126
Passkeys are not a trap. Use them!
(hachyderm.io)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 14 Oct 2026
126 points (75.0% liked)
Privacy
51431 readers
1054 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 7 years ago
MODERATORS
Not much of a rebuttal imho. We still have the problem that passkeys are ok in theory, but in practice they're being pushed as a way to increase lock-in and don't offer compelling advantages over well-managed passwords.
But most people don't have well managed passwords. And me having good password hygiene doesn't stop my data being hacked when someone working at a subcontracting firm to a company I use leaks all my data.
It also is annoying to have to log in over many steps with 2fa, often forced to email or SMS.
Collectively improving security benefits us all.
I think the point about lusers not being able to manage passwords has been argued to death elsewhere, so I won't take issue with that.
What has this to do with passkeys? Are you sending your password in plaintext to the contractor who stores it that way, unencrypted? That's a separate problem entirely. The only benefit I see with just sending them your public key is that they can't leak your private key, whereas if you used one password for everything, and sent it to them, they could leak it.
Am I missing something? Would passkeys offer an advantage over a password manager? What if the website assigns you a password via DH so that users can't pick bad ones or reuse them, would it have the same advantages?
2FA can be super annoying, but again I think it's a separate issue. If I get control of your phone or laptop then 2FA might save you, but passkeys won't.
It sounds like they're saying that if you can manage your passwords then do so yourself and avoid passkeys, but if you can't/don't want to then use passkeys.
And they are pointing out that the company is far more likely to lose your password than you are.
Convenience vs security, but the weakest link is probably not the user.
I think you're mixing up compromise of an account with compromise of the data associated with that account.
If a particular piece of data is accessible to people of a dozen accounts, compromise of any of those accounts potentially compromises the data. That's a legitimate concern for people who want certain data secured, whether other accounts with access are also secure. In some cases, it may be best to have an authentication policy that provides a baseline level of protection even for the most clueless users, rather than a system where you're able to secure your own account.
I follow you, but if we can impose passkeys on the security-inept people we are forced to give our sensitive data to, couldn't we instead force them to use good security?
It's been like 25 years since the security world basically moved on from assuming that users could be trusted to act securely. We gotta design processes and protocols that keep things secure even with people who have bad habits.
I can secure my email, but every email I send or receive touches at least one other mailbox I don't control, of some other user. Same with text messages, social media posts, etc. The digital world we use has a billion overlapping people, some with escalated privileges as employees or admins or mods or whatever. We can't make them perfect, so we should design systems that work well even with imperfect people.
I couldn't possibly argue with that
I’m saying that bad user passwords allow data to be hacked. When it’s the credentials of someone with access, like an employee of companies with your data, then that data is more easily compromised if they have crappy passwords. It’s harder to compromise with passkeys. It is not just your password hygiene that protects your data.
Here is a recent example in Australia. https://www.abc.net.au/news/2026-10-06/asos-app-users-sent-hacked-message/107236520
That doesn't say anything about passwords. Looks like someone's device was accessed. Maybe you just understand this better than I do.
Ok, here’s another one from Netherlands. https://www.tomshardware.com/tech-industry/cyber-security/hacker-claims-123456-password-let-them-breach-the-danish-national-registry-accessing-8-8-million-records-it-and-data-services-company-with-weak-passwords-linked-source-of-the-hack
If the people with access to your data have weak passwords, then so do you.
But that's exactly the problem. Those that were the target audience for the article do not have well managed passwords. For them the passkeys arguably do increase security, while having a bit more "lock-in".
For those that have well managed passwords (like probably most in this community), they are perfectly fine to use because they don't have lock-in either. I have full control over my used passkeys.
Basically you're not getting the "normies" to use proper password management, and for them they do provide additional security and convenience. They can always add more passkeys on different vendors, you're not limited to just 1 per service. Yes, adding them is a hassle, but so it's managing passwords and following higher security standards in general.
The "normies" don't have a clue what passkeys are either.
They don't need to. It just works to log them in when they're using one of their own trusted devices. Being able to unlock their phone gives them full access to the services (apps, websites) that are authenticated to that device.
I know that, and you know that, but passkeys are supposed to solve security-related problems by reducing friction.
What passkeys can't overcome is people dismissing the popups asking if they want to switch to passkeys or create them.
The problem with passkeys is they are 20 years too late, and no one cares.
I think it'd actually be pretty easy. Just ask:
Most people will say yes on their Apple/Samsung/Google devices.
How do they increase lock in?
Lock-in was already being achieved by mandatory use of apps which require iOS or Google Play services.
Plenty of banks etc which I can simply not use because of this requirement, and others which downgrade you to password+SMS security (used to be a physical TOTP token) if you refuse their app.
Which ones are doing this? Give specific examples of sites that are forcing you to use a specific TOTP or passkey validator.
The kind of lock in I'm thinking of is with e.g. Google, Apple, or Microsoft when they take charge of the passkeys for you.
That's entirely optional and not forced. You can use FOSS password managers that store your passkeys, that can log into all those services.
If you're referring to proprietary password managers (IE like google or apples), then that concern applies equally to all the passwords you're storing with them. So that concern is not specific to passkeys.
I don't disagree with any of that. You and I will be fine, as long as whatever sites we use don't insist on evil-only providers. The trouble I'm thinking of is for average uncritical phone enjoyers who are guided into a flow where they're migrated to using passkeys with whatever propriety junk they're using and end up locked into Matacorp Secure Cloud who now control their access to all their accounts, where once they had a list of passwords written in the back page of their diary.