I don't like passkeys
summary
Passkeys offer superior protection against phishing and data breaches, but they introduce unacceptable risks for individual users. The primary dangers are permanent account lockout and dependence on ecosystem lock-in from Big Tech providers. Until recovery methods and interoperability improve, traditional password managers with TOTP are more reliable. The current ecosystem prioritizes corporate security over personal flexibility.
key points
- Hardware keys are expensive and difficult to scale because they have limited storage for credentials and cannot be backed up. Users must purchase multiple keys for redundancy, which becomes impractical as the number of accounts grows.
- Synced passkeys create a single point of failure where an automated account ban from Apple or Google can lead to the loss of all third-party account access. The lack of a standardized, easy export method makes these credentials more fragile than simple text passwords.
- Using passkeys on unfamiliar devices is often frustrating and unreliable due to hardware port limitations or Bluetooth connectivity failures. This lack of seamless cross-platform utility makes them less practical for daily use than traditional login methods.
who should read it
Individuals concerned with digital security who are deciding whether to switch from password managers to passkeys. It is particularly useful for people who value account portability and independence from Big Tech ecosystems.
discussion skeptical
consensus
Commenters generally agree that while passkeys offer security benefits against phishing, their implementation is often aggressive and lacks respect for user consent. Many users find the 'nagging' prompts from companies like Amazon frustrating and believe that forced adoption can lead to lock-outs for non-technical users who accidentally enable them. There is a shared sentiment that passkeys are designed for the 'lowest common denominator' but create significant friction for power users and those managing shared accounts.
top insight
The most valuable insight is that passkeys fundamentally break the ability to easily delegate account access to trusted third parties, such as spouses. Unlike passwords, which can be shared via any channel, passkeys are designed to prevent the exact type of credential transfer that many families rely on for shared digital lives. This highlights a critical gap between technical security goals and real-world user needs.
Generated by an LLM from the article and thread. Check the sources before relying on it.