timtimcappalli@infosec.exchange
Oct 14, 2026, 3:31 PMthis is one of the primary reasons whatarepasskeys.info was created: to help users find a credential manager that works for them and help them understand passkeys more generally.
Replies
Juan C Nunojuancnuno@mastodon.socialOct 14, 2026, 4:22 PM@timcappalli @ScottHelme @maxpool
> If someone already has their password in a password manager, what's the difference to it being a passkey in there instead?
I can export my passwords out of Google Password Manager into a CSV. I can open it in a text editor and see my passwords in there. But I can't export passkeys the same way. I understand that the Credential Exchange Protocol is a thing and can use the flow to import them into Bitwarden or whatever but I prefer a little less opaqueness.
- timtimcappalli@infosec.exchangeOct 14, 2026, 4:32 PM
do you think that is appropriate for an elderly parent who can be easily tricked into exporting all their passkeys in plain text and uploading them to an attacker's site?
If plaintext export is something you want, there are credential managers which will give you that. Use them. But I don't think that's appropriate for the majority of consumers.
Oct 14, 2026, 5:22 PM@timcappalli @juancnuno @ScottHelme @maxpool counterpoint -> my mom finds password managers difficult enough to use already, and she prefers something she understands.
- timtimcappalli@infosec.exchangeOct 14, 2026, 6:02 PM
sure, but she's probably already using one without realizing it, because a majority of users prefer to have their trusted devices remember things for them.
- GerardGerardThornley@hachyderm.ioOct 14, 2026, 7:40 PM
@timcappalli @amonduin @juancnuno @ScottHelme @maxpool The older users I know are still using pieces of paper (or worse, an excel file!) to manage their passwords. Even TOTP is beyond at least some of them. SMS-based 2FA is frustrating to them but they have at least learned what they're expected to do.
For a certain age group, change - any change at all - is really, really difficult to cope with. It's confusing, and ultimately pushes them to reject technology. Then they feel isolated because so many things assume some level of online capability. - timtimcappalli@infosec.exchangeOct 14, 2026, 8:52 PM
@GerardThornley @amonduin @juancnuno @ScottHelme @maxpool they're also the folks most at risk of being phished and losing their retirement. we have to try!
- GerardGerardThornley@hachyderm.ioOct 14, 2026, 10:08 PM
@timcappalli @amonduin @juancnuno @ScottHelme @maxpool Oh, I appreciate the risks arrayed against them. But if folks are struggling to cope with what they already have, the right solution is not asking them to learn something new.
I think for some people it might be better to move their interface to services offline - support people living in a simpler world. 
Epic NullEpic_Null@infosec.exchangeOct 14, 2026, 6:09 PM@timcappalli @juancnuno @ScottHelme @maxpool Actually, if we're bringing up elderly (grand)parents, this introduces a new concern AGAINST passkeys.
Grandma IS going to do something dumb. I AM going to need to sign in to her accounts on my own devices. I AM going to need to fix hr accounts.My mom IS needing to take over her finances to get her bills paid.
Sure, grandma may not be able to handle a plaintext export, but as de-facto tech support? I'm going to find that feature invaluble.
Patrickppb1701@ppb.socialOct 14, 2026, 6:19 PM@Epic_Null @timcappalli @juancnuno @ScottHelme @maxpool you can also run into issue with shared accounts to spouse/partner. I don't move some of the shopping accounts we use to them because for reasonable reasons my wife doesn't want the extra hoops of another app or having to find a specific device to okay it. Not when if it sends me mfa code I can rattle it off to her and she's just slightly inconvenienced but logged in.
- Epic NullEpic_Null@infosec.exchangeOct 14, 2026, 6:33 PM
@ppb1701 @timcappalli @juancnuno @ScottHelme @maxpool The moment you stop assuming an account can only be accessed by one person on devices they fully control, the entire problem of authentication changes dramaticallly.
- timtimcappalli@infosec.exchangeOct 14, 2026, 6:55 PM
most credential managers offer family passkey sharing specifically to address this case!
- Epic NullEpic_Null@infosec.exchangeOct 14, 2026, 7:05 PM
@timcappalli @ppb1701 @juancnuno @ScottHelme @maxpool Sure sure...
Grandma has an Apple and Mom and I do not. Mom struggles with the password manager I use regularly.
Now how do Mom and I step in and help Grandma under the passkey system?
- Patrickppb1701@ppb.socialOct 14, 2026, 8:09 PM
@Epic_Null @timcappalli @juancnuno @ScottHelme @maxpool I'm guessing she relies on Apples app for hers?
- Epic NullEpic_Null@infosec.exchangeOct 14, 2026, 8:34 PM
@ppb1701 @timcappalli @juancnuno @ScottHelme @maxpool She has an odd combination of Apple's app (sign in with Face ID) and data stored in... i think her phone book?
Neither is particularly intentionally managed...
- timtimcappalli@infosec.exchangeOct 14, 2026, 8:52 PM
@Epic_Null @ppb1701 @juancnuno @ScottHelme @maxpool you can choose a credential manager that works on all platforms, and set it up for her. It's exactly what I've done with my parents!
- Epic NullEpic_Null@infosec.exchangeOct 14, 2026, 9:04 PM
@timcappalli @ppb1701 @juancnuno @ScottHelme @maxpool Yeaaaaaaaaaaaaaah I have met my grandma and on a scale of 1 to 10 the probability of that happening is a -50. As in somehow it would create a different, worse crisis if I tried to do that.
As for my mom, I have learned that the things that make me happy with a password manager are non-starters for her.
We have different needs and getting us on the same password manager is gonna be a "no".
- Patrickppb1701@ppb.socialOct 14, 2026, 8:08 PM
@timcappalli @Epic_Null @juancnuno @ScottHelme @maxpool yep, but that's if you can get the family to use "yet another" app. Does work but there is a bit of an if there.
- timtimcappalli@infosec.exchangeOct 14, 2026, 8:54 PM
@ppb1701 @Epic_Null @juancnuno @ScottHelme @maxpool sure. that's the case in many parts of life.