Users can't use hardware passkeys on many websites

“You are saying this as if these companies don't care about CVR or compatibility at all. The reality is that most companies are extremely conservative about pushing you to change your authentication method. Here are my observations, as both a user and an industry insider:1. Many services have old users with passwords that predate password-strength meters (or their ill-conceived brethren: password complexity rules). The service provider knows these passwords keep falling, and the cost of having to”

“I sort of started skimming when the article was saying industry solved the problem with text messages and TOTP. I think there are several arguable problems with Passkeys as implemented, but to argue TOTP is equivalent is going to leave lots of people vulnerable.The protections against MITM you mentioned is probably the biggest one, but the other one in the back of my mind is TOTP is a shared secret. So a compromise of the server side allows impersonation of users undetected, which can be a big p”

“I can't use a passkey on a device unless I can install my password manager on that device and I am comfortable giving that device access to my passkeys. Passwords are simply unparalleled in their flexibility. You're never going to be locked out because isn't working today.I think the bit about TOTP was mostly a joke, the problem with passkeys is that they're billed as a replacement for passwords but they mix lots of MFA concerns in and make interoperability”

“They usually use security hardware for a reason [re: Is this a twist off or does it need an Allen key?]”

“Reminds me of the counterintuitive nature of password resets. We pushed shorter and shorter reset cycles, ruining UX and inadvertently pushing users towards bad practices like writing passwords down or incrementing one number in their password. Bad UX in security almost always pushes users towards avoidance, not compliance.”

“Yes! What is with this! There are several sites. I have to use where it has never once accepted my passkey, and only offered to overwrite it every time I login.”

“I really like passkeys. Better security, phishing resistance, no password typing. I’m completely sold on the concept. But the onboarding experience still feels way too confusing for a normal user. When you start registering one, you can end up choosing between a generic Passkey and Passkey in Microsoft Authenticator , which already sounds like the same thing to most people. Then Windows asks if you want to save it on the PC or use your phone, you scan a QR code, and suddenly Google Password Mana”

“[Sophos Employee] One point, which i found interesting from a Security perspective: Passkey are "Website bound". That means, OTP / Password can be Phished. Passkey "cannot". For the User, the Passkey "does not match" for a Phishing Website. See: https://www.sophos.com/en-us/blog/the-future-of-mfa-is-clear-but-is-it-here-yet Additionally, this is why Sophos itself pushes Passkey: https://www.sophos.com/en-us/blog/strengthening-authentication-with-passkeys-a-ciso-play”

“Yes, at this point I have probably saved literal hours in time added up by being able to skip MFA prompts on sites/apps I use regularly via a passkey login flow. It was becoming ridiculous how often I'd hit a "verify who you are with your phone/email" gate even on services I use constantly, a gigantic waste of time.”

“> the problem with hardware tokens is that they 1) Only store a limited number of logins,1) It's one passkey used over and over, so it only takes 1 slot.> 2) It is very difficult to keep them in sync- every time you need to add a passkey, you have to get them both out, which makes it difficult to keep one a in a secure safe to keep it safe from damage/loss2) With SSO used across enterprise exactly like you're talking about, works fine without having to reregister over and over. Been using this a”

“The problem with hardware tokens is that they 1) Only store a limited number of logins, 2) It is very difficult to keep them in sync- every time you need to add a passkey, you have to get them both out, which makes it difficult to keep one a in a secure safe to keep it safe from damage/lossThis two fatal flaws are what limits their usefulness to enterprise SSO and perhaps some other limited uses where the organization has the ability to replace tokens. (Even in a distributed enterprise, enterpr”

“I absolutely hate that so many sites are begging me to use them.”

“The author talks about the problem with using hardware keys, but they neglect to mention that many websites and apps simply do not allow the use of hardware keys! They will insist you use Apple or Google syncable keys. So after you have spent the money to buy 2 or 3 hardware keys, you find that they are not accepted.”

“The point about poor support for 3rd party managers is so frustrating. Because this is correct, that is the obvious solution for the normal user, but passkey implementations somehow do not know how to deal with it.Amazon prompts me to create a passkey everytime I log in, even when I logged in with a passkey, because my passkeys live in Bitwarden rather than my OS or browser.And the confusing mechanism hurts there too: I'm always a little bit afraid that i'm somehow more in danger because I keep”