Uhhh... Can someone ELI18 to me the problem with passkeys? I use them wherever available and find them very convenient.
this post was submitted on 28 Feb 2025
533 points (93.3% liked)
memes
12170 readers
1853 users here now
Community rules
1. Be civil
No trolling, bigotry or other insulting / annoying behaviour
2. No politics
This is non-politics community. For political memes please go to !politicalmemes@lemmy.world
3. No recent reposts
Check for reposts when posting a meme, you can only repost after 1 month
4. No bots
No bots without the express approval of the mods or the admins
5. No Spam/Ads
No advertisements or spam. This is an instance rule and the only way to live.
A collection of some classic Lemmy memes for your enjoyment
Sister communities
- !tenforward@lemmy.world : Star Trek memes, chat and shitposts
- !lemmyshitpost@lemmy.world : Lemmy Shitposts, anything and everything goes.
- !linuxmemes@lemmy.world : Linux themed memes
- !comicstrips@lemmy.world : for those who love comic stories.
founded 2 years ago
MODERATORS
Yeah i can sum it up for you
I have the opposite situation, I bought yubikeys but nobody supports them.
Indeed. Why so many recommend them I have no idea.
Honestly, if you have a password manager that supports security keys then buy two cheap keys (one for backup) like the Thetis FIDO U2F Security Key and use those to secure your password vault. For everything else just use TOTP and Passkeys stored in your vault.
I invested in Yubikeys and yes it was a waste.
I'm getting ready to roll them out at work but it's basically exclusively for the password managers. Having a password manager and every account be unique isn't helpful if everyone's going to just use shit passwords for their password manager
If they have a security key then fuck it, they can use 'password' as a password 😀
Has this energy...
You can store passkeys in your password manager lol
Remember when tap-to-pay was new and didn't work at a lot of places and some people were freaked out over it?
And now most of us use it without a 2nd thought.
I speculate passkeys will be like that.
I'd use it if it didn't cost extra in my country. Swiping my card really isn't much harder
Wow that's madness
sure, you can use a passkey as a primary authentication, but only "a device" or "system"(keypass/1pass etc) knows the passkey detail. with only passkey, if my passkey provider/ device is compromised then everything is lost. having single factor auth seems like a bad idea.
a password is something that I can know, so is still useful as a protection mechanism. having two factor auth should include password and passkey, which seems entirely reasonable whilst also providing an easier path forward for people used to TOTP.
Passkeys are one exception to the familiar pattern of "we give you more SeCuRiTY so we can spy on you more and control your behaviour better". They actually are more secure. Problem is, a lot of technical issues with it still, a ton of stuff not working correctly yet
I'm still appalled that my Yubikey / FIDO2 still doesnt work on Firefox. I have it as a passkey for GitHub, realized it doesnt work on Firefox, so they just prompt me for my password. That seems backwards to have password as a fallback, too.
I think that's a you specific problem. Mine works fine with Firefox, and has for a good long while. Could anything be blocking it?
I'm also having problems using passkeys (stored in Bitwarden) with Github in Firefox. It keeps prompting me to touch the security key, which I don't have, so I plain can't use a passkey for Github. Works perfectly for Google though
On the contrary i want more services using passkeys instead of 2fa methods that are less secure (sms).
Unless I've missed something big, passkeys are pretty easy for me if the website supports them imo.
Using KeePassXC, I click register on the website, register the passkey with KeePass, then it just works when I need to authenticate or login. My database is then synced across all my devices.
Passkey support is yet to come to KeePassDX on Android though, so I'll be awaiting that feature
For me it's just inconvenient to have to type my computer's login, but the fingerprint on the phone is nice
If you live in the USA, don't use fingerprints or any other biometrics. https://arstechnica.com/tech-policy/2024/04/cops-can-force-suspect-to-unlock-phone-with-thumbprint-us-court-rules/
I'll use banks as an example
If they cared about your security there would not be a mobile app or website.
Hell, credit cards would still require a signature.
It's about cost first and foremost and then convenience.
Has nothing about you as a consumer. They don't give 2 shits about you as a consumer.
I mean you're right about banks but your examples make no sense.
Banks generally don't support 2fa, which is bad. Some banks (fidelity) still have character limits on passwords because they stores it in plaintext until recently so you could use it through the telephone system. They could implement a secure tap to pay system on your phones with enhanced security, rather than relying on Google to handle their job. And for credit cards themselves, switch to chip and pin.
"Banks don't have mobile apps"?? "Signatures are secure"?????🤡
How easy is it to fake a signature for a normal person who has not practiced a person's signature for the intent purpose of faking it? Have you ever tried faking your parents signature to get out of school? I have.
Now the infrastructure required to adequately check signatures is not practical hence it doesn't exist. It's why we moved to pins. Pins are small and 2fa doesn't exist for banks because again it's about the bare minimum and they are out to make money and don't care about customers plus there's government safeguards in place specific to banking.
I will continue to argue that going back in time signatures are infinitely more secure than a 4 digit pin let alone tap but we have traded security for convenience.
Anyways full admit that I'm batshit crazy.
Have you ever tried faking your parents signature to get out of school? I have
Yeah. I've been able to do it since I was 10. It's really easy. I can also fake my husband's and siblings'. It's also a pain in the ass to change your signature. So if someone learns to copy it (like say based on the signature that was literally required to be on the card), it's much hard to change it compared to a pin (which should definitely not be written on the card).
Do you think signatures were at all secure? If they cared about security they'd do chip+pin like most civilized countries.
With proper infrastructure yes signatures are extremely secure. But that proper infrastructure doesn't exist.
I struggle to think of what that extremely secure infrastructure would look like. Are you imagining signing on an electric terminal and having a computer compare signatures at the time of sale? That seems like the most secure and still wildly insecure compared to a pin.
ITT: people who think only SMS, email and TOTP exist as 2FA.
And people who think only your phone can be used as passkey.
load more comments
(1 replies)
Passkey is "something you own" right?
I have something I own, it's a Yubikey
And how many sites support Yubikeys/Security Keys? Not many. I doubt we'll see more either now with Passkeys becoming more prominent.
I have two Yubikeys and other than securing my password manager vault they are rarely used elsewhere.
load more comments
(3 replies)
view more: next ›