> I don't give a fuck if other people can't manage secure passwords.
I infer that you use a password manager.
Consider passkeys as a standardized interface for password managers.
I infer that you use a password manager.
Consider passkeys as a standardized interface for password managers.
I have not followed WebAuthn spec for a while but I vaguely remember that the spec discouraged software-only authenticators.
Which made me feel like WebAuthn is yet another attempt to take the power from users and even states and concentrate it in the hands of a few multinationals controlled by US government.
Pretty much what happened to Certificate Authorities and the push to use HTTPS everywhere.
Of course there are benefits to HTTPS Everywhere and to passwordless authentication.
But they do not outweight concerns over the digital autonomy of my country.
Given the convenience factor (no extra install), I imagine that device/platform passkeys to be the most popular, but there should be no problem with using alternatives.
I believe you can enforce attestation using MDM and a custom app as far as I'm aware. But for general people using Safari or whatever, you can't request any kind of device attestation.
You can make your own backups of passkeys from your password manager.
I believe you are confusing ones that are stored in software or syncable (Passkeys) with the hardware backed credentials (platform authenticators).
The problem is that the protocol allows websites to require use of the latter. If the two were indistinguishable to the website, then passkeys would be a good thing.
https://fidoalliance.org/specifications-credential-exchange-...
The amount of people in this thread who don't understand the very basics of this stuff is a pretty good counterexample to the common trope they somehow "know better." I kind of doubt that when many people here can't even get the basics straight.
I am not migrating to something just because it's new.
My solution works for me. If it doesn't anymore, I'll see what I'll do.
Depending on the service I'll swallow the bitter pill and use another solution or simply not use the service anymore.
Every and any decision has consequences, on any side.
Fight me. Grandmas and Joes end up putting these recovery codes in a Google doc because they don't know what the hell else to do with them. That is NOT more secure.
Hell, even try explaining the difference between the "secret key" and the "password" in 1password to a non-technical person. It's impossible.
"More" implies a comparison to something.
Given that Grandmas+Joes were using "passw0rd!" for all their passwords, I would argue their GDoc of backup codes is considerably more secure.