Decades and decades of defunding education while damaging the people's ability to think critically with a neverending flood of brain-rot?

Ich hab nicht gesagt, dass du nicht klagen sollst. Nur darf das doch bitte nicht zum Normalzustand werden.

Because of this discussion (and because I hadn't looked at passkeys for quite a while), I did some testing...

And passkeys integrate seamlessly into my keepassXC to get backed up with all my regular passwords. So software- instead of device-based passkeys that can be properly transfered, synced or backed up work...

The problem is that tech-minded people that use password managers and think about security and backups are not the primary target group that passkeys should protect from every-day phishing attempts in the first place. And when it's supposed to protect the common user effectively and conveniently/frictionless but then instantly destroys the effect by advising to set up another login method it makes no sense.

Weder sollte gegen die Regierung klagen müssen das normale Vorgehen sein, noch sind derartige Klagen sonderlich erfolgreich. Wie oft wurde beispielsweise jetzt schon gerichtlich festgestellt, dass unser Innenminister rechtswidrig handelt, und wie viel hat das noch gleich an den illegalen Grenzkontrollen geändert?

Yes I can backup a software one. But that's not the point. Passkeys are advertised as the future for common people as they eliminate the biggest issues: phishing.

But then they don't advise people to use software passkeys, back them up and keep them save. Instead they tell them to configure an alternative/recovery login alongside the passkey should it be lost or damaged.

They take a security feature, instantly remove the additional security and make it into a "you don't need to remember and type your password"-convenience thing. Yeah, great. A password manager could've already provided that convenience.

So in the end those more technically-minded that will look at this and decide to use a software passkey so they can back it up will get some additional security they need much less (they are not the primary target group for phishing), and some convenience they already had (because they are already using a password manager).

Passkeys aren't controversial because they are bad. They aren't. They are controversial because the actual way they are used makes zero sense for the purpose of added security. Which raises the question what the actual goal is.

Passkeys are a good idea to prevent phishing. Using passkeys but then require a second method to login as a backup to prevent lockout when you lose your key (as many sites do) is epic bullshit. It makes an actual security improvement into some convenience feature so people don't need to remember/type passwords anymore. Because the phishing will now ask for the alternative/recovery login to fix some alleged problem with your account/passkey...

So it suddenly does not provide additional security anymore above what a password manager would already do.

When you sell somehting as a security feature then instantly defeat the additional security to make it just about convenience the question about the actual goal feels natural...

It's mainly controversial because the actual use contradicts its purpose. Passkeys are phishing-resistent, which is still the main risk for password in real world scenarios, and are a good idea.

But the websites supporting it put out big warnings when you don't have another method to login configured. And they don't actually advise you how to backup your passkey and keep it safe, but instead want you to set up an alternative way to login or recover your account. Which totally defeats the purpose in the first place.

Quite the contrary: "there is a problem with your passkey/account, please use the recovery method you set up" even makes for more convincing phishing. So why are they pushing for passkeys when it isn't for security reasons?

A passkey is cryptographically signed by the server when it's created.

So it does not only has your credentials encrypted which are then used to login to a server, but it also carries information about the server and only that server can request the credentials from the passkey. So unlike a password a passkey is resistent to phishing attempts as you can't actually give your credentials away to anyone but the actual server it was created for.

Die meisten waren schon erfolglos, bevor sie an rechte Influencer geraten sind, die ihnen erklärt haben, dass es gar nicht an ihnen liegt und wie sie es ändern können...

Passkeys fix a different problem.

In my eyes the problem is that passkeys do not fix a problem. They just shift it to another layer...

I can backup a password however I like. I can backup a TOTP authenticator (or specifically the secret that works with every one of them) however I like.
I can not however backup a hardware device with my passkey.

And the websites supporting passkeys obviously know it and explicitly warn when you don't have an alternative way of logging in configured as it's possible that simple hardware damage or loss locks you out of your account. Thus the "fix for a problem" is now relegated to a shiny new way of conveniently pressing the button on a key instead of typing and remembering passwords, while the actual attack surface is still there but now sitting in alternative login/account recovery instead.

I want a key I can backup, even emulate if I want too

This actually seems possible... https://codeberg.org/r4gus/PassKeeZ

Also keepassXC works with passkeys for quite some time.

Was meinst du mit "sehen"? Die orientieren sich nicht an der EU-Entwicklung, sondern sind die treibende Kraft dahinter. Und da nicht erst seit gestern, sondern spätestens seit Zensursula nach dem Scheitern ihrer Zensur- und Überwachungsphantasien hier zu lande, an die EU weitergereicht wurde, um dort das selbe nochmal zu versuchen.