I don't like passkeys
A security blogger argues passkeys suit enterprises but expose individuals to lockout, ban, and recovery risks that outweigh their phishing protection.
The author contends that passkeys are a strong fit for corporate environments but a poor fit for personal security due to permanent lockout, automated account bans, and device loss risks. Hardware keys cap discoverable credentials at 25-300 accounts, and synced passkey ecosystems tied to Apple or Google accounts remain immature and fragmented. The post recommends password managers with independent TOTP apps for individuals.
- Hardware keys cap discoverable credentials at 25-300 accounts, forcing multiple key purchases.
- Synced passkeys tied to Apple or Google accounts risk total loss on account bans.
- Recovery methods like SMS remain the weakest link even when passkeys are enabled.
- Products
- Credential Manager
- Organizations
- FIDO Alliance
From the original article
4 min read at hawksley.dev
For the past few years, the tech industry has kept pushing passkeys as the ultimate solution to logging in. Many Big Tech companies “helpfully” inform you every time you sign in how much easier and effortless passkeys are. The only way to make them stop is either to concede and set up a passkey or dig into the settings to find the off-switch.
By hawksley.dev via eduard · hawksley.dev
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.