"Something you have"/"device bound" is not what I want if I don't control it. In the case of passkeys, I don't have access to the private key, so I consider that not controllable by me.
I'm happy to be wrong if I am able to extract and import the private keys (it's what I do with TOTP now), but my understanding is designers of passkeys explicitly don't want users access to their own privkeys so they can tie them to physical objects. I get that, I don't want that.
So passkeys are not something I'll ever use or useful or convenient to me.
In my experience, for most basic services, Passkeys are absolute overkill: Your ability to recover your account without too much hassle usually beats having a key explicitely tied to physical hardware (even worse, your phone that you carry around in public). Besides, passkeys are also often used by companies like Microsoft to peddle their apps, because of course you have to have specific apps for it.
Makes me all feel like passkeys are largely a convenient security excuse for vendor lock-in and siphoning personal information. OTP-Generators seem to be more generally applicable and less phone or company-bound.
>even worse, your phone that you carry around in public
Sorry to attach on to such a small part of your comment. Why do you think having it attached to your phone is worse? In my understanding phones are WAY more secure than any run of the mill laptop or desktop due to a variety of security measures like sandboxing, encryption by default, and secure elements. If I came home to a break in I would be way less nervous about them swiping my phone than my desktop.
Passkeys aren't tied to physical hardware. They're tied to your password manager. Passkeys are just passwords that require a password manager.
On Windows, macOS, iOS, and Android, there's a cloud-based password manager built into the operating system, so you can use your passkey anywhere you use that password manager.
Microsoft, Apple, Google, 1Password, and Bitwarden all have password-manager apps for Windows, macOS, iOS, and Android.
Pick a password manager and use the same one everywhere, and your passkeys will be available wherever you go.
On the other hand, all the little services I'm building for myself are passwordless and use passkeys with emailed codes for setup/reset.
Passwords were a really poor solution to the problem of security, they didn't take the human factor into account. After a rocky start, I'm now finding passkeys super easy and convenient to use. Far more convenient than OTP codes.
I appreciate that if you're OS/browser doesn't integrate nicely with passwords you might be in for a bad time. I'm having a great time with 1Password, though I believe native apple handles them nicely now too – and I suspect this is true of any modern password manager (even the ones built into the browser).
Passkeys are a solid idea in theory - in practice they are a confusing mess. Basic users are incredibly confused by them. My recommendation still continues to be a very strong password + app based MFA.
I sometimes consider the number of man-hours wasted every year by companies (such as Amazon and Dropbox) that repeatedly offer to convert passwords to passkeys, despite having already been declined (once, or even dozens or hundreds of times).
This reminds me of the number of man-hours wasted on logging in into Microsoft accounts - bonus points for "No, this app only" being hit after the session timeout of the login session so you have to log in _again_. (instead of being able to make that decision any time you like, because, you know, you've already authenticated yourself)
"Something you have"/"device bound" is not what I want if I don't control it. In the case of passkeys, I don't have access to the private key, so I consider that not controllable by me.
I'm happy to be wrong if I am able to extract and import the private keys (it's what I do with TOTP now), but my understanding is designers of passkeys explicitly don't want users access to their own privkeys so they can tie them to physical objects. I get that, I don't want that.
So passkeys are not something I'll ever use or useful or convenient to me.
In my experience, for most basic services, Passkeys are absolute overkill: Your ability to recover your account without too much hassle usually beats having a key explicitely tied to physical hardware (even worse, your phone that you carry around in public). Besides, passkeys are also often used by companies like Microsoft to peddle their apps, because of course you have to have specific apps for it.
Makes me all feel like passkeys are largely a convenient security excuse for vendor lock-in and siphoning personal information. OTP-Generators seem to be more generally applicable and less phone or company-bound.
>even worse, your phone that you carry around in public
Sorry to attach on to such a small part of your comment. Why do you think having it attached to your phone is worse? In my understanding phones are WAY more secure than any run of the mill laptop or desktop due to a variety of security measures like sandboxing, encryption by default, and secure elements. If I came home to a break in I would be way less nervous about them swiping my phone than my desktop.
Passkeys aren't tied to physical hardware. They're tied to your password manager. Passkeys are just passwords that require a password manager.
On Windows, macOS, iOS, and Android, there's a cloud-based password manager built into the operating system, so you can use your passkey anywhere you use that password manager.
Microsoft, Apple, Google, 1Password, and Bitwarden all have password-manager apps for Windows, macOS, iOS, and Android.
Pick a password manager and use the same one everywhere, and your passkeys will be available wherever you go.
Passkeys “done right” via Apple Keychain however it does it seems to work well enough for the normies.
Being able to sign in with touchID is amazing
On the other hand, all the little services I'm building for myself are passwordless and use passkeys with emailed codes for setup/reset.
Passwords were a really poor solution to the problem of security, they didn't take the human factor into account. After a rocky start, I'm now finding passkeys super easy and convenient to use. Far more convenient than OTP codes.
I appreciate that if you're OS/browser doesn't integrate nicely with passwords you might be in for a bad time. I'm having a great time with 1Password, though I believe native apple handles them nicely now too – and I suspect this is true of any modern password manager (even the ones built into the browser).
Passkeys are a solid idea in theory - in practice they are a confusing mess. Basic users are incredibly confused by them. My recommendation still continues to be a very strong password + app based MFA.
I sometimes consider the number of man-hours wasted every year by companies (such as Amazon and Dropbox) that repeatedly offer to convert passwords to passkeys, despite having already been declined (once, or even dozens or hundreds of times).
This reminds me of the number of man-hours wasted on logging in into Microsoft accounts - bonus points for "No, this app only" being hit after the session timeout of the login session so you have to log in _again_. (instead of being able to make that decision any time you like, because, you know, you've already authenticated yourself)
For a company this may be a good idea, but for consumers this is a nightmare. It will be so easy to get locked out of your account.
wordy ad
Good point.