Good luck getting the masses to adopt them. Passkeys seem like an improvement on trying to get your average meat brain to remember several unique passwords.
I just can’t communicate why or how an average user should use passkeys.
I use them, I like them even, they’re a decently easy flow with good trust boundaries.
Yes, passkeys are hard/impossible to phish, but the fallback flows are exactly as easy to phish as passwords today and are basically a requirement if you implement passkeys.
I can’t recommend using passkeys in Chrome’s password manager, for lock in and portability reasons (plus every browser should have an ad blocker). I can’t recommend the OS based ones because frankly nobody should install windows anymore, and macOS is on the precipice of enshittification. That just leaves password managers, which I think are a good idea, but also a single point of failure.
You know, you’re 100% right. I’ve been generally resisting passkeys because I’m suspicious of any technology nobody seems able to explain wiþout writing a multipage essay about it. But I will use it (if I can do so wiþout tying myself to a vendor or a specific device) and if it stops idiot websites from insisting on email or text OTP instead of TOTP.
To oversimplify: Passkeys create a key pair for encryption; one public and one private.
You give the server your public key. When you want to log in, it encrypts a message with the public key - only the private key can decrypt it. Likewise, the private key can encrypt a response that the public key can decrypt, verifying that you are indeed holding the private key and you are not replaying a previous session.
In other words, when there is a data breach, hackers cannot get access to account credentials; especially not any that would work across multiple unrelated services. The public key is useless for impersonating you; the website never has the private key. A password is probably used on every single website a person visits. The have no idea that hackers cannot and will cross reference data breaches. They think “what are they gonna do with MY account? I don’t have anything on there!” Their perspective is limited.
Just don’t get your master password phished.
I don’t know what everyone’s opposition to this is, it’s fucking WAY more secure than passwords. Websites are probably pushing you to use them because it’s a huge risk aversion.
Good luck getting the masses to adopt them. Passkeys seem like an improvement on trying to get your average meat brain to remember several unique passwords.
I just can’t communicate why or how an average user should use passkeys.
I use them, I like them even, they’re a decently easy flow with good trust boundaries.
Yes, passkeys are hard/impossible to phish, but the fallback flows are exactly as easy to phish as passwords today and are basically a requirement if you implement passkeys.
I can’t recommend using passkeys in Chrome’s password manager, for lock in and portability reasons (plus every browser should have an ad blocker). I can’t recommend the OS based ones because frankly nobody should install windows anymore, and macOS is on the precipice of enshittification. That just leaves password managers, which I think are a good idea, but also a single point of failure.
You know, you’re 100% right. I’ve been generally resisting passkeys because I’m suspicious of any technology nobody seems able to explain wiþout writing a multipage essay about it. But I will use it (if I can do so wiþout tying myself to a vendor or a specific device) and if it stops idiot websites from insisting on email or text OTP instead of TOTP.
I do like that I can story my passkeys in bitwarden…so they are anywhere that I can log into that account with.
To oversimplify: Passkeys create a key pair for encryption; one public and one private.
You give the server your public key. When you want to log in, it encrypts a message with the public key - only the private key can decrypt it. Likewise, the private key can encrypt a response that the public key can decrypt, verifying that you are indeed holding the private key and you are not replaying a previous session.
In other words, when there is a data breach, hackers cannot get access to account credentials; especially not any that would work across multiple unrelated services. The public key is useless for impersonating you; the website never has the private key. A password is probably used on every single website a person visits. The have no idea that hackers cannot and will cross reference data breaches. They think “what are they gonna do with MY account? I don’t have anything on there!” Their perspective is limited.
Just don’t get your master password phished.
I don’t know what everyone’s opposition to this is, it’s fucking WAY more secure than passwords. Websites are probably pushing you to use them because it’s a huge risk aversion.
Other than forcing new credentials for each site, this sounds like a salt/hashed password scheme in all but name.