I don't like passkeys | Ethan Hawksley

Good article.

Currently passkeys are too much of a vendor lock-in to big tech.

Bitwarden support alone does not change that.

I agree the passkey user experience needs work, but man do I enjoy it over the haphazard ‘passwordless’ website login that just sends you an email.

I get it, they’re just skipping an attack vector and basically relying only on ‘2FA’. But now I have to go to a different app/tab, copy a code, and return to the site instead of letting the password manager fill stuff in for me. Some, like kickstarter, let you still have a 2FA code enabled so you have to grab your code from whichever authenticator and go to your email. Really nice login experience out of nowhere one day. \s

The best implementation of this I’ve seen has to be Ghost, an open source self-hostable newsletter/patreon thing. They detect what email provider you have and when you enter your email, will display a link to open your inbox. It’s super neat, and I haven’t seen it anywhere else, and I’m also not sure how they do it. For something self-hostable, I’ll definitely take one less attack vector.