I don't like passkeys | Ethan Hawksley

This article does a great job of articulating a lot of the uncomfortableness I have around passkeys. I’ve always said they make a lot more sense in an corporate environment but the level of control you lose in a personal setting is not commensurate with the protections and possible lock-in they offer.

I just don’t like passkeys. They are an overly technical solution to what is mostly a human problem.

Idk, when I want to log into my personal GitHub a bitwarden window opens from the extension, I click the GitHub profile I wanna sign in, and I do.

It’s a great implementation since it’s not linked to a physical device and it lets me authenticate in place. It’s still MFA, it’s just more comfy.

It’s not MFA if all you need is your bitwarden password.

It technically is, it’s not about the amount of actions you need to do, it’s about the amount of actions the platform you are logging in needs to do with you. That both interactions interface with a bitwarden local device makes the weak link your local device, which already was anyway.

Github only asks me for (bitwarden’s) passkey. That’s just a single factor.

I wouldn’t classify passkeys as MFA tho, they are a passwordless method that’s more secure than most MFA methods. Afaik it’s based on signed certificates or something like that and that’s virtually unhackable unless someone gets physical access to your device (and that’s game over anyway).

But bitwarden uploads it to the cloud to be used on any computer, AFAIK.