Passkeys are a fantastic technology. Since they are bound to the site they are created for, they cannot be phished by a hacker’s fake login screen. If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details.
This leads to passkeys being the perfect fit for a corporate environment, but a poor fit for personal security. To an individual, the greatest risks are instead permanent account lockout, automated account bans, and device loss. By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts.
Phishing through the standard login flow is eliminated by passkeys, but it creates a false sense of security. An account’s security is still dictated by the weakest recovery method: SMS, email links, security questions, and so on. If these recovery methods aren’t enabled, then the risk of permanent lockout remains for the user.
↫ Ethan Hawksley
I’ve always felt something was off about passkeys, and have never used them. They’ve become – or were always intended to be – tools for further lock-in by especially Google and Apple, tying their entire usage flow to their respective operating systems. They also don’t seem to work well if you often work on devices not your own, which is a major hassle. None of these shortcomings come into play when using a traditional password manager, even if they require more manual work.
Just let me use a password manager with random password generation, instead of trying to force passkeys down my throat.
This is almost word for word how I feel about them. I’m okay with fingerprint security on my phone for a few specific apps, but for everything else they are indeed just a hassle. We use traditional desktop workstations almost exclusively at work, and the few laptops in regular use aren’t Surface or Mac devices so they don’t have cameras “good enough” for facial recognition passkeys. We use SMS and email based 2FA for the accounts that require it, and only four of us — the company owner/president, her managing partner, our online sales manager, and myself — are set up for 2FA. If a regular employee needs to log in to a 2FA enabled service, she will have to get the code from one of us. As for passwords, I keep all of those on my phone, with a backup vault on my workstation that my bosses know how to access if they can’t reach me for any reason, another vault on our file server, and backed up again at home on a secure flash drive, all synced daily. Archaic? Yes, but it has worked for the past 16 years I’ve been sysadmin at that job. Before I worked there, password resets were a weekly activity because they simply didn’t know what a password manager was.
At home all of my devices run Linux, BSD, or Haiku, and they are all desktops, really old laptops, or SBCs. One laptop in my collection does have a fingerprint reader, but I have it turned off in BIOS settings because even if I wanted to use it for 2FA, it’s annoyingly inaccurate and only has drivers for Windows and Linux.
Hmm you always need a reset method, that’s the same with passwords and passkeys.
I have my passkeys in Bitwarden, very convenient.
Passkeys are basically FIDO2 2FA but with a higher level of “store a unique ID for the device” authentication substituting for the username.
…so if there IS a pro to them, it’s that they generally mean the site will also support using something like https://www.yubico.com/ca/product/security-key-series/security-key-nfc-by-yubico-black/ for 2FA.