Too bad. Passkeys are a pretty good thing and are an enhancement over passwords… but big tech is doing their thing again.
Corporations want what they’re terming phishing-resistant passkeys, which have two approaches: hardware-based or synchronized passkeys. If they are forced upon us for certain services or jobs, the least harmful to a worker is a synchronized passkey. Password managers like Bitwarden support this, so that you don’t have vendors and employers tracking your cell phone. If an employer uses something like Microsoft, the administrator settings may not allow synchronized passkeys…but at least we can advocate for them when these auth methods are forced upon us.
Passkeys give me anxiety because it’s like “Hope you can go the rest of your life without a phone or USB drive getting lost or stolen LMAO”
So it’s HDMI for login? Thanks, I hate it.
Yeah the technology is cool but I stay away from passkeys and tell people not to use them because there’s too much room to permanently screw up.
Maybe they’ll remove the non portable type from the spec or roll it into an enterprise equivalent like with ad.
As far as I know using a password manager such as KeePassXC or Bitwarden solves all of these problems?
The way i understand it is that remote attestation (main point of this article) makes it possible for services to deny unapproved software. They can deny off market devices, operating systems, or certain password managers. So even if you use password managers you mentioned, if you’re using off market OS (e.x lineageos) they can deny access. Here’s a quote from the article “Remote attestation lets a website demand cryptographic proof that your device, operating system, firmware, and passkey manager are all on an approved list.”
Hm, so similar to websites blocking user agents now.
Make that question mark a period, good sir/ma’am!
An attempt to make an image describing where passkeys live:
It’s funny because I can’t see it and when I view the code of your post and copy/paste it into the location bar I get the broken jpeg picture.
Edit: At the time of upload it was a png. I guess lemmy.zip made the choice to convert it.
I wasn’t able to see the image because it’s an avif. What a weird format and choice of format.
Apropos of a discussion about over complicated unpredictable passkey behavior.
dude speaks about not being able to write down his passkey, then he acts like it can only be saved in bigtech clouds, then some random ai rumbling starts about ads being show to us? can you guys stop posting these god damn fearmongering password articles written by ai?
That seems to miss the main point of the article, which is that Passkey standard has attestation procedure built in. A site that uses Passkey can verify the flags you set and deny your access if you use unapproved device, operating system, old kind of secure chip or, say, allow your passkey to be shared between devices.
Please just stop using a service when it gets unbearable. There is no online service you -need- except maybe bank and tax stuff.
The problem isn’t you or me, the more technically aware… it’s when the majority of users switched to passkeys and then subtly get switched to attested passkeys and sites don’t offer other choices. Once the majority are under-thumb, sites won’t have a reason to offer open solutions to the same number of objectors.
And for the bank, you can always switch to a better bank.
This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites. But the FIDO Alliance standard makes attestation a part of the passkey ecosystem, whether you want it or not. And even if the website doesn’t require attestation now, simply by using passkeys you indicate to the website that your setup supports the FIDO Alliance’s passkey standard and that you as a user are capable of using passkeys.9 This means that once Twitter (formally X) is satisfied that the overwhelming majority of its users would be unaffected, they can flip the switch – perhaps not all at once, perhaps just for ten thousand users at a time so as not to cause a fuss – and start rejecting non-attested passkeys.
Critically, remote attestation requires the co-operation of your cryptoprocessor, your passkey manager software, your device’s operating system, and your device’s firmware to all pass the remote attestation check. After all, your phone’s operating system has total access to all the 0s and 1s in every app that’s ever run, so it’s not enough for Twitter (formally X) to trust your passkey manager if it can’t even trust your phone’s underlying operating system. If any single one of those things were to fail – say, because your phone stopped receiving security updates so you installed a custom operating system like LineageOS to keep yourself safe without having to buy a new device – then Twitter (formally X) will be able to notice and prevent you from logging in.
Remote attestation can allow them to verify that your device is not capable of, say, sending and receiving encrypted messages, or running a competitor’s app, or using social media without verifying your ID. They don’t want you to be able to turn off the mandatory built-in AI image scanner on your phone that scans everything your phone sees for nudity. (Yes, I’m serious.)
The convenience of using passkeys is a double-edged sword.
This is also one of the ways Playstation stops you from installing Linux and other unauthorised software on the PS5.
It’s wild seeing people spaz out over passkeys, clearly venting at something that isn’t passkeys.
I suspected as much, being shoved on us like AI.
Zero trust is the end station, if you allow organizations to treat your personal devices as being theirs. Organizations that could actually benefit from the increased security (which isn’t Twitter, except for some high-profile individuals, maybe), should provide the user with resources to do so, at their expense (issuing a dedicated TOTP device for example).
But what tends to happen instead, is enshittification of service, while offloading it onto the client. A similar trend can be observed with car parking: where operators remove parking meters, and require the customer to use their device and data plan, to make a payment to the operator…
We’ve been on this trajectory for quite a while now: from Outlook enforcing IT-policies of email administrators (dictating screen locking requirements as device administration app), to SMS-based 2FA requiring one to have a mobile phone number and tying all to this tamper-resistant identifier. So why not a black box snitch, paid for by the client, further restrict their freedom for “security”?
It seems perfectly in line, and I think this article draws all the right parallels.
Passkeys mean a spread of enshittification to ever more areas of life. Specifically, they
- force me to use an extra OS on an extra device and keep it around just to use a site with passkeys.
- add insecurity and inconvenience. I neither can backup the passkeys nor use them on another device. (That’s not implemented on Windows.) This user experience is laughable in 2026. The passkeys are forever locked on the device where I created them. I am forever chained to exactly one device. If it breaks down, my life ends because our lives depend on digital technology.
- take away control from me and force me to trust third parties. I have to trust the hardware, the OS, the proprietary software, which makes me feel very uncomfortable as someone used to use Free software. Security by obscurity was always a bad idea.
- deny me anonymity and control over my accounts. I can have only one account per domain.
- are a black box with no user interface. With passwords I know exactly what account name and password I enter at which site. With passkeys I get asked for a PIN. That is all. There is no indication what exactly I authorize. This is a lot like clicking links in emails and giving your banking details to everyone who asks.
The recommendation “do not use them” is cute. They are forced on people. I can’t choose.
I’m not familiar with any of these limitations that you described. Those might be limitations of the specific credentials manager(s) that you’re using. You might want to try a different one.
Yeah I’m confused. I also don’t remember ever using a site tha would force use of passkeys. I always have standard TOTP alongside those.
some of this is disingenuous. For example you’re supposed to make multiple passkeys for your devices so that you can still Access your Accounts even if you lose your Main device (Ofc its still shitty because this forces you into the cloud if you only have 1). Also thats why the passkeys being bound to their „birthplace“ is Not really more of an issue than the others. Also im Not sure where they are forced? In fact i wish it would be more supported in certain apps
Indeed. Every device should get a passkey. Its like client certs where you can lose a device and just remove that passkey from your account. Also, you /can/ store passkeys in pure software. Bitwarden can store passkeys for example. Lots of options for FIDO keys too. I have never heard a non technical person give me a secure password strategy. That is 100% of nontechnical people I have asked use bad password schemes. Passkeys at least enforce a truly randomly generated key.
They still suck at usability but it is an attempt to solve a real problem. Basically the only thing standing between 99% of people and having all their accounts compromised is service password attempt rate limiting.
You think an everyday user will think this way?
Regardless of if a regular user will think this way or not, it is good to have options, precisely for providing them as an option to a regular user, even if they end up not implementing them. The other option is NOT having the option. Which one do you think is more beneficial across the board?
That’s how they work, regardless of how users think. Though you’re correct: the majority of computer users don’t understand what they’re doing and do feel threatened by change, even if that change is positive by any measure other than “I feel uneasy about changing something I have no grasp on”.
For example you’re supposed to make multiple passkeys for your devices How do I do this? Can you link to a guide?
Also im Not sure where they are forced? The big transition is underway. Switch to passkeys or you are out.
Log in to a website that supports passkeys, go to the account security page, press add passkey. Your browser looks for connected security keys to add the passkey to or if you have an extension installed, it might start your password manager. in the security key case; It asks for your pin and it’s done. If you use a password manager to store it, it will ask you where to put it. Once done; you can repeat and add any number of passkeys to your security keys or database. You should do at least two, for redundancy.
I would not tie my passkey to windows/ios/android or whatever. I won’t let a third party manage or sync them. Only on a security key I own or my password database.
finally people are waking up to this garbage.
I didn’t even know what they were until now. And still don’t. Every explanation sounds like a long convoluted MLM pitch. They smell fishy as hell. They may need more grameters to prevent side fumbling.
