As far as I know using a password manager such as KeePassXC or Bitwarden solves all of these problems?
this post was submitted on 12 Oct 2026
220 points (84.4% liked)
Privacy
51387 readers
884 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 7 years ago
MODERATORS
An attempt to make an image describing where passkeys live: 
dude speaks about not being able to write down his passkey, then he acts like it can only be saved in bigtech clouds, then some random ai rumbling starts about ads being show to us? can you guys stop posting these god damn fearmongering password articles written by ai?
Please just stop using a service when it gets unbearable. There is no online service you -need- except maybe bank and tax stuff.
This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites. But the FIDO Alliance standard makes attestation a part of the passkey ecosystem, whether you want it or not. And even if the website doesn’t require attestation now, simply by using passkeys you indicate to the website that your setup supports the FIDO Alliance’s passkey standard and that you as a user are capable of using passkeys.9 This means that once Twitter (formally X) is satisfied that the overwhelming majority of its users would be unaffected, they can flip the switch – perhaps not all at once, perhaps just for ten thousand users at a time so as not to cause a fuss – and start rejecting non-attested passkeys.
Critically, remote attestation requires the co-operation of your cryptoprocessor, your passkey manager software, your device’s operating system, and your device’s firmware to all pass the remote attestation check. After all, your phone’s operating system has total access to all the 0s and 1s in every app that’s ever run, so it’s not enough for Twitter (formally X) to trust your passkey manager if it can’t even trust your phone’s underlying operating system. If any single one of those things were to fail – say, because your phone stopped receiving security updates so you installed a custom operating system like LineageOS to keep yourself safe without having to buy a new device – then Twitter (formally X) will be able to notice and prevent you from logging in.
Remote attestation can allow them to verify that your device is not capable of, say, sending and receiving encrypted messages, or running a competitor’s app, or using social media without verifying your ID. They don’t want you to be able to turn off the mandatory built-in AI image scanner on your phone that scans everything your phone sees for nudity. (Yes, I’m serious.)
The convenience of using passkeys is a double-edged sword.
This is also one of the ways Playstation stops you from installing Linux and other unauthorised software on the PS5.
It's wild seeing people spaz out over passkeys, clearly venting at something that isn't passkeys.
I suspected as much, being shoved on us like AI.
Zero trust is the end station, if you allow organizations to treat your personal devices as being theirs. Organizations that could actually benefit from the increased security (which isn't Twitter, except for some high-profile individuals, maybe), should provide the user with resources to do so, at their expense (issuing a dedicated TOTP device for example).
But what tends to happen instead, is enshittification of service, while offloading it onto the client. A similar trend can be observed with car parking: where operators remove parking meters, and require the customer to use their device and data plan, to make a payment to the operator...
We've been on this trajectory for quite a while now: from Outlook enforcing IT-policies of email administrators (dictating screen locking requirements as device administration app), to SMS-based 2FA requiring one to have a mobile phone number and tying all to this tamper-resistant identifier. So why not a black box snitch, paid for by the client, further restrict their freedom for "security"?
It seems perfectly in line, and I think this article draws all the right parallels.
finally people are waking up to this garbage.
I didn't even know what they were until now. And still don't. Every explanation sounds like a long convoluted MLM pitch. They smell fishy as hell. They may need more grameters to prevent side fumbling.
Passkeys mean a spread of enshittification to ever more areas of life. Specifically, they
- force me to use an extra OS on an extra device and keep it around just to use a site with passkeys.
- add insecurity and inconvenience. I neither can backup the passkeys nor use them on another device. (That's not implemented on Windows.) This user experience is laughable in 2026. The passkeys are forever locked on the device where I created them. I am forever chained to exactly one device. If it breaks down, my life ends because our lives depend on digital technology.
- take away control from me and force me to trust third parties. I have to trust the hardware, the OS, the proprietary software, which makes me feel very uncomfortable as someone used to use Free software. Security by obscurity was always a bad idea.
- deny me anonymity and control over my accounts. I can have only one account per domain.
- are a black box with no user interface. With passwords I know exactly what account name and password I enter at which site. With passkeys I get asked for a PIN. That is all. There is no indication what exactly I authorize. This is a lot like clicking links in emails and giving your banking details to everyone who asks.
The recommendation “do not use them” is cute. They are forced on people. I can't choose.
I'm not familiar with any of these limitations that you described. Those might be limitations of the specific credentials manager(s) that you're using. You might want to try a different one.
Yeah I'm confused. I also don't remember ever using a site tha would force use of passkeys. I always have standard TOTP alongside those.
some of this is disingenuous. For example you’re supposed to make multiple passkeys for your devices so that you can still Access your Accounts even if you lose your Main device (Ofc its still shitty because this forces you into the cloud if you only have 1). Also thats why the passkeys being bound to their „birthplace“ is Not really more of an issue than the others. Also im Not sure where they are forced? In fact i wish it would be more supported in certain apps
Indeed. Every device should get a passkey. Its like client certs where you can lose a device and just remove that passkey from your account. Also, you /can/ store passkeys in pure software. Bitwarden can store passkeys for example. Lots of options for FIDO keys too. I have never heard a non technical person give me a secure password strategy. That is 100% of nontechnical people I have asked use bad password schemes. Passkeys at least enforce a truly randomly generated key.
They still suck at usability but it is an attempt to solve a real problem. Basically the only thing standing between 99% of people and having all their accounts compromised is service password attempt rate limiting.
You think an everyday user will think this way?
Regardless of if a regular user will think this way or not, it is good to have options, precisely for providing them as an option to a regular user, even if they end up not implementing them. The other option is NOT having the option. Which one do you think is more beneficial across the board?
That's how they work, regardless of how users think. Though you're correct: the majority of computer users don't understand what they're doing and do feel threatened by change, even if that change is positive by any measure other than "I feel uneasy about changing something I have no grasp on".
load more comments
(2 replies)
So... Uh... What's a passkey? The article is saying they're pure evil. Everyone here is saying they're good. Everyone knows what they are except for me.
What's the difference between a passkey and a password?
Imagine if a romantic partner said "I will send you a unique string, probably exactly 8 characters" to verify that I am your partner. You would laugh and remind them it takes less than a second to generate every 8 character combination possible.
Instead, your SO makes a key and keeps it with them at all times, and you promise to talk to them using a machine that makes secret messages only their key can decipher. For fun, they give you a key and make a machine too... Explaining this shit is complicated I'm sorry for what you're about to read.
They send "heyy", You send "whatup", They send "send pics", You take one, encrypt and send the pic, They say "huh? Wtf?", You remind them about the secret key, They have no idea what you're talking about -fail OR they send something in return back (which you decrypt) -success
That's basically the same thing as authentication with a passkey oversimplified and only slightly wrong but good enough. There's shitloads of devices that do it, yubikeys, authenticator apps, but they're all doing that.
It's something you pass around--like a word, but a key instead. If you're familiar with passwords--instead of a word--imagine a key: a passkey. That's what passkeys are. The issue with passkeys is--as you pass them around they begin to open more and more stuff; everyone is opening stuff with your key as it's passed. So they need to be sanitized every now and then. Deposit them into a furnace and buy a new passkey. Every two to three days. If you have more questions please feel free to ask!
Password is a shared secret: When you want me to prove myself, i repeat the password we both know. Both of us could loose that password and it happens every day. Can't go a day without a major data breach news.
passkeys use public-private keys. Anyone can posses the public key, so that is ok to leak. The private key you keep to yourself. When you ask me to prove myself, you hand me a challange which i manipulate with my private key and hand back to you. You check it with the public key and conclude that i am indeed the one that posseses the private key. Mathematical magic! The private key was never shared.
For the user, the password is replaced with a file stored somewhere. Either in your usb security key or in your password manager of choice. Stored in a security key (aka authenticator), the private key never leaves the authenticator and all cryptographic operations are done inside it. The private key can't leak. Amazing! Passkes in a security key are called hardware bound, very secure and nice. The security key, you can plug out and take with you. There are built in hardware like this in phones and computers. But you can't take that with you. That sucks. They only authenticate that device. But you can make any number of passkes for all your devices.
The bad part is that some big corporatins would like to control where and how you can store the passkeys and preferably make it harder for you to escape them. The solution is to not use the services of these malicious corpos.
Nice explanation!
Can you elaborate on this part?
some big corporatins would like to control where and how you can store the passkeys
Attestation means that whatever code runs on your authenticator has been submitted to the FIDO Alliance (google and buddies) and they signed off on it. After that it can't be changed.
Security keys like the Solokey Hacker (the superior version), is not signed and never will be, cause I can tinker with it in any way I wish. It's truly mine.
Like the article highlights, attestation is part of the standard. The remote service can ask for cryptographic proof that your authenticator, where you stored your passkey, is attested. I have not seen any service doing that so far. IT managers are doing that internally, for their employees for sure. They don't trust bobs homemade solution, only their chosen vendors. From that standpoint it's reasonable.
This gives the service the power to deny you freedom of choice of where to store your passkey. They might say only yubikeys allowed or only microsoft hello or only IOS secure enclave or whatever they wish. It might become a scenario where they don't allow any passkey solution that can run outside their platform. Running LineagOS or Linux? Google and microsoft will say it's "not secure enough".
They will abuse that power to make your decision for you and lock you in. "Password manager not allowed, Use our cloud insted".
Ideally it's not part of the standard and they don't get the option of knowing anything about your authenticator. It's none of their bussines how i choose to store my secrets.
Any sane service will just not ask about the attestation. They don't have to ask. I would not ask my users on my webpage. You can store your passkeys on printed paper for all i care. Although, storing them on a usb/nfc key is pretty damn secure and cool!
Personal anecdote to illustrate: the last time I tried creating and using passkeys for my Google account, I got the impression they (Google) would only accept keys coming from either Google Authenticator (their 2fa smartphone app) or something like macos's built-in keychain. No way to give them a key generated using a local, offline service that I could store however I want - it needed to be accessible using, basically, a big corpo['s software] as the intermediary. This coming from how their website would request the keys from my browser (which means mozilla seem to be in on it as well :/).
Given that I currently use a pure file-based password manager that I can move around and switch the keys for as I please, the current state of passkeys feels like a step back in terms of allowing me to control my digital identities.
So in order to log into most websites, you need your username/email address and a password.
You can save your username/password in your web browser or in the cloud.
Sometimes people get lazy and reuse passwords, sometimes people forget their passwords.
Passkey is a replacement for usernames/passwords. It does require that the passkey is saved somewhere, often on your device (in the cloud is possible, but non-standard).
When you "create" a passkey, this passkey is used only at a single place. For example, you'd have a passkey for your bank, another one for your email, another one for Lemmy. You have no say in the matter, that's just how it works.
When you log into a website that has passkey enabled, your passkey/password manager pops up, you click on the passkey and that's it. There is no email address, there is no password, no MFA.
edit: oh, you also asked about the difference between passwords.
It's all about improved security.
You go to certain websites, and they'll only allow a-zA-Z0-9, others require a minimum length of 8 characters, needs 3 symbols (except ! for whatever reason ;)
Then you have no idea how the website is storing your password. Are they encrypting it? Did they do it correctly?
If you look at the number of "breached/leaked" passwords on the internet, it's because it's hard to securely store passwords.
Passkey solves all this. Websites are just given "a public key" and it can be "just stored", no special treatment necessary.
load more comments
(9 replies)
load more comments
(4 replies)
Despite the attention-grabbing headline, the only negative thing I can find in the article about passkeys are this section:
Attested passkeys7 are the last but most important type of passkeys you need to know about. These types of keys use what’s known as remote attestation to cryptographically verify – using the aforementioned tamper-proof cryptoprocessor that lives in all your modern devices – that you are using one of the several approved passkey managers, and not using a custom one that you vibecoded yourself and which can lie.
This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites.
I don't see why we should assume this hypothetical is going to happen. There is a lot of different software that supports passkeys (I use keepass for example), and going against the open standard and forcing all their users to use a specific software would basically make them unusable.
Overall every password / login style has its dangers and bad ways to use it, including passkeys. That doesn't make them "traps".
Ooohh, don’t think corpos and banks won’t go for that hypothetical. A lot of apps already turn haywire if you have developer options enabled, accessibility options enabled, have a specific installed or using a custom ROM. If the optional attestation is enforced by your bank that they only accept passkeys from google’s password manager or apple passwords, then using something like Keepass or Bitwarden isn’t an option.
Look… I love passkeys. They are convenient and more secure. But if a service cares about on what device and software it was created then it is pointless and just an ecosystem lockdown mechanism.
The only area I could really see this taking off is with internal company stuff. Like forcing employees to use a very specific and weird way to do 2FA is already a thing in a lot of companies. They won't let you just use any old authenticator app. You need the "special" one that sucks ass. So maybe they'll do the same to passkeys, but for normal users I don't think they'd do that. Users are way too bad at doing things. It would cause too much of a tech support burden or just user bleed.
load more comments
(4 replies)
view more: next ›