| ▲ | account42 2 hours ago | |||||||
> Passkeys are a fantastic technology. Since they are bound to the site they are created for, they cannot be phished by a hacker’s fake login screen. The same is true for passwords with a password manager. > If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details. Also not really a problem with randomly generated site-specific passwords in a password manager. Really all the browser vendors had to do was add an API to make automatically generate a password that is then stored in the user's password manager the low friction option. | ||||||||
| ▲ | rcxdude 2 hours ago | parent [-] | |||||||
If you're doing that you might as well use public/private keys. The issues with passkeys are around user experience and education about how they are stored, and a lack of good backup options like enrolling a not-present device as opposed to relying on syncing them through an external service. | ||||||||
| ||||||||