[jlmb]

“Passwords are fine” only in a theoretical world where everyone uses passwords “correctly” and securely. But in the real world people don’t, so passkeys are a much better and easier method.

I fail to understand how educating billions (?) of people about proper password hygiene is faster or simpler than moving all authentication to a “tap this button to magically log in” method.

[bunga-bunga]

> passkeys are a much better and easier method

Disagree. This isn't possible with passkeys:

- logging into a service with email and brain-stored password from any device

With passkeys, your phone becomes your password, so don't break it, lose it, let it die, forget it in the car, become too old, let your kids use it, etc

> “tap this button to magically log in” method

That only works if the device you tap it on is the same device with the key, while that's not always the way for many people (sync may or may not be set up or active)

[szasamasa]

you either can remember all your passwords and then you are fucked or you use a pass manager

passkeys will be stored in a pass manager and they can be recovered with device pin and master pass, I think they will be exportable too

so yes, you can log in with brain stored stuff

I guess you need a device to log in? then you log in to your pass manager and you can log in to anywhere

only this way you have to remember a passcode and a master pass, not 1000 passwords and you need your master pass 5x/10 years and your passcode every other day and you log in with your device and your biometrics

passkeys have issues but what you are saying is pure shit

[hulitu]

> so passkeys are a much better and easier method.

I'm old. What's the difference between a pass word and a pass key ?

> tap this button to magically log in” method.

And how exactly is "this button" authenticated ?

[wasmitnetzen]

Passkeys are basically enforced password managers with random passwords. There's some more complexity below the surface, but for the user, that's it.

[krisoft]

> I'm old. What's the difference between a pass word and a pass key ?

Password: You have to choose a good one using your brain or a password manager of your choice, and you have to remember it using your brain or a password manager of your choice.

Passkey: Your device generates it for you, whether or not it is sufficiently random, and long enough is not up to you. You don't even have to worry about it. Your device stores it for you. You don't have to remember it in your brain, you don't have a choice if you want to use a password manager or not. The passkey is stored in something which is functionally equivalent to a password manager.

> how exactly is "this button" authenticated ?

What are you asking? How is it authenticated between the server and the client? Or how is it authenticated that the person pressing the button is the right person on the client side?

[k8sToGo]

The button is authenticated through the phone biometrics for example.

[ValleZ]

Password is something you know and pass key(or a physical key) is something that you own.

[denton-scratch]

> so passkeys are a much better and easier method

Thing is, most people don't understand passkeys. If you want to be secure, then you want to understand why and how you're secure; a pinky-promise that you're secure doesn't cut the mustard.

I do have some understanding of this kind of technology, having written for myself an OAuth server back in the day. I gave up on the server, because the services I wanted it for (bank, tax, medical) didn't accept OAuth, and because it was much too hard to understand.

Passkeys involves more third parties, and is even harder to understand.