411
I don't like passkeys | Ethan Hawksley (hawksley.dev)
submitted 2 weeks ago by to c/technology@lemmy.world
171 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 36 points 2 weeks ago (15 children)

Good article.

Currently passkeys are too much of a vendor lock-in to big tech.

Bitwarden support alone does not change that.

  • permalink
  • fedilink
  • source
  • hideshow 15 child comments
    •
  • [–] 23 points 2 weeks ago (5 children)

    I agree the passkey user experience needs work, but man do I enjoy it over the haphazard 'passwordless' website login that just sends you an email.

    I get it, they're just skipping an attack vector and basically relying only on '2FA'. But now I have to go to a different app/tab, copy a code, and return to the site instead of letting the password manager fill stuff in for me. Some, like kickstarter, let you still have a 2FA code enabled so you have to grab your code from whichever authenticator and go to your email. Really nice login experience out of nowhere one day. \s

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 2 points 2 weeks ago (4 children)

    The best implementation of this I've seen has to be Ghost, an open source self-hostable newsletter/patreon thing. They detect what email provider you have and when you enter your email, will display a link to open your inbox. It's super neat, and I haven't seen it anywhere else, and I'm also not sure how they do it. For something self-hostable, I'll definitely take one less attack vector.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 3 points 2 weeks ago (1 child)

    A DNS lookup on a domain says who runs the email server for email users on that domain (that's how email senders figures out how to send you messages), and if that host is a known one then you can just pull the link to show. If you're self hosting email then a few solutions can be recognized and login shown by guessing that the email software's default URL pattern is used.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 22 points 2 weeks ago (5 children)

    Microsoft 365 implementation of passkeys is sacrilegious somehow.

    It requires only the Authenticator app from Microsoft and can use nothing else to create the passkey. The way this is implemented on iOS means that Authenticator comes up as an autofill option BUT IT ONLY SUPPORTS M365 and is useless for anything else. Leave it to Microsoft to take an open standard and bastardize it to the point of it being MORE CONVENIENT to just type a damn password.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 2 points 2 weeks ago (1 child)

    The authenticator requirement was for regular MFA, with passkey you can use others like yubikey. BUT your admin can lock it to certain vendors so they could have selected Microsoft only.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 weeks ago (2 children)

    Wait, you type passwords? KeePassXC's auto-type awaits!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 weeks ago (2 children)

    bitwarden went from working great to buggy on browsers. sometimes the browser passes the request to the extension but most times goes to the os

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •