The intended audience is people who are not yet using passkeys, or have just started (due to all the websites demanding them now) but don't really know what they are.

I apologize that the headline is provocative. I thought for a long time about how to appeal to both people who are barely aware of what passkeys are but also not put off people who like them. I considered calling them a "Trojan Horse" in the headline as I do in the body (i.e. legitimately lovely, but with a terrible and unobvious problem) but "trojan" has another connotation in computer security.

Nonetheless, I said what I meant. Convenience is how they get you. This convenience didn't have to come with a trap, but thanks to the way it was designed, it does.

▲

Grombobulous 5 hours ago | parent | next [-]

Sure, I think your logic makes sense, and I don’t want to overemphasize complaints about headlines.

Regarding how I feel about passkeys after reading your article, logically I am reading what you wrote and conceptually understand the trap, it’s just hard to wrap my head around what kind of situation would cause this trap to “catch” me so to speak.

I.e., the upside is real and immediate, the downside is theoretical and tied to future uncertainty.

	▲	nonfunctional 5 hours ago \| parent [-]
		You're right, I didn't explain in much detail the motivation that will push websites to start requiring the remote attestation flag to be set. I will try to cover that in a future article. But as for how it could "catch" you: if you use FOSS devices that are unattestable (as is the case for the LineageOS phone and Linux laptop I exclusively use), you may one day find you can't use many websites.

▲

MBCook 5 hours ago | parent | prev [-]

You know what’s a great way to get me to not read something? Shitting on it immediately and making it seem like the articles just going to be another pointless rant.

The title put me off completely.

I’m tired of people shitting on everything. Especially without offering any advice on how to improve things. It’s exhausting to read. And apparently it’s not even the point of the article. So why is it the title?

Very very strange choice.

▲

tavavex 2 hours ago | parent | next [-]

I really can't comprehend what the actual issue is here. The title isn't "shitting" on anything, it doesn't say "If you use passkeys, you are a horrible person". It literally is a summary of the article's point - Passkeys are a trap. It even offers a solution you long for - Do not use them, a perfectly fine recourse on an individual level unless you expect OP to overpower a massive tech alliance.

The tone hair-splitting makes it seem like you weren't going to be that receptive to the point anyway, no matter how many layers of subtext are inserted to abstract away the actual point, that being - Passkeys are a trap. Do not use them.

▲

9x39 4 hours ago | parent | prev [-]

>Especially without offering any advice on how to improve things. >And apparently it’s not even the point of the article.

It wasn't a pointless rant, you're seemingly primed for something that didn't happen here.

It's a good argument that passkeys are a trap while TOTPs offer the security you need but avoid the absolute control passkeys may hand over, so stick with those.

▲

qlte 2 hours ago | parent [-]

TOTP/SMS 2FA is a gigantic pain, I've probably lost multiple 24 hour days worth of time added up from entering TOTP and SMS 2FA codes dozens of times per day on websites that mandate it despite having nothing meaningful worth securing.

With passkeys I click once and I'm in like the golden age of using the web with a password manager in 2012. It's a huge quality of life improvement. If people want to avoid passkeys for whatever reason, that's fine but not interested in reading the same slippery slope argument that gets reposted every week.

A recurring issue with these critiques is how they seemingly presuppose passkeys are an all or nothing thing, and losing your passkey means losing access entirely. Which isn't how it works basically anywhere. It's just another auth method, if you can't use a passkey you fall back to whatever recovery method is offered. If passkeys became some user hostile trap overnight I'd just unenroll them and use TOTP, SMS 2FA, email 2FA, or whatever else is supported.

	▲	MBCook an hour ago \| parent [-]
		So true. And every critic always attacks this same thing. TOTP isn’t so bad, my password manager can do it. 2FA is fine it’s automatically pulled from my phone. It’s still phishable. The password is still sent. You haven’t solved anything, you just piled more complexity on top to make it harder. People can still use the same password at 12 websites. Passkeys never get transmitted. If you hack into a server and steal my credentials, all you get is a public key. You can’t use it at another website. A bad developer can store my password or TOTP secret in a way that makes it useful to a thief. That’s not possible with Passkeys. No one ever offers an alternative other than saying it’s irrelevant. Despite practical experience showing otherwise. Passkeys work and make my life better. These constant rants remind me of seeing people argue that the GUIs are a waste of time and no one will ever use them and it’s a fad that will go away and the only reason everyone’s talking about them is companies want to sell graphics cards and mice.