Until laws surrounding biometrics are changed, I personally won't move to passkeys. There have been cases where biometrics have been protected under the same category as pins and passwords but there have also been cases where it was not.
https://www.concordlawschool.edu/blog/constitutional-law/fif...
First it was "use complex passwords" so passwords got harder to remember, but it was doable. Then it was "don't reuse your passwords" and I'd made a good show of it by dreaming up 3-4 distinct passwords that I rotated in different services. Then I started managing my accounts in an app because I had too many to manually/mentally track. Then it was "use a password manager" and so as I transitioned to the password manager, I had it generate very strong random passwords that I had no hope of remembering, much less typing in manually.
So I don't remember any passwords anymore and I couldn't remember them if I tried. I couldn't even type them (although I could transition to a "correct horse battery staple" method instead.) And I'm beholden to my password manager, plus my Yubikeys plus my phone plus my email, due to disparate mandatory MFA challenges.
Authentication has become really splintered and really complex. It's ridiculous to insist in this day and age that a password is "something you know" unless it's a master password to unlock your vault or your employer's SSO or something. So that ship has sailed, sorry to inform you!
You are making a lot of generalizations about how people interact with passwords. I don't have a single Yubikey, I use Aegis on android that allows me to generate codes and self manage backups of my 2FA secrets. It even supports DUO 2F, but I don't mess with DUO accounts because they are hotp and not totp so you will run into sync issues if your aren't careful. I do have the secret key backed up though.
My passwords are something I know. More importantly, even if you use a password manager, your master password is still something you know in the eyes of the law. That covers all passwords that are accessed using a master password as something you know. That's the whole point of multifactor, the second factor is irrelevant without the first. I could surrender all of the 2F secrets and it still wouldn't matter because a password is something I know.
Not knowing your passwords is a choice, which you are free to make, I made the opposite choice. I can understand not wanting to remember every password, but it's worth creating self chosen passwords for the critical accounts like google, microsoft, github, and financials, in my opinion. I use biometrics for my mobile OS, but biometrics are only enabled after first unlocking the phone with the pin/password. I use a traditional password for my pc.
Incidently, having "a system" is one of the things that has been repeatedly advised against, as it weakens your security significantly.
I have one too actually (for some accounts), but I recognise I am a/ not the norm at all and b/ definitely not following security best practices. But I estimate (maybe wrongly) that my theat model allows me to take such shortcuts.
It's absolutely possible to have a system without weakning security. But that might fundamentally have the same considerations that rolling your own crypto solution would. I was thinking about those very same mistakes when making my system. I expected that a technical crowd like HN would care about stricter privacy, but I continue to be surprised.
The threat model I assume is the reason why I would never use passkeys. From the responses I have gotten, my threat model seems stricter than average. Using a manager generated password feels like security through obscurity. As does using a single point of failure piece of hardware where I can't backup the secret. I don't want to use a "virtual" passkey that is attached to a MS or Google or Apple login, especially for replacing passwords. A secret I don't control isn't my secret, similar to the idea of not your keys not your wallet when dealing with cryptocurrency. In this case, there's a very real price of privacy to pay for convenience.
I would personally feel far less secure replacing my master password with a passkey, especially if the biometric is fingerprint.
But I guess this increases security for the vast majority of people while decreasing security for a small minority. Which is probably still an overall win.
I’ll continue using a strong master password for as long as it’s possible.
Did you read the linked article? 1Password is allowing users to avoid having a master password at all, instead allowing them to use only biometrics to access their vaults. So this specific implementation that we're talking about right now very much has something to do with biometrics.
> Your biometric data is not the passkey.
Never said it was.
> is only used for local authentication, and does not leave the device.
Not my concern. My concern is that my biometric data is public. The same fingerprint that would unlock my phone/laptop also happens to be plastered all over said devices as well as everything else I touch. Plenty of videos on YouTube where people have lifted fingerprints and unlocked devices. Most facial recognition technologies can be fooled with a photo. I have a serious issue with someone being able to access my 1Password vault without needing a secret such as a password that only I know. FaceID is probably the only technology I'd trust to prevent unauthorised access, but as the parent mentioned, biometrics are a bit of a grey area - in certain countries / jurisdictions you can be forced to unlock a device using biometrics even if it's illegal to force a password out of you.