upvote

points

by mingus886 hours ago |
comments
upvoteby coldpie6 hours ago|
next
[-]
Proton Pass is on the official Passkey client naughty list[1]. I hope the services you log in to don't choose to ban it because of those big, scary X's.

[1] https://passkeys.dev/docs/reference/known-issues/

reply
upvoteby corndoge6 hours ago|
parent|
next
[-]
The fact that services can ban passkey providers is a major red flag in the protocol and the real issue that nobody talks about

well, people are talking about it but it's not making a difference https://lucumr.pocoo.org/2025/9/2/passkeys/

reply
upvoteby duskdozer5 hours ago|
parent|
[-]
This is why I am so concerned about passkeys. They could be a good improvement, but in practice I already see how it's going to result in Google/Apple/Microsoft/whoever seizing even more control.

The document there is laughable too, because KeepassXC is listed as "not performing User Verification" when it demands manual authorization per request. But this isn't good enough for the passkey people. Ultimately, I see any FOSS option being effectively banned from most services and all important ones. It's a parallel to how you must now be on Cloudflare's nice list or be banned from the majority of the internet.

reply
upvoteby corndoge5 hours ago|
parent|
[-]
Yeah they're really trying to solve problems that should be solved at a technical level with soft solutions in porcelain. See also this issue asking keepassxc to disable plaintext exports, which is completely technically feasible

https://github.com/keepassxreboot/keepassxc/issues/10407

reply
upvoteby mlfreeman4 hours ago|
parent|
next
[-]
The author of this ticket seems to come across as an arrogant know-it-all that thinks "the threats i thought of (or personally face) are the only threats that are significant, fuck anyone in a different situation."

I proudly print my entire KDBX file including passkey private keys and I encourage my elderly parents to do so too.

Lightning strikes (and assisting people with cleanup and repair from them) have taught me that there are definitely a class of threats that will leave me with paper but possibly no technology until I can go buy a cheap laptop to restart my digital life, SO BEING ABLE TO BACK EVERYTHING UP IS ABSOLUTELY ESSENTIAL.

His website says he's in Boston, so I seriously doubt he's ever seen what lightning can do or dealt with a hurricane or tornado.

In general, if you're in the FIDO Alliance and had anything to do with the kind of micromanagement that passkeys can allow, FUCK YOU. Go get a job at Walmart as a greeter. We'll all be better off.

reply
upvoteby OkayPhysicist2 hours ago|
parent|
prev|
[-]
That issue was exactly why I took up my "Never use, under any circumstances" stance on passkeys. It is an indictment of the entire passkey project. I now routinely tell the less technical folks in my life, when asked about those weird passkey options, that they are the mark of the beast, and should be avoided at all costs.
reply
upvoteby summermusic6 hours ago|
parent|
prev|
[-]
(I might be wrong, please correct me if I am) What I'm gathering from this page is that the Passkey spec can specify whether the app handling the passkey should prompt the user for biometric scan, PIN code, etc. but some apps simply ignore that flag. This makes sense though. I've already logged into my password manager and it hasn't timed out yet, so why would my password manager prompt me again? I'm glad that they don't prompt me again when I'm already logged in. I don't see this as a problem.
reply
upvoteby coldpie5 hours ago|
parent|
next
[-]
Your understanding is correct and I agree with you. The Passkey spec authors, however, think services should be allowed to ban your client for behaving this way:

> [When UV is required, KeePassXC must request user verification or not handle the request]

> This implementation is not spec compliant and has the potential to be blocked by relying parties.

https://github.com/keepassxreboot/keepassxc/issues/10406

reply
upvoteby Telaneo2 hours ago|
parent|
[-]
> > This implementation is not spec compliant and has the potential to be blocked by relying parties.

The only conclusion I can come to when it comes to this and the earlier kerfuffle regarding being able to export the plain text of passkeys is 'the spec is bad and you should feel bad'.

reply
upvoteby coldpie1 hours ago|
parent|
[-]
Yeah, it sucks. It could've been a cool technology but they're so locked in to "my way or nothing" and won't consider other usecases or security trade-offs other than the ones they decided on. It's just a complete non-starter with that attitude.
reply
upvoteby duskdozer5 hours ago|
parent|
prev|
[-]
Right, not only are you authorized, but you are also prompted to manually complete the request, which will fail if you do not accept. However, this isn't considered sufficient by the passkey people, who do in fact want you to retype your password at each prompt.
reply
upvoteby juancn6 hours ago|
prev|
[-]
What if I lose all my apple devices? House break-in and they steal my mac and my phone?

You're basically fucked even if you buy a new one because you need one of the other two to log in.

reply
upvoteby dfabulich5 hours ago|
parent|
next
[-]
Then you'll login to your Apple iCloud account using your password.

Passkeys are just passwords that require a password manager; you can't login to a password manager without something outside the password manager, usually a password. (That's why they call it "LassPass" and "1Password"; there's one last password you'll still have to maintain.)

No password manager tries to get you to login with a passkey without setting a password, for precisely that reason. Apple, Google, and Microsoft do invite you to login to their password managers via passkey, because it's convenient and unphishable, but they always also allow you to login via password (or "backup codes", which are just backup passwords).

reply
upvoteby gretch6 hours ago|
parent|
prev|
[-]
No technology in the world can protect you against every threat model and unlikely scenario.

What if the robber hits you in the head and you get brain damage and forget your password?

reply
upvoteby pavon6 hours ago|
parent|
next
[-]
That is not a rare threat model. Many people use iPhones and Windows computers. Fortunately, Apple has released iCloud Passwords which lets you access passwords and passkeys from a Windows computer.
reply
upvoteby Melatonic57 minutes ago|
parent|
[-]
Did not know that - how well does it work?
reply
upvoteby TeMPOraL5 hours ago|
parent|
prev|
next
[-]
That's the point: passkeys, and even 2FA, address rare and unlikely threat scenarios, while defeating most common use cases (delegation by sharing credentials), and making people vulnerable to most common threats (like, losing or breaking your phone).
reply
upvoteby juancn4 hours ago|
parent|
prev|
next
[-]
A password has the best recovery process. Period. Write it down somewhere. It's up to me, no third party.

I had more trouble with a failed 2FA than with a password.

reply
upvoteby deejaaymac6 hours ago|
parent|
prev|
[-]
Master password to password vault stored on metal, buried in my backyard and I tell a family member where it is in case I ever get brain damage
reply
upvoteby gretch5 hours ago|
parent|
[-]
Family member gossips "that crazy [deejaaymac] always burying secrets in the backyard..."

Or straight up betrays you (you slighted them at some family event)

reply
upvoteby iamnothere2 hours ago|
parent|
[-]
If you marry someone you don’t trust, you’re going to have a lot more problems than password compromise.
reply