55
Passkeys are a trap. Do not use them. (nonfunctional.substack.com)
submitted 1 day ago by to c/linux@lemmy.ml
45 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 8 points 1 day ago (3 children)

I have passkeys in many sites, but they are never the only sign in option. Username + pass + TOTP keep working as an alternative.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 1 day ago (2 children)

    That wasn’t my experience but maybe 1pass defaults to only keeping one kind of credential per site?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 1 day ago (1 child)

    Maybe. Do passwords vanish after you set up a passkey? I thought you were saying the server refused to sign you in, but it's a bit sketchy if your password manager just chooses to replace secrets behind your back. Especially being different categories (password and passkey).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 day ago*

    I set up a passkey and stored in 1pass, it worked for that 1st attempt. Time passes, I don’t recall if I’ve gone back to the site in the interim. I go to the site again and it errors on my passkey and I can no longer use my password. Thinking about it some more, I think my original password wasn’t deleted from 1pass so I my guess about 1pass being at fault isn’t right. But it’s possible that websites test for storing in iOS, Chrome and whatever the Android default is and anything else working is just luck.

  • permalink
  • fedilink
  • source
  • parent