Hard disagree. Phishing is a major problem. Passwords+OTP are phishable[1]--passkeys are not (the signature is bound to the domain and cannot be forwarded). That alone makes passkeys worthwhile for the vast vast majority of consumers. This is not a theoretical threat model. You simply cannot realistically expect even a savvy consumer to be able to save themselves from phishing all the time. One mistake and they are fucked.

If you write a long article about the merit of passkeys and there is no occurrence of the string "phish" in your article, I am afraid I cannot take your rant seriously.

Again, this stuff is not merely theoretical. YubiKeys have been a thing at Google and other major tech companies for almost two decades now and the effects are well-studied.

[1]: I have found for some weird reason, this is often overlooked and misunderstood in the industry. People even know about SIM swaps and stuff like that, but don't realize OTP is not phishing-proof.

▲ kccqzy 4 hours ago | parent | next [-]

Phishing is a major problem, but it happens less than you think. Password managers are also checking the domain before supplying a saved password. A user who relies on autofilling the password every time will notice when their password manager suddenly does not autofill.

Yubikeys are a great second factor honestly. But do you want to use a Yubikey as a passkey? Sorry you are likely dissatisfied. Many websites and apps (especially apps) support passkeys but would prohibit using your Yubikey as a passkey.

▲

tgma 3 hours ago | parent [-]

> Phishing is a major problem, but it happens less than you think.

Bullshit. Literally number one attack vector.

> Password managers are also checking the domain before supplying a saved password.

Password managers are not anywhere as ubiquitously used as you'd think. Even if you rely on password managers, you encounter scenarios where the website relies on a different domain that's not paired appropriately. Some "legitimate" mofos like Plaid used to ask password for third party website. Consumers don't see a password manager failure to fill out a password as a security issue. They see it as a routine password manager failure.

	▲	kccqzy 2 hours ago \| parent [-]
		> Literally number one attack vector. That’s an out-of-date view. The number one attack vector these days is cookie stealing. The prevalence of 2FA even weak ones like SMS-based 2FA has made plain old phishing so much less effective.

▲ 4 hours ago | parent | prev | next [-]

[deleted]

▲ nonfunctional an hour ago | parent | prev | next [-]

Note that YubiKeys are not passkeys. But they are a great alternative to passkeys that are just as secure if not moreso.

▲ AlotOfReading 4 hours ago | parent | prev [-]

    YubiKeys have been a thing at Google and other major tech companies for almost two decades now and the effects are well-studied.

My experience is that yubikeys have a tendency to get lost, get cleared, get mixed up (which of my 4 identical yubikeys has the right passkey?), stop working reliably from random USB issues, etc. And worse, yubikeys are awful to use. Like am I seriously supposed to take off my phone case every time I want to plug in a yubikey to the USB-C port (which may or may not be working depending on whether moisture has condensed in the port) so I can use the one mobile browser that supports them to retrieve a passkey every time I want to log in?

No, fuck that. Just let me use an SSH cert at that point. The existence of phishing is a comparatively minor evil.

▲

tgma 3 hours ago | parent [-]

Your "SSH cert" option, in a consumer package, is effectively the passkey.

▲

AlotOfReading 3 hours ago | parent [-]

SSH doesn't prevent key sharing (and hence, phishing), so it's fundamentally different in the context of this discussion.

	▲	tgma 2 hours ago \| parent [-]
		> ...sharing (and hence, phishing) Sharing and phishing are on two different axes. You can have shareable credentials that are phishing-resistant when used. You can have hardware-backed SSH keys that are not cloneable. You would need the browser to prevent phishing while still using SSH agent as its underlying signature mechanism (implied by my "in a consumer package").