Royce Williamstychotithonus@infosec.exchange
Dec 15, 2025, 3:54 PM"Let us be the repository of your passkeys" and "We may terminate your account at any time and permanently refuse to communicate with you" ... seems like a bad combination?
Replies
AAAAKL@infosec.exchangeDec 15, 2025, 4:01 PM@tychotithonus Most people just walk into the first part. Trying to figure out what the original hook was for falling for the tech convenience mantra. People who walk in become like the captive hamster on the wheel.
Erik Johnsondistractal@hachyderm.ioDec 15, 2025, 5:34 PM@AAKL @tychotithonus "It just works" marketing + survivorship bias coupled with general tech idealism.
I used to be "Mr. Bleeding Edge" and would try everything I could that seemed even slightly cool on a surface level.
I barely scrutinized tech until I started seeking out the commentary and thoughts of experts with strong ethics.
- AAAAKL@infosec.exchangeDec 15, 2025, 5:37 PM
@distractal @tychotithonus I wish more people had done that. But we're past that. The captive generation has already been minted. And now a new AI generation is being coined.
Dec 15, 2025, 7:32 PM@distractal Yes, tech idealism almost certainly has a lot to do with it. ALSO that a lot of peoples' threat model seems to basically come down to "why would they care about me?". (For some value of "they".) Spoiler alert: they don't; that's the problem once some automated system somewhere triggers.
No mouse trap ever cared about the particular mouse. Barely anyone who places a mouse trap care about which particular mouse ends up in it, either. Neither helps the mouse.
Bas (Tools on Tech)toolsontech@pkm.socialDec 15, 2025, 4:01 PM@tychotithonus trust me bro authentication
Thomas BrandEggfreckles@mastodon.mit.eduDec 15, 2025, 4:10 PM@tychotithonus privacy am I right?
Dave Wilburn :donor:DaveMWilburn@infosec.exchangeDec 15, 2025, 4:37 PM@tychotithonus in a better universe I'd say this might be a good place for government to step in with digital IDs, but somehow that would be even worse because we live in the worst and dumbest timeline.
Helge Heßhelge@mastodon.socialDec 15, 2025, 6:46 PM@DaveMWilburn @tychotithonus I think the German IDs do have certs embedded for a while, but yes.
- Dave Wilburn :donor:DaveMWilburn@infosec.exchangeDec 15, 2025, 6:50 PM
@helge @tychotithonus I wouldn't trust the American government with that, simply because they don't even respect or acknowledge the rights of anyone that lives here, including our own citizens. And even if Trump goes away, the underlying rot won't.
Hopefully you can keep AfD out of power and avoid our same fate.
- Helge Heßhelge@mastodon.socialDec 15, 2025, 7:11 PM
@DaveMWilburn @tychotithonus That’s the cool thing about cryptography, it gives a shit about such things.
Dec 15, 2025, 7:52 PM@helge @DaveMWilburn @tychotithonus So does arithmetic, it cares deeply.
bmaxvbmaxv@noc.socialDec 15, 2025, 4:48 PM@tychotithonus
...that's just passkeys though, right?What is this hypothetical storage medium that you don't have to care about, but also have to care about enough that it doesn't fall into the wrong hands and that *isn't* tied to some user account, or is a literal piece of hardware you can just lose?
- Royce Williamstychotithonus@infosec.exchangeDec 15, 2025, 4:55 PM
@bmaxv If the interfaces managed passkeys the way physical keys are managed -- "you need to have as many of them as you are comfortable having house keys, probably more" -- that would be pretty manageable. A hybrid - in which physical keys are tracked and rotated, to bring them up to current with recent adds, and passkey managers providing flexibility and redundancy in the meantime -- is the most robust, but requires some relatively complex personal risk modeling (and state keeping -- today, you basically have to track it all on a spreadsheet, which most people aren't going to do)
Dec 15, 2025, 5:15 PM@bmaxv @tychotithonus I will use passkeys when there is an interoperable export/import format. I.e., I need to be able to export my passkeys from their primary vendor platform, store the export securely myself, and then import them if needed into a _different_ vendor platform.
Until then, they're no more convenient than the YubiKey I already have and use.- Royce Williamstychotithonus@infosec.exchangeDec 15, 2025, 6:19 PM
@jik
+5, Insightful 
Dec 15, 2025, 6:48 PM@jik @tychotithonus @bmaxv the sad thing is that this is a description of the ssh keys that have been in use for decades
Kg. Madee Ⅱ.kgMadee2@mathstodon.xyzDec 15, 2025, 6:53 PM@Tak @tychotithonus @bmaxv @jik and PGP, S/MIME, and client cert auth in web BROWSERS (🪦)
Dec 15, 2025, 6:56 PM@jik @bmaxv @tychotithonus There is some import/export between different apps implemented, but as I understand it they're deliberately making it hard to export to just files or something, because sEcUrItY
- Dec 15, 2025, 7:27 PM
@mackuba I do distinctly recall seeing that work is being done on a defined interoperability / transfer feature for passkeys, but I don't recall the specifics.
Of course each vendor would need to implement that. Otherwise it's just another standard that nobody can use.
bbbbbrbbbbbr@mastodon.gamedev.placeDec 15, 2025, 8:10 PM@mkj @mackuba @jik @bmaxv @tychotithonus There's also this fine thread where a passkey industry person more or less mafioso style threatens KeePassXC with "that's a nice passkey implementation you got there, it'd be a shame if we banned your program working with passkeys" due to KeePassXC having allowed users to export their own keys unencrypted.
One can somewhat understand the position, but it's a real tell of how anti-user-control the passkey project is.
https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994673954
- Dec 15, 2025, 8:21 PM
@bbbbbr @mkj @mackuba @bmaxv @tychotithonus come for the security, stay for the vendor lock-in
Dec 15, 2025, 10:13 PM
Dec 15, 2025, 10:44 PM@bbbbbr Ewww. (That's a technical comment.)
Dec 15, 2025, 5:03 PM@tychotithonus this is a dig at Google right? Asking because Proton just sent out a passkey related email
- Royce Williamstychotithonus@infosec.exchangeDec 15, 2025, 5:04 PM
- Dec 15, 2025, 8:23 PM
@tychotithonus fair enough! I haven't heard horror stories about proton yet, but I wouldn't even be surprised
Alexander 😷alxndr@tech.lgbtDec 15, 2025, 5:17 PMMe, reading about Passkeys: Oh, it's vendor lock-in for credentials!
Apple: Hold our Zinfandel
🫠
David Nelsondmnelson@mastodon.socialDec 15, 2025, 5:50 PM@alxndr @tychotithonus This situation is absolutely rotten. I don’t oppose putting passkeys in a password manager but this illustrates how it can be dangerous to *only* have them in a password manager. I argue that from a risk management perspective we should think of the password manager as a single virtual YubiKey: You wouldn’t register just one. Anything important should have at least a couple backup methods registered, be they hardware keys or a second password manager backed up offline.
Softwarewolffaoluin@chitter.xyzDec 15, 2025, 5:30 PM@tychotithonus As someone around here described them: Passkeys are just passwords with landlords. And the landlords can evict you at any time for any reason without notice.
_GreyWolf_GreyWolf@kinkycats.orgDec 15, 2025, 6:05 PM@faoluin
Technically passkeys should be like ssh keys and it does work that way if you use hardware passkeysSadly most services only allow you one passkey somehow...
Dec 15, 2025, 5:47 PM@tychotithonus yup.
Which is why I maintain my original position: passkeys can lick my salt bits.
(at least until such time as I can store my passkeys where I GD please.)
mike805mike805@noc.socialDec 15, 2025, 8:19 PM@kaasbaas @tychotithonus KeePassXC is supposed to let you manage your own passkeys. I've been holding off on them too.
Dec 15, 2025, 6:03 PM@tychotithonus that's why it's important to always keep a local backup of-
oh. oh no. Oh No
Dopes The Frogmanmacacator@mastodon.socialDec 15, 2025, 6:06 PM@tychotithonus and don't even think about scrutinizing our current administration, otherwise you'll get doxxed on top of getting your account perma-banned
Dec 15, 2025, 6:14 PM@tychotithonus This is why, even if I use a passkey with a site, I always keep the backup option of a password.
Dec 15, 2025, 6:34 PM@tychotithonus Can't even tell which particular Giant Evil Tech Corp this is about.
- Royce Williamstychotithonus@infosec.exchangeDec 15, 2025, 6:41 PM
- Dec 15, 2025, 6:43 PM
@tychotithonus Ha, precisely!
Ozzelotozzelot@mstdn.socialDec 15, 2025, 7:17 PM@mike @tychotithonus all of them?
LRlritter@mastodon.gamedev.placeDec 15, 2025, 6:39 PM@tychotithonus not what you'd want in a husband
Dec 15, 2025, 6:47 PM@tychotithonus Are you implying that tech CEOs are not trustworthy?
- Dec 15, 2025, 8:33 PM
@rrb @tychotithonus I can throw most people farther than I would trust a tech CEO. The exceptions, the “good guys” you might call them, have a well-established tendency to disappoint. So, I’d be cautious about the ones I can throw.
- Dec 15, 2025, 9:08 PM
@su_liam @tychotithonus Check on how many "Dark Patterns" they use to deceive their users.
Ron Bowesiagox86@infosec.exchangeDec 15, 2025, 7:24 PM@tychotithonus I love using centralized login things to avoid passwords, but the number of things I have linked to Google terrifies me
Sarahpatterson2467@mastodon.socialDec 15, 2025, 7:36 PM
QuasitQuasit@kolektiva.socialDec 15, 2025, 7:44 PMI still don't know what a passkey IS. And I'm certainly not going to use them.
These days my default answer is "no" to almost anything new unless I'm sure I understand it.
- Dec 15, 2025, 8:36 PM
@Quasit @tychotithonus That is generally the best response. Somewhere along the way, Google decided “don’t be evil” was too radical, and the one thing you really need to understand is that all the other tech bros nodded in agreement.
casey is remoterealcaseyrollins@noauthority.socialDec 15, 2025, 7:47 PM@tychotithonus I just use #KeePassXC
7leaguebootdisk𓅽7leaguebootdisk@mindly.socialDec 15, 2025, 7:54 PM@tychotithonus yeah, with my main email, I can recover everything else, or, with my password manager account, I can log in directly. I really like having a different memorized PW for each, written down in an obscure location that's easy for me to recover, but hard for someone else (I know which scribble in which notebook full of scribbled notes, good luck!).
Dave Robesondrobeson@mastodon.socialDec 15, 2025, 8:04 PM@tychotithonus The main reason of several that I won’t go anywhere near passkeys (and don’t trust my photo backups to their cloud).
Brad Koehnbkoehn@hachyderm.ioDec 15, 2025, 8:19 PM@tychotithonus I’ve been quite happy keeping passkeys etc. on Yubikeys (plural!). I know that that way they cannot be accessed remotely (you have to have a PIN and touch it for it to work), and with more than one yubikey I don’t have a single point of failure.
But I was never comfortable using a password manager or other software for passkeys; it seemed to defeat the purpose.
- mike805mike805@noc.socialDec 15, 2025, 8:18 PM
@tychotithonus People must learn to manage files. If you understand files and directories, and can copy data from a laptop to a USB device and vice versa, you own your computing environment. If you cannot do those things, Big Tech owns you.
KeePassXC is supposed to provide self-custody of passkeys, although I have not tried that part. It works fine for TOTP.
If you forgot the USB cable, try this: https://TheUnCloud.co/ (WebRTC chat and file xfer)
JohnWTheEffekt@indieweb.socialDec 15, 2025, 8:43 PMI'm reaaallly old school when it comes to vital information. I never started using online services. I use KeyPass locally for personal credentials, and for my over 200 past and present clients as a web dev,.
Matt Cengiamattcen@aus.socialDec 15, 2025, 9:57 PM@tychotithonus ideally https://fidoalliance.org/specifications-credential-exchange-specifications/ will improve this situation; Apple have already implemented the export functionality. It's not a complete solution (which is one of the reasons I self-host Vaultwarden/Bitwarden), but it's a start.
SchroedingerSteveClough@metalhead.clubDec 15, 2025, 10:12 PM@tychotithonus Yes, but unfortunately, me and my brain are fixed together.
But I know that one day, it will refuse to communicate with me.
Dec 15, 2025, 10:19 PM@tychotithonus Is this a specific company or a general thing?
Marc Edwardsmarcedwards@mastodon.socialDec 16, 2025, 12:39 AM
Dec 15, 2025, 10:27 PM@tychotithonus isn't it the same as regular password managers from those companies, where passwords are actually hard/impossible to remember?
Lauralandelare@mastodon.gamedev.placeDec 15, 2025, 10:40 PM@tychotithonus I can't wait for websites forcing passkeys!
McWabbit 🇺🇦🍋🌻🍉McWabbit@tenforward.socialDec 15, 2025, 11:24 PM@tychotithonus It’s that my novice tech brain said: “Why should I replace my good enough 2FA with your passkey for? And why is it suddenly being pushed by so many companies?”, that I was apprehensive on why there is such need and ignored their offer.
Guess my hunch was right.