Passwords have problems, but passkeys have more

A decent alternative to passkeys, if you need the extra layer of security, is to lean on email for the first login from a new device. Treating email as a second factor, but only on the first login from that device. Everyone has email, everyone understands email.

This is truly terrible advice. Most people use the same or very similar passwords across services, suggesting to rely on email for secondary authentication is like locking a safe in a room, then putting the key to the safe in the same room. Sure you still need to break into the room, but once you've done that you can easily find the key and break into the next thing.

And the solutions, like scanning a QR code with a separate device, are cumbersome and alien to most users.

Is it? Maybe I'm biased because we use such a solution in Sweden to sign into literally all government services, banks, insurance, even some third party services, etc. We cannot use a username/password combo, our only option is to sign in using our personal number (equivalent to social security number) and authenticating via the app that is issued via our banks.

If literally our entire nation can do this, including most old people, then I'm sure people can learn to use passkeys efficiently.

I had thought that passkeys would be the saviour of my elderly parents password woes. Even with a vault that's the easiest to work with (BitWarden), they're forever not being able to use it and going through password reset flows that they then don't do correctly, and we end up where the old password doesn't work, and the new one doesn't either because they didn't do the reset correctly.

So I started looking at passkeys for a couple of my own accounts, and there's no way they'd be able to cope with this. It'd be far more complex and confusing for them, and that's even before we get to the problem of not everything supporting them, and (at the time -- there are partial foss solutions to this now) extreme vendor lock in , but they have a multi OS environment, Mac, Android, ChromeOS and iOS.

So back to managing BitWarden it is.

For what it's worth, I use KeepassXC with Firefox as my Passkey provider for the couple of accounts I enabled it for. This allows me to use my passkey login through my Keepass vault, on both Linux and Mac OS, though not Android sadly. Still, the fact that it's in my vault, under my control, and works on my desktops and laptop machines, is good enough. I expect it'd work fine on Windows too.

Passkeys are not ready for the hoi polloi yet. Or, perhaps anyone.

I agree that passkeys have problems in terms of usability, but from a technical standpoint they’re a lot more secure than passwords. There are other solutions though, like Bitwarden, that lets you store and use your passkeys on any device.

I also recently saw that the FIDO alliance are making a standard that aims to make it easy for passkeys to be moved between platforms. FIDO Alliance Publishes New Specifications to Promote User Choice and Enhanced UX for Passkeys

Apart from the uniquely bad advice on using Email-As-Authentication patterns, the things DHH is talking about are just straight up untrue. I am in the position of using a Windows computer and iCloud Keychain, a situation DHH postulates is not pleasant or smooth to solve. And yet, when I log onto GitHub with a passkey, my computer first checks for a passkey in Hello, doesn't find one, and presents me with a simple QR code I scan with my phone, which verifies me using the Face ID scanner, and Bob's your uncle. It works flawlessly, every time, even though the truly anaemic bluetooth stack Windows comes with.

In fact, Passkeys would have never been implemented by anyone if that wasn't how it worked. A world in which Passkeys do not fall back to mobile auth methods of yesterday is a world that will never use Passkeys at all. It would be a hassle. And if you think that's the case, I can see why you'd write an article like this.

But it's simply not true. Not only do Passkeys work on every modern device that's reasonably up to date, they're more or less idiot proof, can't be forgotten, are easily created, and handled in a secure way by default. Nobody is storing their Passkeys in the notes field of their own contact card, a horrifying practice that I've seen more than once with classic passwords.

And no, having a phone as a requirement does not disqualify the method of entry. DHH says that everyone has email and everyone understands email - same here. Everyone has a smartphone, everyone knows how to use it, and the people that don't are either nerds that are smart enough to make things harder for themselves or people who willingly resist the changing times, and if that's their choice, they're standing in moving water.

So no. Passwords have problems, Passkeys fix them. And to ram the point home more: Passwords have problems, email-as-permission patterns are so laughably bad I have to seriously question if I ever want to use ONCE or Hey if they insist on using them.

Honestly, I'm all for people using hardware FIDO tokens or similar (i.e. passkeys on their phones) as a second factor. I just don't think it's a good idea to use them as the only factor. Why replace passwords and not just supplement them?

I for one use a hardware security token as a second factor wherever possible, but I'm very reluctant to use it to sign in without any password whatsoever.

Another factor is that is the user doesn't understand the system well, that might be a security issue in itself. At work we use a combination of stuff, I get bombarded by keys, tokens, 2FA's, etc. it's just a headache. I end up clicking and copy pasting randomly until something works.

The problems he's noting here aren't unique to passkeys. They're the same problem every type 2 authentication token would have.

Ie; if you don't have the thing that lets you authenticate with you, you can't authenticate. Thats the whole point of type 2. You have to have the thing to authenticate.

That doesn't mean that other authentication types are better, they all have problems. Passwords can be forgotten easily, and are very easy to manipulate out of someone, and type 3 authentication tokens can't be changed if they're compromised (outside of surgery).

Ultimately the friction here comes down to implientation problems, namely cross compatibility.

Why can't I use keychain to sync my passkeys on my android phone or Windows computer? Why is there no universally adopted passkey syncing service/protocol?

Password managers are good, but we've always known that passwords are a deeply flawed approach, even if randomly generated and stored in a good password manager. They require transmitting unencrypted authentication strings around, either by a user typing it or a pw manager pasting it into a field, both of which can be intercepted. They're human readable and easy for humans to relay to one another, which means they get frequently shared or written down, and are subject to the human tendency of reuse. The vast majority of breaches are caused not by new fancy zero days, they're caused by intercepting passwords, or getting in the middle of a user interactive session to grab session tokens. Passkeys with mutual authentication solve a lot of those problems, but they're very clunky in their current implimentation.

I'd love to see a day where authentication is universally done by the smartphones we already have, whether it's on your work PC or at your house, on your gaming console, your laptop, your desktop, or your ATM, and those passkeys are protected on your device by strong biometric backed encryption.

The issue is actually getting those implimentatons right, and ensuring that these things don't only work in corporate walled gardens.