2026-10-13 20:41 UTC
Replies (8)
-
@HaraldvonBlauzahn@feddit.org 2026-10-13 20:43
Alternatives that are similarly secure but much less problematic are TOTP token generators, PGP smartcards with an authentication key, and YubiKeys / NitroKeys.
-
@SecureTaco@lemmy.asc6.org 2026-10-13 21:11
This is such a crazy take. Here’s a major rebuttal from mastodon.
-
@libewa@feddit.org 2026-10-13 21:11
hachyderm.io/@rmondello/117428258722253709
-
@hummingbird@lemmy.world 2026-10-13 21:54
First article I see that focuses strait on the biggest drawback of passkeys. Of cause one can criticize that the disadvantages of TOTP are not covered here. That does not make the argument invalid though.
-
@xtr0n@sh.itjust.works 2026-10-13 21:58
I’m a software engineer, but not a security expert. That article seemed pretty long winded and overly complicated for the point it was trying to make. Regardless, I’m not a fan of passkeys as they are currently implemented. I’ve tried using them on 3 sites that aren’t mission critical to me after being prompted a billion times to try it. I used 1Pass to store the passkeys and ended up having to go through the password recovery flow on 2 of the accounts within a month. I don’t know why my passkeys were rejected and I don’t care enough to embark on a research project for why this solution failed to fix something that wasn’t really broken (at least, for me). Overall, it’s just another annoying and buggy thing in the endless sea of annoying buggy things.
-
@JasonDJ@lemmy.zip 2026-10-13 22:48
Passkeys big bonus is that they are far more phish-resistant than pretty much any other MFA out there. Part of me thinks this is a conspiracy to keep “low tech-minded people” easy to phish from because they don’t understand any of the technical details.
-
@AndrewZabar@lemmy.world 2026-10-13 23:18
Seriously was the author paid by the word? Also even though I believe their main point is valid, they employ more than one Straw Man argument in conveying their reasoning. Nevertheless I have been opting out of passkeys since I first saw them for the simple reason that I was being told by sites and apps that I should use them - and I know that no company ever advises you to do something that’s in your own best interest. Therefore I didn’t trust by default. lol.
-
@magguzu@lemmy.pt 2026-10-14 15:10
Honestly I downvoted because I thought it was bait then actually read the article and it was much more convincing than I expected. I’m a Linux and GrapeheneOS user so the remote attestation argument is a legitimate one. Been a big fan of them though, so this does suck.