@misty I tried to make a passkey once and couldn't make it work. Probably because I use a desktop computer. There must be a way to do it, but I gave up.

I use a password manager.

@misty кажется для людей ключи доступа это наоборот хорошая вещь, можно не запоминать пароли и они "безопаснее"
Только никто не думает о месте где эти ключи хранятся и кто имеет к ним доступ.

Если хотите увидеть что-то действительно забористое, посмотрите как криптокошельки заставляют пользователей записывать 24 слова от руки на листок бумаги а потом проводят тест.

@misty im not anti either..

I just dont like it...

Let me use the passwords i had to make, with uppercase lower case, number, special symbol, blood sacrifice and my first borns soul.

@misty I am anti passkey. But aren't they encrypted with whatever you use to unlock your device? Or do you mean shared device as in shared account on device 😨

@misty @decryption I am very much pro passkeys, but the way a lot of sites push you into it with either dark patterns or like microsoft just straight up trying to create one whether you want to or not is going to do a lot of harm to how people feel about them

@misty AFAICT it's only upgrading already stored credentials to passkeys. So in that scenario either it wouldn't create one or that shared account already had access to that password.

@misty As someone who has been doing IT Security since the days of early dail-up internet, passkeys are indeed a red-hot mess.

Primary problem is that the browser provides access via an API. This is backwards: it means every website that wants to support passkeys gets to provide the UI. This is an *incredibly* bad idea. Password managers in browsers work so well because the UI *is in the browser*. Passkeys should be the same. There should be absolutely no way for a website to forcer you to use a passkey - it should be entirely in your control through the browser.

The secondary problem is the "provider" mechanic, which is where the passkeys are stored. Again, this should be 100% driven by the browser. But it's not. Google can be a provider. BitWarden can be a provider. Windows can be a provider! All good, except the browser needs to be upfront about this and not give the providers any way to counter your wishes.

@misty

@misty Today's posts like yours have been illuminating. Passkeys have been pushed so hard, but I've avoided them because I don't understand them. Neither does my IT spouse.

I thought this was just some ignorance on my part but it seems this really is a mystery to a lot of people.

I am honestly so sick of passkey stuff being tossed in front of me. I wish I could turn it off.

@misty I work in IT and even we don’t always totally get what passkeys are or do. My conception is it’s a post login thing that hopefully lets me get into a site from that same device more securely than sending my password? I save them to Bitwarden and click the button when presented with it. I’ve used them across devices but is that because Bitwarden holds them? If I wasn’t using a PW locker then would they be less useful?

My usual attitude stays in place: try out the new thing but don’t toss out my old things for it immediately.

@misty If this was on an iOS device that setting is on by default as of iOS18: https://authomnibus.com/authentication/passkeys/#apple-has-introduced-%22automatic-passkey-upgrade%22

Shouldn't happen unless you used Apple passwords to log into the site first though, which I sure hope isn't happening on shared devices.

(nota bene: I do not like automatic upgrades for this reason)

@misty I am far more worried about losing access than getting an account taken over. 2fa works fine for the latter. I've never been able to get a straight answer on how one backs up passkeys. I don't use anyone's cloud password manager.

@misty I just enquired of the internet what the advantages of a passkey were and before the internet would respond I had to tell two robots that I was not a robot. I get that passkeys cannot be extracted from my device by intruders but anyone using my device can get a free ride the same as with my saved passwords.

And another thing - aren't passkey something setup and controlled by Google?

@misty *buys up all the famicom disks*

@misty It seems to be an Apple feature. Saw this today: https://mastodon.social/@monkeydom/117382425456803989

This is I think my biggest problem with the passkey ecosystem. It’s very poorly explained and yet every site is very eager to get me to switch to passkeys without making sure the user knows anything about what’s going on or the implications of any of it.