alt Hacker NewsPasskeys only make sense if every user has a open source Fido 2 hardware based USB passkey (like yubikey but opensource).
Then the user still controls the passkey using a password and then everything else flows from that.
Passkeys only make sense if every user has a open source Fido 2 hardware based USB passkey (like yubikey but opensource).
Then the user still controls the passkey using a password and then everything else flows from that.
Passkeys only make sense if multiple passkeys are supported. What if I lose my Fido key? One issue here is that passkeys don’t have a clear role. If they are replacing passwords, only, then they are 100% an improvement even when not hardware backed, but you still need 2fa. If they are hardware backed, you probably don’t need a second factor and different sites see different roles. Assuming I can setup a backup key, hardware backed covers all of sites’ misconceptions, though.