A rebuttal to an anti-passkey, pro-TOTP post that has made the rounds on Lemmy as well.

Not much of a rebuttal imho. We still have the problem that passkeys are ok in theory, but in practice they're being pushed as a way to increase lock-in and don't offer compelling advantages over well-managed passwords.

But most people don't have well managed passwords. And me having good password hygiene doesn't stop my data being hacked when someone working at a subcontracting firm to a company I use leaks all my data.

It also is annoying to have to log in over many steps with 2fa, often forced to email or SMS.

Collectively improving security benefits us all.

I think the point about lusers not being able to manage passwords has been argued to death elsewhere, so I won't take issue with that.

me having good password hygiene doesn't stop my data being hacked when someone working at a subcontracting firm to a company I use leaks all my data

What has this to do with passkeys? Are you sending your password in plaintext to the contractor who stores it that way, unencrypted? That's a separate problem entirely. The only benefit I see with just sending them your public key is that they can't leak your private key, whereas if you used one password for everything, and sent it to them, they could leak it.

Am I missing something? Would passkeys offer an advantage over a password manager? What if the website assigns you a password via DH so that users can't pick bad ones or reuse them, would it have the same advantages?

2FA can be super annoying, but again I think it's a separate issue. If I get control of your phone or laptop then 2FA might save you, but passkeys won't.

Why would I want a convenient passkey stored securely inside my password manager if I can just, much more conventiently, lock myself out of my account by losing my phone?

What is the difference from two factor with aegis + random generated password with keepassxc, and passkey saved on keepassxc.

The author of this post works in Apple, Passwords team. They do not deny that there’s attestation; they argue that it’s only used to prevent bad actors.

Cool, we’ll trust corporations then!

But that's exactly the problem. Those that were the target audience for the article do not have well managed passwords. For them the passkeys arguably do increase security, while having a bit more "lock-in".

For those that have well managed passwords (like probably most in this community), they are perfectly fine to use because they don't have lock-in either. I have full control over my used passkeys.

Basically you're not getting the "normies" to use proper password management, and for them they do provide additional security and convenience. They can always add more passkeys on different vendors, you're not limited to just 1 per service. Yes, adding them is a hassle, but so it's managing passwords and following higher security standards in general.

There isn't one. That's exactly the point. The original article had issues with vendor-specific passkeys (Google, Apple) that essentially are only accessible through their ecosystem.

Corporations never, ever, act badly!

It is not like they are treated as people with rights but fewer consequences for their actions, right? Right, guys?

It sounds like they're saying that if you can manage your passwords then do so yourself and avoid passkeys, but if you can't/don't want to then use passkeys.

And they are pointing out that the company is far more likely to lose your password than you are.

Convenience vs security, but the weakest link is probably not the user.

no, fuck passkeys. they will lock everyone in with their proprietary bullshit.

use a good generated password in a manager if you will. don't trust anything corps are pushing.

a way to increase lock-in

Lock-in was already being achieved by mandatory use of apps which require iOS or Google Play services.

Plenty of banks etc which I can simply not use because of this requirement, and others which downgrade you to password+SMS security (used to be a physical TOTP token) if you refuse their app.

You don't need passkeys if you don't have anything important to steal, or any accounts on anything you would feel sad to lose. Just cancel all your subscriptions and sail the high seas! Nobody likes you anyway!

Don't put it in your phone?

How do they increase lock in?

What propietary bs? It's an open standard.

the www is also an open standard, and google controls it through chrome.

I've had trouble with them with my gear.

I intend to continue with keepassxc wherever possible until compatibility is built out.

1. Describing TOTP as a “great solution” for adding security to a password-based account. When the most common threat model on the web is phishing (a word the post never mentions!), TOTP hardly buys you anything. TOTP is phishable.

If (after decades of awareness) you manage to get phished while using TOTP, you shouldn't be trusted with a phone or any digital information at all

True story … take it as you like,

my 8 months old reddit account was filter flagged as a bot after commenting the following

“death to the Epstein class and fuck Israel the genocide state”

The only way to get it back according to reddit was if i used IOS authentication passkey.

Not the normal password manager i use on Firefox but no it must be passkey on ios.

Now i am convinced that 8200 unit of the Zionist regime have my facial biometrics.

that's quite a leap.

Yes google does have a lot of control over the HTML and HTTP specs because they control the most popular web browser. Whether people are or will in the future be "locked in" to google for that reason is debatable.

Regardless, the potential for a company to dominate the implementation of a specification is not a reason not to create said specification.

Granted. But there are plenty of users who probably shouldn't be trusted with any digital accounts, but they still have to use them for daily life. If we can make it harder for them to mess up we should.

Passkeys have inherent advantages over passwords. They are more secure.

1. Public-private cryptography vs shared secret
2. They can be stored in an authenticator that can never leak your private key.
3. You can have many passkeys for the same account and they are all unique and can be revoked individually.
4. Can be put in a password manager. (less secure, but still better than password. see point 1)

The standard requiring the authenticator to report attestation if asked, opens up for abuse though.

Even if the standard allows them asking for attestation; the nice thing is that they can't force the passkey in to protected storage, as long as there is a browser like firefox in between you and them. (don't use non free apps) So store all your passkeys how you wish and the day they start asking you to replace those passkeys with their better storage options, you just don't. If they lock you out of your account, then stop using their service.
Don't use shitty services when they abuse you.

They are turning off passwords before they start asking for attested authenticators anyway. So might as well enjoy the convenience of passkeys while they are working like you want them to.

Agreed. Even if you trust her words, she's only one person and Apple could override any decisions she makes.

It makes me wonder about the people in Google who worked for, maintained, and advocated the openness of Android. Only now for Google to continually lock it down.

and they would never violate your trust and later force this onto you because the love their users.

the more apologetics for this shit i see, the less i trust it.

I’m saying that bad user passwords allow data to be hacked. When it’s the credentials of someone with access, like an employee of companies with your data, then that data is more easily compromised if they have crappy passwords. It’s harder to compromise with passkeys. It is not just your password hygiene that protects your data.

Here is a recent example in Australia.
https://www.abc.net.au/news/2026-10-06/asos-app-users-sent-hacked-message/107236520

Regardless, the potential for a company to dominate the implementation of a specification is not a reason not to create said specification

yes it is

A passkey is just traditional PKI in a trench coat, your biometrics are A) not even required as you can just use a PIN and B) are not sent from iOS when unlocking the passkey.

Phished doesn’t mean just a plain old phone call or email these days. It can still happen, and does. But there are now reverse proxy systems that clone legit web pages to steal TOTP by appearing legit, and they’re highly successful.

I'm using GNU pass, it doesn't support passkeys. I'm using Arch with Firefox. When a site requesting a passkey, Firefox says touch the key. I don't know what to do so I cancel the process and search for a workaround.

For example npmjs.org, they require passkey for publishing packages, so I rather have to create an API token which supposed to be for CICDs and publish the package with that instead.

It's f*cking awkward. I have a secure password manager, offline, nowhere shared, even the passwords are encrypted. Don't force passkeys on me for no reason, I was secure before as well. And even if you do, at least it should work. As always Linux users left behind.

The problem is that if they're getting phished with TOTPs then they'll walk through a scammer over the phone to let them access their accounts other ways.

You can put all the security in place all you want but 99% of breaches aren't coming from red team actors "hacking" into a system. It's way easier (and even moreso now with LLMs able to do robo calls with human sounding voices) and get Brian from accounting to give up his shit...or even the CEO to give up his.

I've seen it all, they willfully will give over their access because they're dumb as fuck.

"Even the passwords are encrypted" I would certainly hope so! Seems like the bare minimum for a password manager 😄

I get the anti-phishing notion, but they are buggy pieces of shit so you can't use them even if you wanted to

Yeah, I am not sure about the part of its not being sent

The passkey won't work on a lookalike phishing site, but the password and totp can be inputted into it

I love how you provided no rebuttal to my two points. The EFF even goes into detail on how it works. The beauty of an open standard is that you can verify these assumptions of yours.

would be nice, but apparently i do not exist according to my bank without a phone on my person 24/7

Yeah but most of them are just opened up and stays like that, e.g. I open an app and it can read my gnome keyring passwords

I don't need to, if you read my comment again you would understand my point.

But let me try to breakdown what i mean;
you need to wake up from your lala land,
if you truly think and believe corporations that are actively participating in genocide and killing children will really care about “policies and terms of usage”.

Your statement reads like someone who used to believe the “don't be evil“ google policy citing it as evidence in his head.

If that is how you stand, then good for you, but i don't, actually i view such corporations as a dangerous entities to humanity.

Hope its clear for you now.

The "normies" don't have a clue what passkeys are either.

So we shouldn't have created HTTP because Google might appear?

we should have learned our lesson after they did and done our damndest to create protocols immune to capture. there were excuses in 1989, there aren’t now

I misread your second sentence as "my 8 month old's reddit account" and was confused when there was no payoff to the premise of the shitpost.

I have a basic question, I learned that MFA should draw from multiples of "things you have" (totp) and "things you know" (passwords). There's all this talk of passkeys replacing passwords, but aren't passkeys in the "thing you have" category, not the "thing you know" category? My worry is that an unlocked computer or unlocked phone will let someone access ALL of a person's accounts because now they have the thing and don't need you at all. Putting access to my entire digital life behind my 4-9 point lock symbol? Or worse, a fingerprint?

The idea is that they Cross the Mark on thing you have and certainty on who you are saying you are. The latter comes in the Form of biometric authentication for normies Like Face/touch id

Can we Not Act like only idiots can get phished? Nobody is Safe, especially when the phishing attempt is incredibly convincing

Nah, lock-in is not a safety feature. 16+ random chars are plenty, and if cracking gets better I'll go to 20 or 30 chars. My pw manager doesn't care what strings go in it or which device opens it up.

I have a secure password manager, offline, nowhere shared, even the passwords are encrypted.

How can the service provider tell, though?

The point of passkeys is to create an authentication flow that is easier for users to keep secure. The question, then, becomes whether a service provider should make user authentication decisions based on the worst case scenario, best case scenario, or average case scenario. Passkeys are a reasonable way to make sure almost all of your users have secure login credentials, even if the best of the best users would have just as secure login credentials with traditional passphrases.

You can have passkeys on multiple devices. I use them on different platforms for the same sites.

I have been hesitant in the same way. I have not until recently understood where the passkeys are stored, and then understood that they then become a “thing tou have”. The passkey is stored on my computer, I prove I have access to my computer, and that is the authentication.

I am still hestitant since it often is just one factor, and I feel I have to manage them much more carefully.