I don't like passkeys | Ethan Hawksley

This article does a great job of articulating a lot of the uncomfortableness I have around passkeys. I’ve always said they make a lot more sense in an corporate environment but the level of control you lose in a personal setting is not commensurate with the protections and possible lock-in they offer.

I just don’t like passkeys. They are an overly technical solution to what is mostly a human problem.

Idk, when I want to log into my personal GitHub a bitwarden window opens from the extension, I click the GitHub profile I wanna sign in, and I do.

It’s a great implementation since it’s not linked to a physical device and it lets me authenticate in place. It’s still MFA, it’s just more comfy.

It’s not MFA if all you need is your bitwarden password.

Unless your bitwarden has MFA and locks after an amount of time commensurate with your security needs

True, but how does GitHub know your bitwarden has MFA? It only knows something has a valid credential.

I don’t think that github has to know that. You could be using a password manager and choose to make it a minimum character boring password or meet minimum complexity requirements or use the same password on a million sites. You have to secure your credentials; complying with the minimums of a service isn’t security.