293
Passkeys Explained: The End of Passwords (sentientrant.com)
submitted 10 months ago by to c/technology@lemmy.world
225 comments fedilink hide all child comments
 

Passkeys are built on the FIDO2 standard (CTAP2 + WebAuthn standards). They remove the shared secret, stop phishing at the source, and make credential-stuffing useless.

But adoption is still low, and interoperability between Apple, Google, and Microsoft isn’t seamless.

I broke down how passkeys work, their strengths, and what’s still missing

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 10 months ago (2 children)

I use them with bitwarden and a self hosted vaultwarden. If my phone breaks, no issue. If my server breaks, I got local backups.... Keys are stored encrypted in a postgres database for which I have access, if I need to restore it. No lock-in issue or risk of loosing access when one or two devices break.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 10 months ago (1 child)

    That sounds great, but also isn't a solution for most people.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 10 months ago*

    True. But most good stuff isn't a solution for everyone. It takes real effort to escape vendor-lockin. Bigtech made sure of that.

    If something is too simple to set up or requires no set up, or comes from a for-profit company, but doesn't cost anything, then it always suspicious.

    I am just saying that the issue is not with passkey itself, but the individual implementations and that google/twitter/etc. is pushed towards regular users.

    Critiquing passkey because vendor-lockin is like critiquing HTML for allowing ads.

  • permalink
  • fedilink
  • source
  • parent