You don't remember them you are not expected to moving from iOS to Android lets say generate new ones for your new device.

Well if your using a pasword manger instead of easily remmbered passwords your screwed either way. And considering the fast majority of people use the same password eveywhere and use a simple passowrd they are a big improvement.

There is nothing or should be from the standard stopping you having multiple passkeys. One on your phone one on your pc. Switch devices create new passkey for it. It isn't a password and people have to stop treating it as one. Now sites only allowing one is another issue.

******* you say?

Yep, very dumb... And no plans anywhere from anyone to genuinely fix it either.

So at a customer I found the following note. At the desk of an employee with the last name "Sun":

"'Sun' is user name and password!"

I wonder why we use passwords at all.

That's why you should never change your password. No one will think to guess @utumn2O23 in 2026.

You can't fit that many post-it notes under the keyboard though, so if they're doing the latter they're probably doing the former

Ain’t it 8 characters, and 15 for machine accounts?

I just read it yesterday but maybe it was an older entry

Mine also along with multiple new pin codes for our phones every 3 months. Its annoying as hell and makes people just use easier and more memorable passwords rather than sticking with harder ones for longer.

Until they only allow specific AAGUIDs to enroll passkeys that don't include the one used by KeePassXC (fdb141b2-5d84-443e-8a35-4698c205a502) or KeePassDX (eaecdef2-1c31-5634-8639-f1cbd9c00a08) because they don't consider them secure enough.

https://aaguid.nicolasuter.ch/

Personally I like Passkeys, and I enroll them in both my KeePassXC vault and on my two hardware keys (a primary Yubikey which I carry with me and a spare one at home).

It doesn't absolve one from neglecting proper security best practices (don't login on a system you don't trust, logout / clear cookies when done, etc), but a Passkey on a hardware key is much more difficult to phish or extract if you're using someone else's computer.

Question: do English native speakers also read "arstechnica" as "arsetechnica"

What a shitshow

I definitely read it like arse technica

Which is why I use a password manager. There are some passwords that I do keep human readable and typeable, like my home wi-fi password, because...enter a password like ghQ953mGh0hY0eo5vgnj;lse%tp[n9a36 into my niece's Switch Lite when she comes to visit. For that I do the CorrectHorseBatteryStaple thing. But for most passwords for services that aren't in my physical control I use my PM's random string generator.

For home Wi-Fi I use a strong password, but that's because it's something I input once in a blue moon. For guests I have a guest Wi-Fi with a simpler* (still reasonably secure and random, but shorter and without special characters) password and a QR code for simple use, though they are rate limited and have no access to any other network clients.

Yeah, that makes a lot of sense. I guess I meant for things where you need to actually memorize a password, like for the password manager.

But yeah for 99% of cases, a backed up KeePass database with randomly generated ridiculous passwords for every little service is fantastic. 👍

I can memorize the 8 words though, which is why I use that method for anything where I can't use keepass.

This is why passphrases are better than passwords. So the “Under the keyboard” can be used as password. It has 3 out of the 4 types to match complexity and plentiful for length. And so much easier ro remember. It could be also a quote from your favorite movie or book, part of a lyric of your favorite song, etc.

I would argue that is different because an Https server doesn't scale as much as a user login. Also, as someone that had to rely on things like "letsencryp" free certificates for personal servers, this is so annoying to setup and I hate that security needs a third party having to give me something for free and be able to stop giving it at any moment.

I do get the point on servers, is annoying but adds security to people visiting webs. but making this also a problem on the user login side is exactly why people hate this shit, and doesn't add any security for the users.

Passkeys: don't stop them
Passkeys: don't, stop them

This isn't necessarily bad,

I'm of the opinion that it is bad, from the perspective of the user. They are now locked into that company. It not bad from the perspective of the authentication provider, and the service provider may get a positive outcome of it from fewer breaches due to bad passwords.

The problem is the authentication provider isn't trust worthy.

Passkeys officially have TPM support: https://www.w3.org/TR/webauthn-2/#sctn-tpm-attestation Let's Encrypt doesn't require a TPM. Passkeys can apparently require an actual closed-up DRM anti user hardware component to sign what you're doing.

While Let's Encrypt requires an external party for signing, 1. it's not something the average citizen needs or uses a lot, unlike potentially passkeys, 2. there is no variant of it that works via special DRM hardware that they try to establish everyone as having.

Also, Let's Encrypt is a non-profit while the common Passkey server-side storage vendors don't seem to be.

Anyway, that's just my opinion.

But large companies that want customers? They want to make it as easy as possible for their customers to connect. They’re not going to force people to have a hardware device which if damaged or lost will lose them a customer. That’s just not what they want.

I would say this is already proven to be wrong, since Microsoft Windows appears to be already doing exactly that with the special hardware device "TPM": https://rossmanngroup.com/services/encrypted-data-recovery/bitlocker ...in regular customer machines.

This is the article that converted me into a TPM hater: https://www.gnu.org/philosophy/can-you-trust.en.html (And SystemD hater, since Lennard Poettering was employed by Microsoft for a while, the ones that control the TPM default signatures, and now apparently tries to get Linux to use secure boot signing everywhere. Very suspicious.)

Like, yeah, GNU/FSF tend to be radical with many opinions and that's not everyone's cup of tea. But I feel like this article has a point.

The TPM exists because it's useful to support use cases where you want your passkeys tied to a device. It isn't a Microsoft thing either. I run Linux - my computer has a TPM. I can't use it because Linux support for the TPM is weak still, but it's there! You probably have one too if your computer was made in the last decade.

By default, even on Windows, your website passkeys aren't stored in the TPM. No one is forcing you to store your passkeys on the TPM.

And they won't, because it's a bloody stupid idea that benefits no one.

Microsoft wants your passkeys synced across devices because that's how you get lock in. If the passkeys are stuck on the computer you made them on, then you may as well buy a Mac for your next computer because those passkeys are gone either way! If the passkeys are in Microsoft Password Manager though, now migrating to a Mac is harder.

Oh I know I have a TPM, yes. I blacklist all the Linux TPM modules though. Screw that thing.

there's formats other than TPM like Apple and FIDO U2F, so I don't think Apple, Yubikey (which chairs the standard's working group), and the password manager industry (which already does passkeys) would just let that happen.

it's not something the average citizen needs or uses a lot, unlike potentially passkeys

i would certainly say the average citizen uses HTTPS a lot

Let's Encrypt is a non-profit while the common Passkey server-side storage vendors don't seem to be

(context for onlookers: Let's Encrypt is the most popular certificate authority, while the analogous to attestation is the concept of certificate authorities and not any one certificate authority.)

Let's Encrypt was only founded in 2012 (and announced 2014) with general availability in 2016, while the current HTTPS standard with certificate authorities had been around since 2000. Passkeys, 2021. I think fairness is something the world needs.

Let’s Encrypt was only founded in 2012 (and announced 2014) with general availability in 2016,

I wouldn't agree HTTPS was unproblematic before Let's Encrypt existed, so I'm not sure where you are going with this. The average person doesn't need a HTTPS cert issued, which I would say is comparable to the average citizen using a passkey. If only some spaces, e.g. enterprise, use them then it's not a real problem. But that's why it seems problematic to me once passkeys are pushed for general use.

you’ve also missed the point of

I don't think that I did, but my apologies if that is the case.

no, i was saying Let's Encrypt solved HTTPS's problems. before it HTTPS had the problems people claim passkeys' attestation certificate chain has. it is very possible an authority equivalent to Let's Encrypt will come about within the 16 years after 2021.

the average person doesn't need an passkeys certificate issued either. using a passkey is the equivalent of HTTPS's TLS packets, not making a new certificate.

it is very possible an authority equivalent to Let’s Encrypt will come about

So why shouldn't we tell people to boycott the tech until then? Even then, that doesn't solve the threat of a hardware attestation toggle.

using a passkey is the equivalent of HTTPS’s TLS packets

I disagree.

why shouldn't we tell people to boycott the tech until then?

because attestation the conspiracy to use attestation has not activated and i believe the damage is too small even if it did; i've argued how TPM reliance would be impossible for a very long time.

that doesn't solve the threat of a hardware attestation toggle.

just like how Let's Encrypt made acquiring certs (essentially a requirement for new websites now thanks to HTTPS, just like what you say passkey attestation is) extremely easy, the equivalent for passkeys would make new attestation providers quite easy, since the equivalent authority would be trusted

I disagree.

Why so? What about passkey attestation requires each user to issue a certificate?