Passkeys Are Not Passwords

notes.neatnik.net

4 pointstodsacerdoti3 comments

I still don't get passkeys.

Even in this article the author says "don't worry about portability just set up a new one using the email fallback that almost every service provides".

But then what have I gained, if there is still an email fallback?

You've gained the convenience of not round-tripping through your email client every time you want to login/authenticate with the service!

The same is true of passwords, of course; if there's an email-based password-reset mechanism, then your email is your real proof of identity; the password is a shortcut.

Passkeys are a shortcut too; they just pick a different set of tradeoffs (less portable, less user-visible, more secure, harder to get phished, less stuff to remember). IMHO, these tradeoffs turn out to better-match the threat model of the modern web.

Right but before passkeys I was using password + phone confirmation.

So I see why passkeys improve on passwords, but not on 2fa.

Reply on news.ycombinator.com