I still don't use passkeys because I don't know what advantage it has over my existing method of generating random passwords in my passport manager and using that. My password manager generally autofills it anyway.

I know where my password manager syncs, it's on all my devices. Passkey prompts always seem confusing, I don't know if it's going to save to my browser, or my OS, or if those are gonna sync on what devices. It's just more confusing.

What would I gain from using a passkey?

▲

nemothekid 2 hours ago | parent | next [-]

>What would I gain from using a passkey?

The number one gain I see with passkeys is that they are phishing resistant. The biggest issue I've had with TOTP keys is they aren't phishing resistant.

Forcing people to use passkeys gives the authentication layer a stronger means to ensure that people are logging into the correct domain. A password manager accomplishes this, but it's very difficult to enforce. (I've heard a number of variants of "John Smith sent me an important document and when I went to open it, the password manager didn't work so I just copied password")

▲

whyagaindavid an hour ago | parent | prev | next [-]

> What would I gain from using a passkey?

The correct question is What did others gain?

- Phishing free press fingerprint or faceID or Windows Hello for login into many important sites

- many people don't have time to type password, then otp. If most of the world did that then this would not be needed.

- And finally, YOU are not OBLIGED to use it. Let the rest of population use it.

- It is like SOME pay with phone/NFC-Watch etc. MANY still use card or cash...

▲

Capricorn2481 an hour ago | parent [-]

> And finally, YOU are not OBLIGED to use it. Let the rest of population use it.

They are.

	▲	whyagaindavid 37 minutes ago \| parent [-]
		Who forced you? Your employer?

▲

mixdup 2 hours ago | parent | prev | next [-]

What's the difference between using a really good password vs. public key authentication in SSH?

▲

loloquwowndueo 2 hours ago | parent | prev | next [-]

I’ve seen tech-savvy people getting phished into entering their password on a fraudulent site, despite the password manager blaring alarms that the login looked fishy.

This cannot happen with passkeys at all because crypto magic.

▲

hbn 2 hours ago | parent [-]

I assume a phishing site wouldn't even attempt to use the passkey because it can't. So wouldn't it just ask for a password, and at that point, if you're gonna fall for it, you'd go and grab the actual text password anyway?

My password manager matches off of domains too, so it wouldn't suggest to autofill on a phishing site.

▲

MrDOS 2 hours ago | parent | next [-]

Right. The “correct” way for a service to handle this is to disable password logins for any account that has enrolled a passkey. A few services do this, but boy howdy is it ever unfriendly to users (or at best, difficult for them to get their heads around).

▲

loloquwowndueo 2 hours ago | parent | prev [-]

Right. It didn’t suggest it but the phishing message was convincing enough that the tech-savvy person fished the password out manually and input it anyway. A mistake for sure, and one the password manager was trying to help with, for sure, but this mistake would have been impossible with a passkey.

	▲	joshuaissac 15 minutes ago \| parent [-]
		> this mistake would have been impossible with a passkey. But GP is saying that when the passkey is not auto-entered, the user will just use password-based login. So the mistake will still happen even if passkeys are enabled and used, as long as password-based login remains as an option.

▲

hedora 2 hours ago | parent | prev [-]

You’d gain forced lock-in to client operating systems and hardware that someone else picks for you.