Passkeys: don't stop them Passkeys: don't, stop them
this post was submitted on 14 Oct 2026
348 points (97.5% liked)
Linux
68100 readers
1014 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 7 years ago
MODERATORS
Meanwhile, half of the people at every company I've ever worked at:
If the computer is in even a marginally secure place, storing passwords on physical paper is better than what a lot of people do.
Of all the proverbial bullets I've been hit with, none had my name on them; they were all addressed "To whom it may concern". The times my identity has been stolen or my accounts compromised it was because somebody attacked some fairly large entity, like Alphabet or Equifax or Microsoft or Visa. Nobody's going to walk into my house looking for my passwords. They might walk into my house looking for my television, but that hasn't happened to this house longer than I've been alive.
Yep, there's a reason 2FA recovery keys are usually printed and stored safely.
With that said, one way to avoid someone compromising service A due to somebody breaking into service B is to have different passwords everywhere, so a Password Manager is more convenient anyway.
Which is why I use a password manager. There are some passwords that I do keep human readable and typeable, like my home wi-fi password, because...enter a password like ghQ953mGh0hY0eo5vgnj;lse%tp[n9a36 into my niece's Switch Lite when she comes to visit. For that I do the CorrectHorseBatteryStaple thing. But for most passwords for services that aren't in my physical control I use my PM's random string generator.
For home Wi-Fi I use a strong password, but that's because it's something I input once in a blue moon. For guests I have a guest Wi-Fi with a simpler* (still reasonably secure and random, but shorter and without special characters) password and a QR code for simple use, though they are rate limited and have no access to any other network clients.
So at a customer I found the following note. At the desk of an employee with the last name "Sun":
"'Sun' is user name and password!"
I wonder why we use passwords at all.
Oct0ber2026!
That's why you should never change your password. No one will think to guess @utumn2O23 in 2026.
The worst part of the left one is the implication they have only two passwords. The "under the keyboard" part at least requires physical access and (hopefully) means its not something stupid or short like "p@ssw0rd".
This is why passphrases are better than passwords. So the “Under the keyboard” can be used as password. It has 3 out of the 4 types to match complexity and plentiful for length. And so much easier ro remember. It could be also a quote from your favorite movie or book, part of a lyric of your favorite song, etc.
load more comments
(14 replies)
load more comments
(5 replies)
What a shitshow
The biggest problem I see is that it requires OS or browser integration. While possibly a better solution than simple passwords this feels like a vendor lock-in scheme.
You could store them in your password safe if it supports them?
Potentially the server can request hardware/software attestation that would limit the choice of password safe to approved ones only. We don't yet know how big/likely this could be, but in theory it's possible.
yup, and Netflix will use passkey attestation to make sure you can't share logins with other users
well, if I've seen a vendor lockin before, and I've seen a couple, they'll push them with open standards until they're accepted and normalized.
Then suddenly the big players like Google and Microsoft will block all the open platforms sighting "security" forcing businesses to adopt closed proprietary versions while touting their free and easy too use platforms.
then the monitize it.
they can already force your to install their app to receive a push notification (cough.. google...cough...). if they really want to lock you in they will. passkey or not.
load more comments
(1 replies)
Passkeys are greate as long you make sure you use a third party (partial) password app, like proton or bitwarden that works everywhere.
I think the worry is that if passkey attestation is required it will force people into a narrow set of authenticators controlled by the big orgs.
At this point in time it's not a problem, but how can we know it won't be in future?
This right here. KeepassXC (PC) already had passkey support for a while, KeepassDX (Android) recently implemented support. If you use FOSS implementations, vendor lock-in and potential future corporate enshittification are non-issues.
Until they only allow specific AAGUIDs to enroll passkeys that don't include the one used by KeePassXC (fdb141b2-5d84-443e-8a35-4698c205a502) or KeePassDX (eaecdef2-1c31-5634-8639-f1cbd9c00a08) because they don't consider them secure enough.
The argument from the "it's a trap" article is that the service you are registering to can use attestation to ensure that you are only using passkey managers that they approve.
I have to admit that I haven't investigated this thoroughly myself but if the protocol can be abused in that way then your only choice really would be not to use the service. If it is related to banking or government services then you may not have much of a choice.
load more comments
(3 replies)
load more comments
(12 replies)
load more comments
(2 replies)
They really aren't a trap. They're a well designed standard. The tooling around them isn't quite perfect yet, but they're a huge improvement over passwords.
People upvote because they hate change.
People upvote because they hate change.
People upvote because big tech has a tendency of forcing the most anti ownership outcome possible on everyone. Here, such an outcome likely would be mandatory passkeys that are set up to require hardware attestation.
One way to reduce that risk is to boycott passkeys until TPM and hardware attestation are removed from the standard. You may not think that's a fair response, or that such a boycott won't save us from the inevitable outcome, but nevertheless it's not a completely irrational reaction.
load more comments
(6 replies)
I’ve honestly not seen any benefits over passwords.
If I want to check my mail on a library computer, I can type in a password and I’m in. If it’s using passkeys I need an already logged-in smartphone - which I probably don’t have if I need that library computer in the first place. That’s just one example.
Personally I like Passkeys, and I enroll them in both my KeePassXC vault and on my two hardware keys (a primary Yubikey which I carry with me and a spare one at home).
It doesn't absolve one from neglecting proper security best practices (don't login on a system you don't trust, logout / clear cookies when done, etc), but a Passkey on a hardware key is much more difficult to phish or extract if you're using someone else's computer.
load more comments
(2 replies)
I only dislike the ability for service providers to enforce a “security level”. Those should be the exclusively under my (the user) control. Sending preferred default (hints) would be cool, but not enforcement.
That a webpage can basically prevent me from using a passkey if the passkey is stored in software (a password manager for example) is complete bullshit. Especially if there is still username/password as alternative which is clearly worse. Sure, hardware tokens are the ultimate security. But it should be up to me and not them if I want that level of security.
load more comments
(2 replies)
load more comments
(5 replies)
Passkeys are awesome. Developers not following the standard properly are a trap.
view more: next ›