Remix.run Logo
readread 2 days ago

I’ve just been operating under the assumption passkeys are gonna lock me out unrecoverably in some way at some point, and have been avoiding them for anything important while allowing them for low-value accounts so they’ll stop nagging me.

I hate that I can’t just put a value in a plain text file somewhere (encrypted, let’s say, to preempt the inevitable and low-value response) and rely on that to work when I need it on any device and interface that can accept keyboard input.

deltoidmaximus 2 days ago | parent [-]

I avoid using them altogether for the same reason. I won't use them for low value accounts because it signals that I think they might be acceptable to eventually require for high value ones. And of course low value accounts have no value so I don't even care about phishing on most of those.

readread 2 days ago | parent [-]

Haha, this thread has prompted me to follow some of the discussion about stupid bullshit like requiring "user is present" attestation and banning passkey programs (LOL wut?) if they lie about it, or resistance to allowing exports and portability.

I'm now on team "I am outright anti-passkeys and hope they fail and everyone pushing them cries a whole lot about it and never gets over it".