I don't like passkeys | Ethan Hawksley

One complaint I have is browser insistence that a site must have a proper certificate to work at all.

I provide self hosted software with passkey support and probably over 90 percent of my users never set up property certificates due their private networks. So the passkey function is impossible for them.

Which means they must use passwords. Which are far worse in this scenario. The practical risk either way is arguably low for them, but to take a more mitm/phishing resistant technique and then force it to not work because mitm or phishing might be in play…

I literally just completed a Secure Code Warrior formation mandated by work, and one of the videos states “websites with expired certificates transit your information unencrypted, leaving you exposed to hackers” 🤦 like bruh you’re supposed to know better, you teach cybersecurity for fuck’s sake.

Computing and by extension cybersecurity has a lot of mouth-breather idiots because it’s so new.

I think you a word, “cybersecurity” perhaps?