Hacker News Reader

Comment by ggm | Hacker News Reader

I think I have to agree. I spend my life across 2 macbook and 2 android devices and I now cannot predict which web interaction (or WPA) will ask me to use which device(s) to validate which association.

I have bitwarden on all of them. I can coordinate 2FA TOTP easily. I don't see passkey adding value right now, it's simply added an extra model, alongside the others, which doesn't even reliably work.

Given their non-migrating quality, I can't federate can I?

View on HN

I use passkeys exclusively on my YubiKeys, and I ensure I always have a backup (two Yubikeys with one passkey each).

TOTPs are handled the same way (stored on two Yubikeys).

We used password managers when 2FA allowed us to guarantee that even a leak of the passwords wouldn’t be that catastrophic. If you sync your passkeys to your password manager, anyone compromising it has full access to your accounts.

FWIW Bitwarden supports passkeys which allows you have them synced across all your devices.

Thank you. TIL.

This is the way.

Easy and painless.

I use Bitwarden. I need none of the convenience of passkeys, and I am able to login on a third system just by hand-copying a password, which I cannot do with passkeys. So why should I prefer passkeys anyway?

Passkeys have some benefits, but the major reason they exist is vendor lock-in.

The main reason they exist is that the vast majority of people don't create secure passwords and 2FA isn't always reliable. Passkeys may not be for someone like you (and me).

Passkeys can’t be accidentally hand-copied into a phishing page.

Reply on news.ycombinator.com