logoalt Hacker News

necovek • today at 5:15 PM • 0 replies • view on HN

You lose a device or the local DB that keeps your passkey and you are screwed.

You need to migrate from one login domain to another (rebranding, change of login providers...) and none of your customer credentials will carry over.

Your password might not be stored anywhere except in your head.

Your local storage gets compromised and your passkeys are there for the taking (password in your head isn't).

"Cloud" password managers who hold your passkey private key part is exactly like them having your password and are worse than websites having proper cryptographic hash of your password: they might not be e2e encrypting it (you were comparing with sites doing password hashing wrong too), so a breach exposes all your passkeys just the same.

My point is that there is no panacea. Passkeys are like SSH keys for the web. I still put a passphrase on my SSH keys. Do you?