Yeah the technology is cool but I stay away from passkeys and tell people not to use them because there’s too much room to permanently screw up.

Maybe they’ll remove the non portable type from the spec or roll it into an enterprise equivalent like with ad.

It’s funny because I can’t see it and when I view the code of your post and copy/paste it into the location bar I get the broken jpeg picture.

Amazon/whatever login:

• email: koalalover@schmeemail.com
• password: hunter2

Email login:

• username: chlamidiyasux
• password: hunter3

There. You've solved 90% of online fraud that begins with website(s) leaking your credentials and someone combining leaks to gain access to everything in your life via your email (including bank, socials, porn habits, whatever).

Okay. I think I'm understanding. A passkey is a virtual key? That we have to buy? And some company makes these virtual keys? And there's a virtual locksmith who makes virtual locks? And you have to hire them to install them on your computer? Is this what's going on?

Corporations want what they're terming phishing-resistant passkeys, which have two approaches: hardware-based or synchronized passkeys. If they are forced upon us for certain services or jobs, the least harmful to a worker is a synchronized passkey. Password managers like Bitwarden support this, so that you don't have vendors and employers tracking your cell phone. If an employer uses something like Microsoft, the administrator settings may not allow synchronized passkeys...but at least we can advocate for them when these auth methods are forced upon us.

Edit: At the time of upload it was a png. I guess lemmy.zip made the choice to convert it.

Too bad. Passkeys are a pretty good thing and are an enhancement over passwords... but big tech is doing their thing again.

I wasn’t able to see the image because it’s an avif. What a weird format and choice of format.

Apropos of a discussion about over complicated unpredictable passkey behavior.

The problem isn't you or me, the more technically aware... it's when the majority of users switched to passkeys and then subtly get switched to attested passkeys and sites don't offer other choices. Once the majority are under-thumb, sites won't have a reason to offer open solutions to the same number of objectors.

and your redundant 3-2-1 backup system of that. Everyone knows that! Surely no one has no backups. Oh well, can't design around that unpredictable problem that no one could guess. Everyone has backups!

Passkeys are intentionally badly designed but as long as you use them with an open source password manager they can be an immense security improvement. Alternatively if you're using a cryptographic USB token register a second passkey in your password manager.

I wish SQRL was more commonly used.

Healthequity tried forcing this passkey garbage on me, and they wouldn't allow me to manage investments over the phone, so I ended up transferring everything to a different HSA provider. Not giving in. I love TOTP though.

I have been doing the same thing. If the passkey tries to lock itself to a particular device, I'm not using it. I don't feel like having Google, Microsoft or any other software company control my logins. If it can be stored in my KeepassXC vault, I will use it.

It’s even more apropos that the fediverse behaves unpredictably when uploading images.

Passkeys in a nutshell: how does it work? Idk. Who’s in control of it? Idk.

I mean I would hope so, but losing a password manager database sucks regardless if you used passkeys or not.

Basically the problem is that Passkeys are designed to allow a particularly bad enshittification once everyone uses them. So it's not about downsides of using them now, but about them being used in general and then abused.

I like the article and agree with the problem, but I'm skeptical that this works as a strategy to fix the problem. First off, individual responsibility or boycott doesn't really work. Most people will just use what their phone gives. Second if the corporations do want to do this, they could implement it separately in their apps, like twitter or google chrome requiring quasi-attested "homebrew" passkeys stored in cryptoprocessors. Ultimately I do not think we have any power to prevent them from doing that.

The time of democracy and pluralism is over. We're already seeing the author of the article being maligned and personally attacked for talking about AI - how dares he? On all fronts we have lost the culture war and lost power, economic power, information power like access to truth.

Based

Use a password manager like bitwarden et al.

I apologize. The reply you responded to was entirely satirical. It was written in frustration. From my point of view passkeys are the way to do authentication. More specifically public-key cryptography. It has a lot of desirable qualities. Governments and 'tech platforms' should have been using it from the start--we've had the software to do this since the 1980s and it was libre-software by the 1990s.

Any criticism of passkeys (as brought up in this thread) are more so applicable to the private-dictatorships that are Microsoft, Apple and Google. The contrary behavior of continuing to use these private-dictatorships whilst decrying passkeys is tantamount to hypocrisy? stupidity? To give a tiny bit of context: the quality of attestation in passkeys are also applicable to SSL-certificates, yet no one is decrying SSL-certificates. It's also applicable to every GNU/Linux distribution and libre-software at large.

That's to say the criticism is written from a place of ignorance. "Privacy" forums on the internet are not interested in reality. Their users are full of users with static behaviors. More often than not any questions asked in these places amount to "how can I continue doing what I was doing before? Big-corp has introduced a change I don't like. I want to do the exact same thing on big-corp that was previously permissible." When the factual observation is stated: "big-corp is a corporation designed for surveillance-capitalism therefore if you desire liberty and privacy whilst computing you cannot use such a corporation in any manner" it's met with unfounded hostility, hypocrisy and lies. Any use of such software is contrary to your stated desire: digital-privacy. Even when responses illustrate how you could achieve what the OP wanted, but with libre-software and privacy-preserving-software you're often met with: "no. I want to use Google/Microsoft/et al." Users are lazy idiots.

Technical and correct responses are ignored whilst a flood of ignorant, emotional or status-quo enforcing responses are brought to magnified attention. I've abandoned restraint and started to shitpost as every one else appears to be doing.

I suppose this is all a criticism of 'social-media' and how it's a waste of everyone's time.

That’s to say the criticism is written from a place of ignorance.

The praise is also written from a place of ignorance too. People love it and they don't know what it is. If you can't explain it to a five year old, then you don't understand it. And if we don't understand, it's a horrible idea to fork over our security to it. We don't want to rely on a box full of ADE 651 bomb detectors.

Yeah, but if the big company wants to embed weird shit in their client software… A frontier model can reverse engineer the client, determine what satisfied the authentication request, and replicate the implementation elsewhere on our own terms. Can do this with less than $100 worth of compute. I know because I’m already compiling/sideloading iOS apps with Xcode on my Gentoo desktop — Apple can eat shit.

you do not have ultimate control over your passkeys.

Looks like it boils down to that? Because I just started using a few and they're on my self hosted vaultwarden so...

It's more like how my bank has started locking users out of online banking if they don't have the mobile app for authentication, and preventing the mobile app authenticating the user if they're running a non-approved version of Android like GrapheneOS. Try to gain digital independence and all these mechanisms will be used to shut you out of everything you need. Only thoroughly locked-down and surveiled devices will be allowed to access useful services.

This is another way they'll lock out Linux as an OS. It won't pass passkey attestation or age check attestation so it just won't be allowed to access the web because clearly you're a bot or some other bad actor for failing those.

That or they'll create a special government backdoored and approved Linux that has attestation in among a bunch of other blackbox modules that you have to trust aren't an NSAKEY right into your system.

The future looks so bleak with all this online, Flock, Axon, etc cameras IRL controlling all movement and all fed into Palantir for one online and offline profile of you for the police state.

Then this turns into yet another arms race of fixing and breaking.

You're an idiot.

Are you serious?

Hiding stuff in client side software never stopped being an arms race between the producer and consumer. LG TVs are a great example.

I’m trying to reconcile corp IT doing it being reasonable, but it shouldn’t be in the standard. If it’s not in the standard, how would they do it?

It sounds like your browser is not hooked up to your password manager. I’m not sure how you want it to work if the browser APIs the website needs don’t have the required plumbing.

That does not mean the standard or Google have locked anyone out of the ecosystem.

How do you suggest enforcing it?

There is a subtlety here that I feel like is being missed. Yes, via remote attestation, websites can require only passkeys from Google and Apple are usable. But you can still use those passkeys with Linux. It is a restriction on how you can authenticate and I can understand concerns over the lack of freedom in this area, but it is pretty far from a threat that would prevent the use of Linux.

Try protonpass. I switched from bitwarden to it. It’s not perfect but it’s much nicer

EDIT: seems like it's both simpler and more complex than I thought to achieve what I want. https://codeberg.org/PassFF/passff/issues/581 suggests it is "just" a local tweak. At the same time, any search I make for finding an actual implementation guide for authenticators is buried under pages of results for using passkeys in your own web app. The ecosystem's current state seems to be "don't bother, just trust us!". Even the damn "passkeys.com" site is a barely disguised ad for OwnID.

I dunno, the browser could open a file picker and let me point it towards the passkey, or perhaps let me paste the key contents into a field?

It's been several months since I looked into it, so maybe things have changed since, but I don't see why the browser has to be hooked up to my password manager through a mechanism that seemingly can't be user-piloted nor user-intercepted. How does a browser API require some external third-party software to be installed and configured to work?! It's a public/private key pair at the end of the day, right? Not some novel algorithm, protocol, or whatever. Why can't I simply tell the browser "here is where my existing passkeys reside; place any newly generated ones here as well"? Or perhaps "here is the program to call and here are the arguments to supply when you need to create and/or retrieve a given passkey"?

I don't think I have claimed the standard itself is locking anyone out - let me correct that if I did. I have just not found a way to not be locked out of the feature itself in the products of big players like Google - my Google account(s) being the one service where I feel like I could actually benefit from using passkeys over passwords (not to mention one of those I have seen pushing the "replace all your passwords with passkeys!" messaging).

To be specific, my password manager is http://passwordstore.org/, ("the standard Unix password manager").

Enforcing what? It's up to your email service to adopt the change. The way it currently works was probably okay for the early days of the internet when people had just started using emails, but now that so much private and sensitive financial information passes through your email account, it makes little sense that the same credential you use to login to your email account (email id) is also what you must use when some random website forces you to register in order to access it, just so they can send you massive volumes of unsolicited spam.

Certainly a simpler change with more potential to do good relative to the ease of enforcing a convoluted passkey-slash-usb-slash-save-this-file-somewhere-safe implementation

No. Sorry.

I don’t understand what will stop the users from using same passwords for both services

Then you've missed the point of the change entirely. Splitting email addresses into public and private-facing addresses is one thing. Reusing passwords is entirely another evin if both are related to securtity.