125
Passkeys are not a trap. Use them!
(hachyderm.io)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 14 Oct 2026
125 points (74.5% liked)
Privacy
51461 readers
800 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 7 years ago
MODERATORS
Nah, lock-in is not a safety feature. 16+ random chars are plenty, and if cracking gets better I'll go to 20 or 30 chars. My pw manager doesn't care what strings go in it or which device opens it up.
You can have passkeys on multiple devices. I use them on different platforms for the same sites.
How do you transfer your passkey to a new device?
If you use a self-hosted password manager like bitwarden, then its there. If you use a file-based password manager like keepass, then you can use any syncing method you choose, and its no different from passwords.
not sure about every OS but the ios password app has a menu button to export them to other apps. I have exported mine to my own self hosted vaultwarden. took 2 minutes
You don’t, you can have multiple passkeys, one for each device.
ok.
How do you add a new device to your account without a password or the old device?
Password, then get a prompt about registering a new passkey.
After that I can use the passkey registered on either device.
Edit: to clarify, most sites still let you log in with a password after you’ve registered a passkey
The the account is still as vulnerable as a password.
Yes, but you’re less susceptible to phishing when you login with a passkeys.
It’s also makes logging in faster.
That's my workflow as well 26 random characters, a yubikey (and Aegis TOTP for sites that don't have fido or similar) and I'm good.
I like the idea of a Yubikey but there is no way it would survive more than a month on me due to the conditions where I work. And getting a physical key then not having it on my body at all times is a non-starter.
I keep my keepass .kdbx in on a webdav server and that covers any device I can think of.
Do you work in a blender? It's a pretty solid bit of plastic, should be fine in a pocket or wherever the device you're using it with is.
Maintenance at a blast furnace. I am exposed to acidic vapours, caustic vapours, ambient heat in the 60c range, radiant heat in the 1000c range, rock from the nanometer up to 30cm size, phenolic resins, oil mists, and metal powders. And then there's the crawling around over, under, and between equipment.
Not every tech-savvy person works in an office.
Cool. Hope it's ok on your health. I suppose you have some way to keep your phone safe, and don't need to do 2FA while exposed to all of those things. You could probably wrap one up pretty well and still have the NFC work too.
Totp with a backup of the secrets/seed qr stored in a kdbx. If my phone melts it's a 24hr problem at most.
Passkeys also aren't lock-in. You control them, and your FOSS password manager likely already supports them.
you are required to use a 3rd party. that third party has control. you can't switch. that is lock-in.
I'm using a FOSS password manager for like 6+ passkeys right now, on some of the biggest sites. So this is just demonstratably false.