55
Passkeys are a trap. Do not use them. (nonfunctional.substack.com)
submitted 1 day ago by to c/linux@lemmy.ml
45 comments fedilink hide all child comments

all 45 comments

sorted by: hot top controversial new old
[–] 2 points 12 hours ago

Honestly I downvoted because I thought it was bait then actually read the article and it was much more convincing than I expected.

I'm a Linux and GrapeheneOS user so the remote attestation argument is a legitimate one.

Been a big fan of them though, so this does suck.

  • permalink
  • fedilink
  • source
    •
    [–] 48 points 1 day ago (8 children)

    This is such a crazy take. Here’s a major rebuttal from mastodon.

  • permalink
  • fedilink
  • source
  • hideshow 8 child comments
    •
  • [–] 6 points 1 day ago* (5 children)

    Is TOTP always phishable? Like the phisher says "tell me the code in your authenticator app"? But can't say "tell me your passkey?"

    This kind of explains to me why passkeys are so annoying -- they are designed for if you're always going to be using the same device all the time.

    I wish password managers could hold passkeys reliably -- they keep failing for me.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 11 points 1 day ago (1 child)

    Phishing isn't just over the phone. A phishing website that's imitating say a bank website is just as easy to get the TOTP than it is the password.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 15 hours ago*

    That makes a lot of sense. And on the password manager, you have to click through the "use password on new website?" security dialog so often it becomes a nuisance warning and wouldn't protect you from a phishing website, since you're so used to clicking through it.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 20 hours ago (1 child)

    Nobody is (should be) stopping you from enrolling all your devices, and synced passkeys (e.g. iCloud Keyring) are part of the spec.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 15 hours ago

    I am thwarted all the time by having many passkeys enrolled in the password manager, all named "passkey", because the website kept prompting me to make more whenever i logged in. Yet the website still prompts me to "input your security key", ignoring all the saved passkeys.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 37 points 1 day ago (8 children)

    I’m a software engineer, but not a security expert. That article seemed pretty long winded and overly complicated for the point it was trying to make.

    Regardless, I’m not a fan of passkeys as they are currently implemented. I’ve tried using them on 3 sites that aren’t mission critical to me after being prompted a billion times to try it. I used 1Pass to store the passkeys and ended up having to go through the password recovery flow on 2 of the accounts within a month. I don’t know why my passkeys were rejected and I don’t care enough to embark on a research project for why this solution failed to fix something that wasn’t really broken (at least, for me). Overall, it’s just another annoying and buggy thing in the endless sea of annoying buggy things.

  • permalink
  • fedilink
  • source
  • hideshow 8 child comments
    •
  • [–] 14 points 1 day ago

    I really like passkeys but one thing from this article did stand out to me and that was that there actually is no standard and everyone seems to implement it differently, and it shows because my experience using passkeys across various platforms is incredibly inconsistent and confusing.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 8 points 1 day ago (3 children)

    I have passkeys in many sites, but they are never the only sign in option. Username + pass + TOTP keep working as an alternative.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 1 day ago (2 children)

    That wasn’t my experience but maybe 1pass defaults to only keeping one kind of credential per site?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 1 day ago (1 child)

    Maybe. Do passwords vanish after you set up a passkey? I thought you were saying the server refused to sign you in, but it's a bit sketchy if your password manager just chooses to replace secrets behind your back. Especially being different categories (password and passkey).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 day ago*

    I set up a passkey and stored in 1pass, it worked for that 1st attempt. Time passes, I don’t recall if I’ve gone back to the site in the interim. I go to the site again and it errors on my passkey and I can no longer use my password. Thinking about it some more, I think my original password wasn’t deleted from 1pass so I my guess about 1pass being at fault isn’t right. But it’s possible that websites test for storing in iOS, Chrome and whatever the Android default is and anything else working is just luck.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 1 day ago* (2 children)

    A recent 1password update borked something with passkeys. They didn’t work at all for me for a week.

    I have to log in to some things daily with passkeys, so it was really annoying.

    Might be worth trying again, because they now work reliably for me again.

    This is not a ringing endorsement of either passkeys or 1password, but bad releases do happen.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • [–] 13 points 1 day ago (3 children)

    Seriously was the author paid by the word? Also even though I believe their main point is valid, they employ more than one Straw Man argument in conveying their reasoning. Nevertheless I have been opting out of passkeys since I first saw them for the simple reason that I was being told by sites and apps that I should use them - and I know that no company ever advises you to do something that’s in your own best interest. Therefore I didn’t trust by default. lol.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 1 point 8 hours ago

    and I know that no company ever advises you to do something that’s in your own best interest.

    Why do they warn against phising, why do they give you the option to recover your account, why do they try to prevent scams?

  • permalink
  • fedilink
  • source
  • parent
    • [–] 9 points 1 day ago* (2 children)

    Passkeys big bonus is that they are far more phish-resistant than pretty much any other MFA out there.

    Part of me thinks this is a conspiracy to keep "non-technical citizens of the web" easy to phish from because they don't understand any of the technical details. We've already proven that the non-technical citizens are easy to manipulate. This is basically just low-level social-engineering.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] [S] 5 points 23 hours ago

    Passkeys big bonus is that they are far more phish-resistant than pretty much any other MFA out there.

    How do you recover if you lose a passkey? By a link in an email sent to you?

    These things are not safer than the weakest link in your chain. And not easier to recover than the hardest link in your chain. With a bit bad luck, you get something that is easy to hack, and impossible to recover.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 11 points 1 day ago

    https://hachyderm.io/@rmondello/117428258722253709

  • permalink
  • fedilink
  • source
    •
    [–] [S] 5 points 1 day ago (16 children)

    Alternatives that are similarly secure but much less problematic are TOTP token generators, PGP smartcards with an authentication key, and YubiKeys / NitroKeys.

  • permalink
  • fedilink
  • source
  • hideshow 16 child comments
    •
  • [–] 8 points 1 day ago (6 children)

    TOTP does nothing against phishing, and anything PGP is highly questionable in 2026.

    But, I agree about the FIDO U2F keys.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 4 points 1 day ago (4 children)

    why is PGP questionable ?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 1 day ago* (last edited 20 hours ago) (7 children)

    Good luck getting the masses to adopt them. Passkeys seem like an improvement on trying to get your average meat brain to remember several unique passwords.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 4 points 1 day ago*

    I just can’t communicate why or how an average user should use passkeys.

    I use them, I like them even, they’re a decently easy flow with good trust boundaries.

    Yes, passkeys are hard/impossible to phish, but the fallback flows are exactly as easy to phish as passwords today and are basically a requirement if you implement passkeys.

    I can’t recommend using passkeys in Chrome’s password manager, for lock in and portability reasons (plus every browser should have an ad blocker). I can’t recommend the OS based ones because frankly nobody should install windows anymore, and macOS is on the precipice of enshittification. That just leaves password managers, which I think are a good idea, but also a single point of failure.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 1 day ago (5 children)

    You know, you're 100% right. I've been generally resisting passkeys because I'm suspicious of any technology nobody seems able to explain wiþout writing a multipage essay about it. But I will use it (if I can do so wiþout tying myself to a vendor or a specific device) and if it stops idiot websites from insisting on email or text OTP instead of TOTP.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 2 points 1 day ago* (2 children)

    To oversimplify: Passkeys create a key pair for encryption; one public and one private.

    You give the server your public key. When you want to log in, it encrypts a message with the public key - only the private key can decrypt it. Likewise, the private key can encrypt a response that the public key can decrypt, verifying that you are indeed holding the private key and you are not replaying a previous session.

    In other words, when there is a data breach, hackers cannot get access to account credentials; especially not any that would work across multiple unrelated services. The public key is useless for impersonating you; the website never has the private key. A password is probably used on every single website a person visits. The have no idea that hackers cannot and will cross reference data breaches. They think “what are they gonna do with MY account? I don’t have anything on there!” Their perspective is limited.

    Just don’t get your master password phished.

    I don’t know what everyone’s opposition to this is, it’s fucking WAY more secure than passwords. Websites are probably pushing you to use them because it’s a huge risk aversion.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 18 hours ago

    Why does no one describe is as asymmetric encryption? Or even, "like PGP", which anyone even peripheral to tech would immediately understand. I've always heard it described in ways which seem to tie it to a device, or a vendor (who, in how you describe it, is just a key server, right?) like Google, or MS, or Apple. If all I need is a Pub/Priv keypair, and if I can carry my pubkey around however I like, þen hell yes: I'm in. As long as I'm not forced to use Javascript to log in, perfect!

  • permalink
  • fedilink
  • source
  • parent
    • [–] 2 points 1 day ago

    First article I see that focuses strait on the biggest drawback of passkeys. Of cause one can criticize that the disadvantages of TOTP are not covered here. That does not make the argument invalid though.

  • permalink
  • fedilink
  • source
    •