265
Passkeys are a trap. Do not use them (nonfunctional.substack.com)
submitted 3 days ago by to c/privacy@lemmy.ml
187 comments fedilink hide all child comments
 

cross-posted from: https://lemmy.bestiver.se/post/1390699

Comments

you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 2 days ago (3 children)

There are already dozens of hardware and software passkey vendors. It's honestly amazing how little lock-in there is.

If my passkeys are spread across dozens of vendors I wouldn't call that good, first of all, it's just a headache.

Secondly, just because there's many of them doesn't mean there's no lock-in. Can I get my passkeys out? Can I migrate them freely between any vendors? Can I take backups for myself from all the vendors? Can I restore the backups into each vendor? Can I replace those vendors with a self-hosted solution?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 2 days ago (2 children)

    If my passkeys are spread across dozens of vendors

    You're picking what vendor you want, not picking unique vendors for every unique passkey.

    Can I get my passkeys out? Can I migrate them freely between any vendors? Can I take backups for myself from all the vendors? Can I restore the backups into each vendor? Can I replace those vendors with a self-hosted solution?

    It depends. It sounds like you just don't like or want hardware-locked/TPM passkeys. If you generate that type of passkey, then no you can't do much of that. Maybe your major complaint is that some major OS's default to hardware-bound passkeys?

    My reference to "vendor" meant to include self-hosted/FOSS solutions.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 2 days ago (1 child)

    You're picking what vendor you want, not picking unique vendors for every unique passkey.

    I don't get to pick anything, in fact. Most often you're told "that's how it is, that's where the passkey goes" and there's nothing you can do about it.

    It sounds like you just don't like or want hardware-locked/TPM passkeys. If you generate that type of passkey, then no you can't do much of that.

    Again, _I_ typically don't get to make that choice, it's being made for me. And that's a problem.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 2 days ago

    I replied to someone else asking the same thing, but we can avoid this infinite-universe syndrome. Which service is forcing a specific passkey provider, and doesn't offer alternatives? I just need an example to understand because I don't know of any and I have been using passkeys for awhile, so I'd appreciate being informed.

  • permalink
  • fedilink
  • source
  • parent