I don't like passkeys (hawksley.dev)

Article summary

The article discusses the limitations and potential drawbacks of passkeys, a technology promoted as a secure alternative to traditional passwords. While passkeys offer improved security against phishing and man-in-the-middle attacks, they can also lead to permanent account lockout, automated account bans, and device loss. The author argues that passkeys are better suited for corporate environments than personal security. The ecosystem for passkeys is not yet mature enough for individual users, with issues such as hardware key limitations and synced passkey management.

Main themes

• passkey limitations
• personal security vs corporate security
• hardware key management
• synced passkey issues
• user education and awareness
• password security alternatives
• industry standardization and interoperability
• user convenience and experience

What commenters say

• Passkeys are not ready for widespread adoption due to their complexity and potential for user lockout.
• The benefits of passkeys are outweighed by the risks of losing access to accounts.
• Passkeys are a solution to a specific problem, but they do not address the broader issue of password security.
• The industry should focus on educating users about passkey management and recovery options.
• Some users prefer passkeys for their convenience and security benefits, despite potential drawbacks.
• The use of hardware tokens could provide a more secure and user-friendly alternative to passkeys.
• The lack of standardization and interoperability in passkey implementation is a major obstacle to their adoption.
• Passkeys may not be suitable for all users, particularly those who are not tech-savvy or have limited access to devices.