4mo ago

Passwords have problems, but passkeys have more

world.hey.com Passwords have problems, but passkeys have more

We had originally planned to go all-in on passkeys for ONCE/Campfire, and we built the early authentication system entirely around that. It was not a simple setup! Handling passkeys properly is surprisingly complicated on the backend, but we got it done. Unfortunately, the user experience kinda suck...

cross-posted from: https://feditown.com/post/744772

Technology @beehaw.org

exu @feditown.com

4mo ago

Passwords have problems, but passkeys have more

world.hey.com /dhh/passwords-have-problems-but-passkeys-have-more-95285df9

63 17

Technology @lemmy.world

exu @feditown.com

4mo ago

Passwords have problems, but passkeys have more

world.hey.com /dhh/passwords-have-problems-but-passkeys-have-more-95285df9

270 187

You're viewing a single thread.

14 comments

I'd be interested in a discussion of his points here :) those sound like valid points he's making
- edit: I think I’ve misunderstood the point of the article. He is saying passkeys are dangerous for people without password managers, therefore for most people passwords are still better (since most people don't use password managers). It's not so much a problem with passkeys, but the lack of password managers.
  Even in the best case scenario, where you're using an iPhone and a Mac that are synced with Keychain Access via iCloud
  Surely the better-case scenario would be using a password manager?
  The article doesn't address the recommended use-case of passkeys + password manager, which makes it kind of irrelevant.
  
  But that is exactly what he recommends, using a password manager - with one time email authentication for the first login as an extra step, right?
  
  edit: I think I've misunderstood the point of the article. In a non-obvious (to me at least) way, he is saying passkeys are dangerous for people without password managers, therefore for most people passwords are still better.
  
  But that is exactly what he recommends, using a password manager - with one time email authentication for the first login as an extra step, right?
  Nope.
  Using a cross-platform password manager with synced passkeys is different and much more secure than using a password manager with email TOTPs or sign-in links with emails that aren’t end-to-end encrypted.
  And password manager adoption is much higher than PGP keyserver adoption, and if you can’t discover someone’s public key you can’t use it to encrypt a message to them, so sending end-to-end encrypted emails with TOTPs/sign-on links isn’t a practical option.
  According to Statista, 34% of Americans used password managers in 2023 (a huge increase from 21% in 2022), so it’s not even like the best case scenario is rare.

14 comments