They really aren’t a trap. They’re a well designed standard. The tooling around them isn’t quite perfect yet, but they’re a huge improvement over passwords.
The trap is they’re pushing passkeys before password managers that make them portable are yet to be mainstream. And that platform lock in may be a motive driving it.
“To login to your account, please use the device assigned to your identity.”
Right now, if someone who doesn’t know about password managers starts using passkeys because of a few popups you just have to follow through to enroll, they’re going to get very confused when they try to login somewhere else. There may be alternative login methods for now, but that may change.
It doesn’t seem all that forced yet, but if we have any idea of how big tech works, that’s where it is going.
Passkeys are great, Big tech aren’t.
I use them with my password manager but I’m cautious on which services and how often i may need to login to them on other devices.
I would say the people hate it, because they are exposed to the tooling and not the standard.
The standard might be the best there is, if the tooling is shit people won’t use it. And once you’ve been exposed to bad tools you make the connection between tools bad = passkey bad because they don’t know there’s a difference…
People upvote because big tech has a tendency of forcing the most anti ownership outcome possible on everyone. Here, such an outcome likely would be mandatory passkeys that are set up to require hardware attestation.
One way to reduce that risk is to boycott passkeys until TPM and hardware attestation are removed from the standard. You may not think that’s a fair response, or that such a boycott won’t save us from the inevitable outcome, but nevertheless it’s not a completely irrational reaction.
And also until the committee designing it has it members on it representing the interests of users. The point that this was lacking in the original is-a-trap article is an important one and is also being missed.
I’m just not convinced that mandatory hardware attestation is actually a real problem we need to worry about.
Like, yes, people with high security jobs will have that for sure. And they should.
But large companies that want customers? They want to make it as easy as possible for their customers to connect. They’re not going to force people to have a hardware device which if damaged or lost will lose them a customer. That’s just not what they want.
Embrace, extend, extinguish as in literally every single corporate case. Thousands of rug pulls later and we still haven’t learned our lesson.
In this case: first get people in the door en masse, then expand the requirements for things like hardware attestation in a transition period, then vendor lock people.
Adobe would never move to cloud only, that would lose them customers.
See: Literally every single API rug pull ever. Reddit, Unity, etc… Get people using the API and infrastructure, then switch from free to huge fees.
See: cloud companies giving good deals for storage and then charging massive fees for output bandwidth to access or move that data
See: VMware rug pull
This is the exact same except they are telling us what they are going to do from the start. When someone tells you how shitty they are, listen.
I only dislike the ability for service providers to enforce a “security level”. Those should be the exclusively under my (the user) control. Sending preferred default (hints) would be cool, but not enforcement.
That a webpage can basically prevent me from using a passkey if the passkey is stored in software (a password manager for example) is complete bullshit. Especially if there is still username/password as alternative which is clearly worse. Sure, hardware tokens are the ultimate security. But it should be up to me and not them if I want that level of security.
But they already do enforce a “security level” for passwords through minimum character counts (e.g. must be at least 8 characters long), specific character requirements (e.g. at least one upper case + lower case + number), rotation schedules (e.g. must be changed every 90 days), etc. Some even enforce password sharing (e.g. Netflix IP/geolocation checks).
Yeah and certain password requirements are also dumb. But at least they still give me a degree of freedom how to generate the password and how I store the password.
Second factor is sometimes worse than Passkeys; with vendor specific apps (Steam Guard, Blizzard Authenticator, Microsoft Authenticator, etc) instead of following standard TOTP. But still. I want agency over my credentials.
This has actually been a really good discussion on both sides as I think many including myself didn’t know about some of the inner workings of them. I’m glad the discussion happened. The trap article IS worth a read, it’s overly long but is really well written. After reading enough about both sides though I don’t think I’m too worried and will continue using them.
I fucking love passkeys. I hate 2FA on every god damn website, but clearly the majority of people are too lazy/stupid for passwords alone to work in a time when phishing is so widespread. My only problem with them was that I couldn’t use my Bitwarden passkeys in Firefox for Android, but they fixed that, and I’ve never had a bad experience with a passkey since.
They really aren’t a trap. They’re a well designed standard. The tooling around them isn’t quite perfect yet, but they’re a huge improvement over passwords.
People upvote because they hate change.
The trap is they’re pushing passkeys before password managers that make them portable are yet to be mainstream. And that platform lock in may be a motive driving it.
“To login to your account, please use the device assigned to your identity.”
Right now, if someone who doesn’t know about password managers starts using passkeys because of a few popups you just have to follow through to enroll, they’re going to get very confused when they try to login somewhere else. There may be alternative login methods for now, but that may change.
It doesn’t seem all that forced yet, but if we have any idea of how big tech works, that’s where it is going.
Passkeys are great, Big tech aren’t.
I use them with my password manager but I’m cautious on which services and how often i may need to login to them on other devices.
I would say the people hate it, because they are exposed to the tooling and not the standard.
The standard might be the best there is, if the tooling is shit people won’t use it. And once you’ve been exposed to bad tools you make the connection between tools bad = passkey bad because they don’t know there’s a difference…
People upvote because big tech has a tendency of forcing the most anti ownership outcome possible on everyone. Here, such an outcome likely would be mandatory passkeys that are set up to require hardware attestation.
One way to reduce that risk is to boycott passkeys until TPM and hardware attestation are removed from the standard. You may not think that’s a fair response, or that such a boycott won’t save us from the inevitable outcome, but nevertheless it’s not a completely irrational reaction.
And also until the committee designing it has it members on it representing the interests of users. The point that this was lacking in the original is-a-trap article is an important one and is also being missed.
This is what people seem to be missing, I haven’t seen a rebuttal to this problem.
I’m just not convinced that mandatory hardware attestation is actually a real problem we need to worry about.
Like, yes, people with high security jobs will have that for sure. And they should.
But large companies that want customers? They want to make it as easy as possible for their customers to connect. They’re not going to force people to have a hardware device which if damaged or lost will lose them a customer. That’s just not what they want.
And yet, it’s there.
Embrace, extend, extinguish as in literally every single corporate case. Thousands of rug pulls later and we still haven’t learned our lesson.
In this case: first get people in the door en masse, then expand the requirements for things like hardware attestation in a transition period, then vendor lock people.
Adobe would never move to cloud only, that would lose them customers.
See: Literally every single API rug pull ever. Reddit, Unity, etc… Get people using the API and infrastructure, then switch from free to huge fees.
See: cloud companies giving good deals for storage and then charging massive fees for output bandwidth to access or move that data
See: VMware rug pull
This is the exact same except they are telling us what they are going to do from the start. When someone tells you how shitty they are, listen.
I only dislike the ability for service providers to enforce a “security level”. Those should be the exclusively under my (the user) control. Sending preferred default (hints) would be cool, but not enforcement.
That a webpage can basically prevent me from using a passkey if the passkey is stored in software (a password manager for example) is complete bullshit. Especially if there is still username/password as alternative which is clearly worse. Sure, hardware tokens are the ultimate security. But it should be up to me and not them if I want that level of security.
But they already do enforce a “security level” for passwords through minimum character counts (e.g. must be at least 8 characters long), specific character requirements (e.g. at least one upper case + lower case + number), rotation schedules (e.g. must be changed every 90 days), etc. Some even enforce password sharing (e.g. Netflix IP/geolocation checks).
Yeah and certain password requirements are also dumb. But at least they still give me a degree of freedom how to generate the password and how I store the password.
Second factor is sometimes worse than Passkeys; with vendor specific apps (Steam Guard, Blizzard Authenticator, Microsoft Authenticator, etc) instead of following standard TOTP. But still. I want agency over my credentials.
This has actually been a really good discussion on both sides as I think many including myself didn’t know about some of the inner workings of them. I’m glad the discussion happened. The trap article IS worth a read, it’s overly long but is really well written. After reading enough about both sides though I don’t think I’m too worried and will continue using them.
I fucking love passkeys. I hate 2FA on every god damn website, but clearly the majority of people are too lazy/stupid for passwords alone to work in a time when phishing is so widespread. My only problem with them was that I couldn’t use my Bitwarden passkeys in Firefox for Android, but they fixed that, and I’ve never had a bad experience with a passkey since.