Passkeys replace passwords with encrypted key pairs that can’t be phished or leaked. Learn how FIDO2 and WebAuthn work, their pros and flaws.

Passkeys are built on the FIDO2 standard (CTAP2 + WebAuthn standards). They remove the shared secret, stop phishing at the source, and make credential-stuffing useless.

But adoption is still low, and interoperability between Apple, Google, and Microsoft isn’t seamless.

I broke down how passkeys work, their strengths, and what’s still missing

  • kjetil@lemmy.worldEnglish
    442·
    18 hours ago

    The biggest disadvantage:

    Disadvantages of Passkeys

    Ecosystem Lock-In – Passkey pairs are synced through each vendor’s respective clouds via end-to-end encryption to facilitate seamless access multiple devices.

    More eggs in the American megacorp basket for more people, yay

    • Doccool@lemmy.worldEnglish
      16·
      18 hours ago

      Currently I use a FOSS (I think?) password manager, BitWarden, that supports passkeys. I use it across Mac, Windows and Android so I’m while my passkeys are locked yo the password manager, I am not locked to any of the aforementioned megacorps.

      • kjetil@lemmy.worldEnglish
        5·
        13 hours ago

        I use BitWarden too. OS , device and browser agnostic is a win

        But I imagine the vast amount of people will use whatever their platform is pushing, so Apple Google or Microsoft. And in 5 years time “3rd party passkeys” are not “secure enough” and blocked by the OS. (Ok that’s a bit tinfoil hat, but Google’s recent Android app developer verification scheme is fresh in mind)

    • 3abas@lemmy.worldEnglish
      25·
      17 hours ago

      Your password hashes (assuming they even hash them) already live on their servers…