Login
You're viewing the mastodonapp.uk public feed.
  • ma𝕏poolmaxpool@mathstodon.xyz
    Oct 14, 2026, 2:45 PM

    @ScottHelme

    Here is IMH better argument against passkeys for personal use: hawksley.dev/blog/i-dont-like-

    To summarize: perfect fit for a corporate environment, but a poor fit for personal security.

    "To an individual, the greatest risks are instead permanent account lockout, automated account bans, and device loss. By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts."

    "If their [Apple and Google] automated systems decide one day to ban your account, you irreversibly lose access to all your passkeys used across all third-party accounts too."

    "I believe enterprise users have good reason to use passkeys, but the ecosystem isn’t mature enough yet for individuals."

    #passkeys

    💬 3🔄 3⭐ 5

Replies

  • Scott HelmeScottHelme@infosec.exchange
    Oct 14, 2026, 2:49 PM

    @maxpool Those are fair arguments, and points we could discuss.

    It's worth noting though that the same problem exists if you store your passwords or passkeys in keychain and then lose your Apple account, you have the exact same recovery issue.

    These are also not the points or concerns raised in the OP, which I believe don't stand up to scrutiny.

    💬 1🔄 0⭐ 2
  • ma𝕏poolmaxpool@mathstodon.xyz
    Oct 14, 2026, 3:10 PM

    @ScottHelme

    That's why the proposal: "third-party password manager, paired with an independent TOTP app" seems like the the best solution for personal use until passkeys have mature ecosystem.

    Authentication is decoupled from OS vendor. Password vault and TOTP tokens exist independently. Even if Apple or Google bans your identity, you keep your credentials, can log in from any browser or OS, and can update your contact email on those third-party services.

    I'm no expert, but if I understand the situation correctly, FIDO alliance has draft for transferring passkeys between ecosystems (Apple, Android, Google, Linux,... ) but it does not exist in practice.

    It's probably just an attempt in lock-in to slow walk, or refuse to implement these parts.

    💬 1🔄 0⭐ 1
  • Scott HelmeScottHelme@infosec.exchange
    Oct 14, 2026, 3:14 PM

    @maxpool Right, but all I'm saying is you need to swap "password and TOTP" with "passkey" in that explanation and you're better off.

    If someone already has their password in a password manager, what's the difference to it being a passkey in there instead?

    All password managers I've seen can sync passkeys across any device where the password manager is installed.

    💬 1🔄 0⭐ 1
  • timtimcappalli@infosec.exchange
    Oct 14, 2026, 3:31 PM

    @ScottHelme

    this is one of the primary reasons whatarepasskeys.info was created: to help users find a credential manager that works for them and help them understand passkeys more generally.

    @maxpool

    💬 1🔄 0⭐ 0
  • Juan C Nunojuancnuno@mastodon.social
    Oct 14, 2026, 4:22 PM

    @timcappalli @ScottHelme @maxpool

    > If someone already has their password in a password manager, what's the difference to it being a passkey in there instead?

    I can export my passwords out of Google Password Manager into a CSV. I can open it in a text editor and see my passwords in there. But I can't export passkeys the same way. I understand that the Credential Exchange Protocol is a thing and can use the flow to import them into Bitwarden or whatever but I prefer a little less opaqueness.

    💬 1🔄 0⭐ 0
  • timtimcappalli@infosec.exchange
    Oct 14, 2026, 4:32 PM

    @juancnuno

    do you think that is appropriate for an elderly parent who can be easily tricked into exporting all their passkeys in plain text and uploading them to an attacker's site?

    If plaintext export is something you want, there are credential managers which will give you that. Use them. But I don't think that's appropriate for the majority of consumers.

    @ScottHelme @maxpool

    💬 2🔄 1⭐ 0
  • 💬 1🔄 1⭐ 0
  • 💬 1🔄 1⭐ 0
  • GerardGerardThornley@hachyderm.io
    Oct 14, 2026, 7:40 PM

    @timcappalli @amonduin @juancnuno @ScottHelme @maxpool The older users I know are still using pieces of paper (or worse, an excel file!) to manage their passwords. Even TOTP is beyond at least some of them. SMS-based 2FA is frustrating to them but they have at least learned what they're expected to do.
    For a certain age group, change - any change at all - is really, really difficult to cope with. It's confusing, and ultimately pushes them to reject technology. Then they feel isolated because so many things assume some level of online capability.

    💬 1🔄 1⭐ 0
  • 💬 1🔄 1⭐ 0
  • GerardGerardThornley@hachyderm.io
    Oct 14, 2026, 10:08 PM

    @timcappalli @amonduin @juancnuno @ScottHelme @maxpool Oh, I appreciate the risks arrayed against them. But if folks are struggling to cope with what they already have, the right solution is not asking them to learn something new.
    I think for some people it might be better to move their interface to services offline - support people living in a simpler world.

    💬 0🔄 0⭐ 0
  • Epic NullEpic_Null@infosec.exchange
    Oct 14, 2026, 6:09 PM

    @timcappalli @juancnuno @ScottHelme @maxpool Actually, if we're bringing up elderly (grand)parents, this introduces a new concern AGAINST passkeys.

    Grandma IS going to do something dumb. I AM going to need to sign in to her accounts on my own devices. I AM going to need to fix hr accounts.My mom IS needing to take over her finances to get her bills paid.

    Sure, grandma may not be able to handle a plaintext export, but as de-facto tech support? I'm going to find that feature invaluble.

    💬 1🔄 1⭐ 0
  • Patrickppb1701@ppb.social
    Oct 14, 2026, 6:19 PM

    @Epic_Null @timcappalli @juancnuno @ScottHelme @maxpool you can also run into issue with shared accounts to spouse/partner. I don't move some of the shopping accounts we use to them because for reasonable reasons my wife doesn't want the extra hoops of another app or having to find a specific device to okay it. Not when if it sends me mfa code I can rattle it off to her and she's just slightly inconvenienced but logged in.

    💬 1🔄 0⭐ 0
  • 💬 0🔄 1⭐ 0
  • 💬 2🔄 1⭐ 0
  • 💬 2🔄 1⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 1⭐ 0
  • 💬 1🔄 1⭐ 0
  • Epic NullEpic_Null@infosec.exchange
    Oct 14, 2026, 9:04 PM

    @timcappalli @ppb1701 @juancnuno @ScottHelme @maxpool Yeaaaaaaaaaaaaaah I have met my grandma and on a scale of 1 to 10 the probability of that happening is a -50. As in somehow it would create a different, worse crisis if I tried to do that.

    As for my mom, I have learned that the things that make me happy with a password manager are non-starters for her.

    We have different needs and getting us on the same password manager is gonna be a "no".

    💬 0🔄 1⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 1⭐ 0
  • Chaz Hawschazh@mastodon.social
    Oct 14, 2026, 3:14 PM

    @maxpool @ScottHelme Ultimately if a passkey goes away your fallbacks are passwords and reset-by-email, right? And those are your fallbacks now? So if you use passkeys for a few years and then the site betrays you like this, then the net gain is at least you had a few years of easier/safer/unphishable logins and a future of logging into that site without passkeys (or moving to a site that hasn’t betrayed you). Seems like even your worst case is a limited gain but net gain. Did I miss something?

    💬 1🔄 0⭐ 0
  • Chris Adamsacdha@code4lib.social
    Oct 14, 2026, 5:00 PM

    @chazh @maxpool @ScottHelme it also relies on a fundamental misunderstanding of how even the platform passkeys work. If you use Apple’s iCloud Keychain and then get added to a terrorist watchlist, it will block your ability to make changes but it doesn’t remote wipe all of your devices.

    Even if that was true, the answer would be using a password manager not made by the OS vendor or buying a Yubikey, not getting phished because you think this much rarer event was your greatest threat.

    💬 0🔄 0⭐ 1
  • amonduinamonduin@mstdn.ca
    Oct 14, 2026, 6:49 PM

    @acdha @chazh @maxpool @ScottHelme It doesn't matter if it remote wipes you or not it depends on whether or not Apple can reach out and lock your account. If the iCloud Keychain gets locked and you can't log into it anymore you're just as stuck as if you the vault was wiped.

    There are ways of doing it (offline first models) that do sync and do not support this kind of lockout but that isn't the default for most of the popular solutions. (Note that this is a password manager problem more generally not just passkeys)

    💬 2🔄 1⭐ 0
  • Chris Adamsacdha@code4lib.social
    Oct 14, 2026, 7:14 PM

    @amonduin @chazh @maxpool @ScottHelme My point was that it's not true: if your iCloud account is locked or unavailable, you can still use your local copy — it won't sync any more but you can migrate as you want to anything else, including exporting your passkeys to something like BitWarden, 1P, etc.

    💬 0🔄 0⭐ 1
  • amonduinamonduin@mstdn.ca
    Oct 14, 2026, 7:31 PM

    @acdha @chazh @maxpool @ScottHelme is that true though? If my iCloud account is locked do I still have access to the iCloud vault? I know with bitwarden and proton pass because you log into the app with your account if your account login fails you are at risk of being unable to access your passkeys. I haven’t checked if iCloud Keychain is similar where if the authentication shows as locked or terminated account the keychain still unlocks.

    💬 1🔄 1⭐ 0
  • Chaz Hawschazh@mastodon.social
    Oct 14, 2026, 7:34 PM

    @amonduin @acdha @maxpool @ScottHelme As far as Iknow, anything you can reach by way of a PIN or FaceID or TouchID or a local MacOS password is running locally and hasn’t gone and checked with Apple. Anything you need to type your Apple Account password into, on the other hand, is at risk. Want to mitigate the risk anyway, go for it, make backups. Want to have less Apple risk, use somebody else’s passkeys system.

    💬 0🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • amonduinamonduin@mstdn.ca
    Oct 14, 2026, 7:33 PM

    @chazh @acdha @maxpool @ScottHelme this is an argument against the system because as designed it doesn’t guarantee user ownership and access. The standard should explicitly be against things like device fingerprinting and attestation and require that users have access to passkeys even if the sync account is locked, that it does not is a mark against passkeys as a concept and standard.

    💬 1🔄 1⭐ 0
  • 💬 0🔄 0⭐ 0
  • argv[-1]argv_minus_one@mastodon.sdf.org
    Oct 14, 2026, 6:42 PM

    @maxpool

    Passkeys are an utterly unnecessary solution for corporate environments, because corporate environments already have PKCS#11, and have had it for 30 years.

    So no, passkeys are not good for corporate *or* personal use.

    @ScottHelme

    💬 1🔄 1⭐ 0
  • 💬 1🔄 0⭐ 0
  • argv[-1]argv_minus_one@mastodon.sdf.org
    Oct 15, 2026, 12:01 AM

    @autolycos

    I mean, if you want security then you want it to be battle-tested, and it doesn't get much more battle-tested than PKCS#11. That s**t works.

    It also doesn't require any nonsense about remote attestation, because the company's IT department controls which devices the private keys go onto in the first place. Hardware token? Secure enclave on a phone? Doesn't matter, as long as there's a PKCS#11 driver for it.

    @maxpool @ScottHelme

    💬 1🔄 0⭐ 0
  • 💬 0🔄 1⭐ 0