posted in Technology
I don't like passkeys | Ethan Hawksley
hawksley.dev/blog/i-dont-like-passkeys
Replying to @lemmydividebyzero@reddthat.com
This article does a great job of articulating a lot of the uncomfortableness I have around passkeys. I’ve always said they make a lot more sense in an corporate environment but the level of control you lose in a personal setting is not commensurate with the protections and possible lock-in they offer.
I just don’t like passkeys. They are an overly technical solution to what is mostly a human problem.
Replying to @audaxdreik@pawb.social
Idk, when I want to log into my personal GitHub a bitwarden window opens from the extension, I click the GitHub profile I wanna sign in, and I do.
It’s a great implementation since it’s not linked to a physical device and it lets me authenticate in place. It’s still MFA, it’s just more comfy.
It’s not MFA if all you need is your bitwarden password.
Replying to @anguo@piefed.ca
Unless your bitwarden has MFA and locks after an amount of time commensurate with your security needs
True, but how does GitHub know your bitwarden has MFA? It only knows something has a valid credential.
Replying to @plateee@piefed.social
Github doesn’t need to know how you implement it, just that your browser is handling it (and in this case the browser lets Bitwarden handle it lol)
Replying to @plateee@piefed.social
I don’t think that github has to know that. You could be using a password manager and choose to make it a minimum character boring password or meet minimum complexity requirements or use the same password on a million sites. You have to secure your credentials; complying with the minimums of a service isn’t security.
GitHub doesn’t need to know that - I think that’s why it’s a bit of a cop out for MFA. Sure, your bitwarden may implement MFA, but just a chrome browser isn’t MFA.
Passkeys enable sites to offload the responsibility of securing accounts to the user, and if the user chooses a weaker way to implement them, GitHub doesn’t give a fuck.