I do appreciate that passkey adoption has led to wider support for hardware security tokens for sites where I actually care about increased security over password managers, however.
The benefit of a passkey here isn't zero but it's at the minimum.
Meanwhile there are other security benefits as well. With a password, that static credential is transmitted in the handshake. It can be mishandled somewhere in between, and now that entire root credential is potentially compromised. This is just impossible with a passkey. The credential never leaves the client. In some implementations, the credential never leaves a secure enclave, never even entering the client's system memory. You can't say the same for passwords, not even close.
> password doesn't show up you know there's a problem
Here is your contradiction.
The normal person will just assume that some tech isn't working today again.
A key point of passkeys seems to be that it guarantees to the site owner that the user cannot be phished, without having to make assumptions on whether the user is tech-stupid.
Well gee how nice for the site owner.
Problem is my priorities are my absolute ability to never lose my most critical assets through some means outside my control, not the site's convenience.
It was ok to use imperfect systems back in the days when the bank and the store and even the government all had a desk a mile away you could go to in person and get anything cleared up and override all possible "usually it works like this" with your physical presense an drivers licence and birth certificate or simply 5 people who all attest they know you.
We no longer have that ultimate backup plan, so really F anyone's attempt to justify basically tricking people into doing something unwise that puts them at actually greater risk because their life is less under their own control, and doing this under the very banner of claiming to care about the users safety!
It's freaking amazing.
If someone only ever saved passwords from the browser UI they really could have no idea how to manually copy a password, while getting along fine.
In my experience this simply didn’t happen. Many sites support passkeys but only the native passkey stored on the current device, but not a hardware security key. Many sites don’t even allow multiple passkeys, which is frankly required if you use hardware security because you will want multiple pieces of hardware in case one is misplaced.
That's a function of your browser, not the site.
Your point about multiple passkeys is valid though. That affects me too. I use multiple hardware keys but cannot enroll many sites because of this.
What's the point of a passkey that can technically be exfiltrated off a device it was created on? I thought the whole premise of passkeys is that they can't be copied, and hence can be trusted as much as the device access control. Am I missing something?
I think that is a big step down from the convenience and friction level that the native password managers get you, where you save your password once and for the rest of your life, as long as you maintain fealty to Apple/Google/Microsoft, your password will always be there in autofill.
In typical scenarios, passkeys offer no advantages over a password manager.
Fairly frequently, I find myself searching for the password manager entry I want, and copying the username or password.
For a while, I was very consistent in trying to fix the URLs for that password manager entry, every time it happened. But when I'm on mobile, sometimes it's just a pain.
There are quite a few scenarios - I'm logging into an app, and it doesn't use a browser window for authentication, but also logs out after a few weeks, I've been redirected to Microsoft or similar for the login, but I haven't added microsoft.com as a URL for my work login, or GitHub (I could be wrong about this example), etc.
When I list them, these reasons seem like I should have solved them already. I used to try to keep my password manager tidy, but when I'm at 674 entries and it's growing faster than I'm cleaning.
I also think Passkeys are a confusing mess, and I don't mind the idea in addition to a password/TOTP option, but definitely not instead. I do like having it as an option for Google, where I have occasionally encountered a scenario where I login from overseas, and can't login despite having everything they can possibly want (username, password, backup email, etc.). I can't remember the exact details now, so I hope I'm not being uncharitable to Google's login/lockout process, but I doubt it!
I don't exactly understand what you mean but it seems more like a problem with the auth token.
1. In practice everything that saves a passkey requires a biometric to unlock each time, so you SHOULD not be required to use another factor (the secret is “something you have” and the bio is “something you are.” In practice though, now every F—-ing site insists on the damn “we emailed you a code” BS.
2. Passkeys certainly don’t need to be changed every arbitrary period like some idiotic sites (or IT admins) insist for passwords.
3. If one becomes compromised, you can revoke just the one. Unlike a password.
For the people already using password managers, it's not a huge step to get a Yubikey and use that for hardware-backed passkeys.