I’m a software engineer, but not a security expert. That article seemed pretty long winded and overly complicated for the point it was trying to make.
Regardless, I’m not a fan of passkeys as they are currently implemented. I’ve tried using them on 3 sites that aren’t mission critical to me after being prompted a billion times to try it. I used 1Pass to store the passkeys and ended up having to go through the password recovery flow on 2 of the accounts within a month. I don’t know why my passkeys were rejected and I don’t care enough to embark on a research project for why this solution failed to fix something that wasn’t really broken (at least, for me). Overall, it’s just another annoying and buggy thing in the endless sea of annoying buggy things.
Maybe. Do passwords vanish after you set up a passkey? I thought you were saying the server refused to sign you in, but it’s a bit sketchy if your password manager just chooses to replace secrets behind your back. Especially being different categories (password and passkey).
I set up a passkey and stored in 1pass, it worked for that 1st attempt. Time passes, I don’t recall if I’ve gone back to the site in the interim. I go to the site again and it errors on my passkey and I can no longer use my password. Thinking about it some more, I think my original password wasn’t deleted from 1pass so I my guess about 1pass being at fault isn’t right. But it’s possible that websites test for storing in iOS, Chrome and whatever the Android default is and anything else working is just luck.
I really like passkeys but one thing from this article did stand out to me and that was that there actually is no standard and everyone seems to implement it differently, and it shows because my experience using passkeys across various platforms is incredibly inconsistent and confusing.
I’m a software engineer, but not a security expert. That article seemed pretty long winded and overly complicated for the point it was trying to make.
Regardless, I’m not a fan of passkeys as they are currently implemented. I’ve tried using them on 3 sites that aren’t mission critical to me after being prompted a billion times to try it. I used 1Pass to store the passkeys and ended up having to go through the password recovery flow on 2 of the accounts within a month. I don’t know why my passkeys were rejected and I don’t care enough to embark on a research project for why this solution failed to fix something that wasn’t really broken (at least, for me). Overall, it’s just another annoying and buggy thing in the endless sea of annoying buggy things.
I have passkeys in many sites, but they are never the only sign in option. Username + pass + TOTP keep working as an alternative.
That wasn’t my experience but maybe 1pass defaults to only keeping one kind of credential per site?
Maybe. Do passwords vanish after you set up a passkey? I thought you were saying the server refused to sign you in, but it’s a bit sketchy if your password manager just chooses to replace secrets behind your back. Especially being different categories (password and passkey).
I set up a passkey and stored in 1pass, it worked for that 1st attempt. Time passes, I don’t recall if I’ve gone back to the site in the interim. I go to the site again and it errors on my passkey and I can no longer use my password. Thinking about it some more, I think my original password wasn’t deleted from 1pass so I my guess about 1pass being at fault isn’t right. But it’s possible that websites test for storing in iOS, Chrome and whatever the Android default is and anything else working is just luck.
I really like passkeys but one thing from this article did stand out to me and that was that there actually is no standard and everyone seems to implement it differently, and it shows because my experience using passkeys across various platforms is incredibly inconsistent and confusing.