever get brain damage
Then you'll login to your Apple iCloud account using your password.
Passkeys are just passwords that require a password manager; you can't login to a password manager without something outside the password manager, usually a password. (That's why they call it "LassPass" and "1Password"; there's one last password you'll still have to maintain.)
No password manager tries to get you to login with a passkey without setting a password, for precisely that reason. Apple, Google, and Microsoft do invite you to login to their password managers via passkey, because it's convenient and unphishable, but they always also allow you to login via password (or "backup codes", which are just backup passwords).
Proton Pass is on the official Passkey client naughty list[1]. I hope the services you log in to don't choose to ban it because of those big, scary X's.
[1] https://passkeys.dev/docs/reference/known-issues/
The fact that services can ban passkey providers is a major red flag in the protocol and the real issue that nobody talks about
This is why I am so concerned about passkeys. They could be a good improvement, but in practice I already see how it's going to result in Google/Apple/Microsoft/whoever seizing even more control.
The document there is laughable too, because KeepassXC is listed as "not performing User Verification" when it demands manual authorization per request. But this isn't good enough for the passkey people. Ultimately, I see any FOSS option being effectively banned from most services and all important ones. It's a parallel to how you must now be on Cloudflare's nice list or be banned from the majority of the internet.
(I might be wrong, please correct me if I am) What I'm gathering from this page is that the Passkey spec can specify whether the app handling the passkey should prompt the user for biometric scan, PIN code, etc. but some apps simply ignore that flag. This makes sense though. I've already logged into my password manager and it hasn't timed out yet, so why would my password manager prompt me again? I'm glad that they don't prompt me again when I'm already logged in. I don't see this as a problem.
Your understanding is correct and I agree with you. The Passkey spec authors, however, think services should be allowed to ban your client for behaving this way:
> [When UV is required, KeePassXC must request user verification or not handle the request]
> This implementation is not spec compliant and has the potential to be blocked by relying parties.
https://github.com/keepassxreboot/keepassxc/issues/10406
Right, not only are you authorized, but you are also prompted to manually complete the request, which will fail if you do not accept. However, this isn't considered sufficient by the passkey people, who do in fact want you to retype your password at each prompt.
these questions all have easy answers that could be quite easily discovered by simply trying to use passkeys, instead of trying to find reasons not to use them.
But since there's a potential nonzero risk of permanent account loss, I don't want to experiment, and since I can still log in with email/password I'm going to keep doing that.
You shouldn't be forced to discover what capabilities exist by brute force. Just freaking explain it.
Like some folks already commented here, even as someone who has been working in tech for 20+ years, I find Passkey confusing. I understand the key aspect in computer science term, but I don't know how to use it across devices. Another big worry is that if I tie that to a physical key, then I might lose it (because it's physical) and never get it back.
Exactly, I always refuse to add a passkey because I'm afraid I won't be able to easily login again. Also, I don't want to be locked in to a vendor.
FWIW: I find passkeys to be a very simple and easy to use concept.
Simple: it's like a password that I don't have to type in
Easy to use: because I use 1Password and just have it installed on everything. On Android, it can be set as the default passkey provider so, even on mobile, I am using passkeys shared across devices.
Is this "less secure" because I'm sharing the keys through 1Password. I suppose, at some level. But before that, I was simply sharing passwords through 1Password in the exact same way. So, I don't think my security posture has changed any.
What has changed is the UX and IMO for the better. Now I don't have to generate/fill/copy-paste text strings for user names or passwords. 1Password knows what site I'm on and usually responds automatically when I'm in a passkey context. If I have more than one passkey available, because I have multiple accounts (for something like Google Workspace), it shows me options and I pick the one I want.
Honestly, it's mostly a "just works" system and I like it a lot better than passwords.
YMMV, of course.
This is a big problem I have with "just works". Everyone is used to services only allowing a single password. I know the answer to this, but it's not clear in the marketing or how it's explained to normie end-users: Won't creating a passkey erase my password? How do you sign in on another device? Won't that change the passkey and lock me out from the first device?
OK now say you're on a work/library/friend's computer and you want to look up an account in 1password on your phone so you can type in the password. Passkeys don't support this very basic and common workflow. Meanwhile there's no real security benefit over password manager generated complex and not reused passwords.
If I'm on someone else's computer and I want to use a passkey on my phone, it'll display a QR code. I scan the QR code with my phone, it signs the login request and posts it to their callback. Then I'm logged in on that device.
If my phone's camera is broken but both devices have bluetooth, it can do the handshake over bluetooth.
If I'm on someone else's computer and I want to use a passkey on my authenticator on my keychain, I'll just plug it in and then tap the button on the authenticator.
Meanwhile, if I logged in with the password and the account only has a password then they have a full copy of my entire authenticator to the account. With the passkey, once the session is invalidated the access is gone.
My problem with passkeys is that "don't have to" is actually "don't have to, and couldn't if I wanted to".
Everything you said is _also_ true if you use a password manager than can interact with the browser (which you're already doing).
Plus, that doesn't have the negatives/limitations of passkeys.
But you still have all the negatives/limitations of passwords, of which there are tons.
With physical U2F key, I could explain to my 78 year-old-parents "this is a physical key needed to access your account. Think of it like the front door key to your house. Don't lose it or lend it to anyone. We should have a couple of backup keys too." And they got completely understood and added it to all of their accounts. This was not hard. People assumed consumers were too stupid to do this without even giving them a chance.
> Don't lose it or lend it to anyone. We should have a couple of backup keys too.
Honestly, this is one of the two things that make me hate passkeys. The key management is a high-friction pain in the ass.
And/or maybe the vendors were annoyed that people would lend the keys anyway, refusing to accept that it is normal because that's how delegation of authority works in real life too. House keys are also things you often lend to a third party that you want/need to access your house in your absence, and in fact making extra duplicated for trusted third parties is normal.
Software vendors continue to refuse to support, or even accept the existence of, this entire class of use cases for regular consumers (they are, however, more than happy to milk enterprises on convoluted implementations of those).
I never found a comfortable way to ensure all of my accounts had more than one U2F key associated with them. I always wished there was a way to have 2 physical U2F keys, one on me, and by adding one to an account, both would work.
As is, I had to either:
- Keep both on me, and add both - I am at risk of losing both at the same time
- Keep one one me, one in a safe - I have to keep track of which device I've added to which service, and periodically take the backup one out of the safe and iterate through the "new" services
I was never satisfied with either approach, so I ended up with an OTP app with backups.
Passkeys are just SSH keys in how they work. We've been doing this since the 90's. The only people that use SSH keys are the Linux savvy users and those who are forced to via an enterprise solution for vaulting.
The average person doesn't know anything about this stuff nor do they care. I also have yet to see a Passkey solution that didn't also have a password on it and a nice little box letting people choose to use the password instead of the passkey. They just added a new layer on top of all the old ones and created confusion. Now people use password and passkey interchangably in conversations and no one knows what they are talking about.
I can find my ssh keys in `~/.ssh`. No such place exists for passkeys.
It depends on the app you’re using to save passkeys. Use Keepass and it saves the passkeys into kdbx file (similar to SSH keys).
Aren't they effectively locked in the database of whatever password manager is used? I know you can export them, sort of, but that feature may blacklist your password manager and make it useless. Are they portable? I thought passkeys are locked to the device.
I was answering to the storage part. Blacklisting is the attestation part which is definitely a concern. Again, you can use passkeys as a yet another way to login. You can still use passwords. It doesn’t have to be one or other.
I can pull up all my passkeys in 1Password or Bitwarden without issue.
I would feel a lot better using SSH keys rather than passkeys. At least those are understandable.
They're literally the same thing, what are you on about?
Apparently not: https://news.ycombinator.com/item?id=49007750
SMS 2FA was also optional everywhere until it wasn't.
I mostly love passkeys to be honest even though I use multiple browsers across multiple devices and OSes (iOS, Chromebook, Linux, macOS, Xbox, etc). Bitwarden’s support is (finally) pretty good.
My problem is that I manage a lot of accounts for my family which makes passkeys a nightmare. If I’m out and a kid gets chucked into a login flow that happens to require a passkey, I can’t text a password and TOTP code to the adult with them. I know that’s terrible opsec but the reality is people share accounts and passkeys are designed to thwart that.
Passkeys are a mitigation against users being bad at password hygiene and phishing being a real issue to users.
You can't phish a passkey, and you don't rely on the user providing you 'hunter2' on every site.
As for vendor lock in? No. The specs are open. You can run the code on a microcontroller, or, you can keep it in your arm with something like the Vivokey Apex. Note that the FIDO2 for the Apex is an open source Javacard applet.
The UX on the other hand is not great. If you have a password manager, your OS may prompt you which target to store the passkey with.
I don’t understand this point at all. I think the author has himself confused with the average consumer. For the first time in a decade or so you can buy a PHYSICAL key and use it to sign into websites. I can explain this to any grandma out there. Likewise, I’m an Apple user. Once you’re in Apple universe passkeys are extremely easy. Tap your thumb on the scanner, done. Now we can put on the tinfoil hat and say how this fosters vendor lock in yadda yadda but the last thing I would say is that it has terrible user ergonomics. LOL
> Once you’re in Apple universe
And there's your blocker. Being limited to only devices from a single vendor is horrible, and a firm no from a lot of people.
> Now we can put on the tinfoil hat and say how this fosters vendor lock
The fact that you call it a tinfoil hat type issue is just insane to me. Literally every person in my household has some apple devices and some other ones (android, windows, etc). And some of them have switched back and forth.
Plus, the "ergonomics" of logging into a website on a random device to check something are awful.
I literally presented you with the solution in the sentence before. Buy a usb c dongle key. You pay 20 euros to NEVER have to remember a single password ever again. Seems like an ok trade off to me. Likewise you can register multiple passkeys for multiple devices, so long as you do it in sequence (first Apple, then Android) etc. Really it takes very little getting used to. Ever tried to fill out a crap password form which wants 7 special characters but no dashes but uppercase but not uppercase Y and so forth.
I think portability is very confusing: they rolled out passkeys with no device portability (device-bound) and only recently added it (CXP). So for anyone with multiple devices it was a relative disaster - why should my Windows PC hold a device-bound passkey to anything? How do I login on Linux or macOS? Picking a password manager to do portability also means another kind of lockin, though maybe you can live with that kind if you really trust the company. Even so, the password managers all seem to be competing to have relaxed security, so that vault and account passwords are the same, or you are asked to type your master password into a webpage - surely we didn't replace per-site passwords with this?
The website for my HSA required me to set up a passkey last time I logged in. I set it up on my work laptop and my work password manager, which means I can now no longer access my account from my personal computer. This is fantastic, just what I wanted
This is exactly a scenario that worries me. Proponents of passkeys imply you can setup a bunch of passkeys. Evidently that's not always the case.
I’ve read all the answers. I still don’t get it. I find it WAY more complicated than copy/paste or a browser extension that does that for me.
I hope it won’t become mandatory. (I honestly doubt).
I only use pass keys by storing them in 1password. Then I don't have to worry about the whole "lose/broke/replace a device" thing, which is inevitable. Then just be really good about keeping your backup codes etc with 1pass solid.
You’d think a head of product at a tech company would embrace a “it’s literally impossible to have your password stolen if you use this” technology.
You can still get your session cookies stolen. If you have good password hygiene passkeys only protect you in extremely niche scenarios.
Passkeys are a vector for locking your logins to Big Tech ecosystems. They support device attestation, which means the service you are logging in to can require you to only use certain Passkey clients such as those provided by Google, Apple or Microsoft. The Passkey spec authors also maintain a list of "naughty clients"[1], which are clients that allow the user to manage their own data how they want. Services could choose to block those clients for "security reasons," justifying the decision to force you to use one of the Big Tech providers.
Until device attestation is removed or strongly curtailed in the spec, I suggest you do not create any Passkeys. Which sucks, because it's otherwise a pretty cool tech.
[1] https://passkeys.dev/docs/reference/known-issues/
More sources here: https://www.smokingonabike.com/2025/01/04/passkey-marketing-...
The cumbersome and poorly designed workflows surrounding passkeys are a significant hindrance to their adoption as well. It surprised me how bad they were when they emerged -- it was as if the UX was intentionally designed to kill passkey adoption.
I don't know how to rationalize it: is passkey so good that even the banking apps start pushing it, or is it all a big conspiracy theory with a hidden agenda?
I find it difficult to explain how to use password manager to non-IT person. Whatever I say, they say it is not secure. No amount of explanation will change their mind. They prefer to keep their passwords in their physical note book hidden in the safe (yes, they open the safe etc each time they need to log in somewhere when they get logged out).
As someone with ADHD a passkey is something I can lose easily and I don't want my accounts to be tied to any specific device. What if I have to upgrade my laptop tomorrow because one I use got bricked? Sounds like an absolute nightmare.
Password on the other hand I can remember for dozens of services, each very long.
If the person you describe really is doing that for all their passwords, then they are correct. Their password store is more secure than a password manager by nearly every metric that counts.
The one thing I would ding that approach on is recoverability, though. If a fire burns that down, it's gone.
I mean, they're right. I wouldn't trust any online password manager even if it was iCloud.
It just so happened that Microsoft sent an email today to our M365 tenant administrators that SMS and voice for 2FA is being removed 1-Feb-2027 and that automatic enrollment to passkeys starts 1-Sep-2026. Bring on the passkey overlords. Although, LLMs say that passkeys are superior to passwords since it includes a public/private key setup with the private key saved to a device that requires a PIN or biometric to access the private key.
That's if you're using Authenticator.
Clarification: Microsoft Authenticator.
You can’t use any random password-manager with passkey support.
I use Bitwarden for everything and have to have MS Authenticator installed just for this 1 login.
Super annoying.
I have Duo in our environment. Authenticator not required.
How is one supposed to let an LLM log in with passkey?
Passkeys were invented so hacked sites could brush off their leaks with "no credentials were leaked" and minimise any regulatory fines. This is the reason why its being pushed by the big players.
Additionally this puts the same players in control of your logins - want to sync your passkeys? - enable "iCloud Keychain", or some other 'trust me bro' app that will 'securely store/sync your data' - no thank you.
In perfect world users should be able to generate a certificate, upload it to a couple nfc capable ubikey like devices that blow a fuse afterwards preventing from additional writes/reads and use that to login to every app ever. You would buy such devices in packs of 3, upload same cert to all, hide the other, burry the third.
[dead]
My tinfoil hat take is that there's significant interest to keep everything digital, always-online and connected to the major providers, so it can easily be snooped by five eyes using their omnipresent backdoors.
Passkey biometrics also allow you to confirm certain person is holding the device right in this very moment, and not receiving a TOTP via walkie-talkie. Especially important for kinetic sanctions.
If you check out their Terramare group of companies those guys are still using typewriters. Unless you're US/UK millionaire I recommend to stay as analog as possible with physical password book and TOTP/yubikey.
Same with the push for "post-quantum crypto" and elliptic curves. I feel my systems get significantly more attention when using 8k RSA than any of its modern replacements. While I love wireguard the transition to ED25519 felt way too smooth..
the fact that some nebulous "group of companies" still uses typewriters does not mean that all modern cryptography is flawed
Diversity is resilience; no need to standardize on curves or "post-quantum" IBM bullshit if other approaches still work perfectly fine.
And if the pros are using typewriters in 2026 it's not a signal for me to put even more eggs into the US-megacorp dominated basket who treat me like an NPC who can be droned at will.
I think there are probably sinister motives behind some of the push to pass keys, but you'd think that if that were true, they would make it really quite easy to add one and to use.
That is not the case. The entire setup/enrollment/add a passkey to your account processing is DMV inspired.
Its a lot easier to track email and phone numbers used across multiple sites than it is passkey used on multiple sites.