Remix.run Logo
lapcat 4 hours ago

Two crucial things you can do with a password that you can't do with a passkey:

1. Write it down on a piece of paper and put it in a safe deposit box.

2. Read it on one device (or from a piece of paper!) and enter it manually on another device.

Plain text is the ultimate form of cross-platform portability. Passkeys are the ultimate form of vendor lockdown. The passkey vendors won't even allow you to view the private key, unlike with ssh keys, which you can also write down on a piece of paper. It's vendor cabal to destroy computing freedom in the name of "security", always the excuse. Tech company paternalism at its worst.

XorNot 4 hours ago | parent [-]

This is exactly how I feel about it.

If passkeys were meant to be user friendly then there'd be a secure optical transfer mode to QR code them from device to device with the screen and camera.

Easy to implement (receiver flashes a public key, sender encrypts to that key and flashes the QR code back).

That it doesn't exist for a protocol meant to work with phones tells you exactly where the thinking was headed.