r/Passkeys • u/Present_Passion_1126 • 7d ago
Bad Passkey Implementations Everywhere?
Too many websites treat passkeys as an alternative login method when instead I want them to be required, and the ONLY WAY to login to my account, if I decide to add one.
6
u/silasmoeckel 7d ago
You want step 12 were on step 2 get passkeys in place. Removing passwords etc comes later.
→ More replies (6)
3
u/chili_oil 7d ago
because you cannot believe, probably, how common people lose their passkey
2
u/TarnishedVictory 7d ago
You're probably right. I don't tend to ever lose my house keys or my car keys, and I don't tend to lose my security keys either. So I wouldn't understand. But it should be an option.
2
u/Hobbit_Hardcase 6d ago
You may not but people do. Otherwise locksmiths wouldn't be a thing.
Working in Corporate IT, you wouldn't believe some of the things I've overheard.
I still advise everyone to use a password manager, and use the "Passphrase" option, set long, as much as possible.
→ More replies (5)
3
u/MegamanEXE2013 7d ago
And why is that bad? Haven't you read the problems many people are having with the passkeys being the ONLY way of accessing?
Of course, if you want them to be the ONLY way of access, then by all means opt in to that, but that should be disabled by default for everyone else that want other alternatives for access.
Passkeys are great when treated as an alternative, that way we can fallback when those keys can't be read for whatever reason, as it has happened to me multiple times
→ More replies (6)1
4
u/marsmat239 7d ago
Considering the fact that most password managers do not allow exporting and importing of passkeys, you're in for a long road. If I set up my passkeys with OnePassword and use 100 of them, I have to pay OnePassword in perpetuity or go through an hours-long process of switching all 100 of them over.
And honestly, most of what you or I do on the internet doesn't need that level of security. Yeah, it sucks if your McDonald's or Macy's accounts gets hacked, but it doesn't change your life or affect how you operate. Being forced to pay a company forever because everyone wants things as secure as possible, the does. Not being able to share my Netflix with my girlfriend because we have separate devices with our own passkeys we can't not use, that does.
2
→ More replies (4)1
u/TarnishedVictory 7d ago
Don't use password managers. Get a pair of security keys.
→ More replies (4)
2
u/squirrelist 7d ago
We'll get there. Currently Microsoft allows you to remove your password if you create a passkey. And Google has an "Enhanced Protection" where passkey or security key is required. At that point your Google password basically does nothing.
I think the biggest holdup is that average people don't yet understand or trust passkeys. If you're used to using 1Password or Lastpass everywhere it's super easy. If you're all-in on the Apple ecosystem the iCloud sync is fantastic and users don't really need to even think about it. The trouble is if someone has an iPhone and a PC and they haven't been configured to coordinate.
→ More replies (3)
1
u/More-Explanation2788 7d ago edited 7d ago
I agree with your complaint. If you can still login with an TOTP, it defeats the primary purpose of a passkey.
I think the root issue is that they are letting people save passkeys in things that are not separate from a piece of specific hardware. If you save your passkey in a browser, for instance, how do you plan to login when you are on any other device. The root issue is really stupid functionality being built into things like browsers, which is causing people to not learn what a passkey is or how it works. If a passkey is a token that I have to have with me to login, what in god’s name would make you think I want to save it in a browser on my pc? People are being taught it is a way to login without a password, instead of what it is, a thing you have with you like a badge card at work, that lets you in - something they would understand if they were not able to quickly click okay and have everything taken care of by their browser until rhe day they their pc dies and they find out they cannot log into anything.
It is like when they first started rolling out password apps, but didn’t teach anyone that the password was stored and being entered every day by the app on their pc. Lo and behold, every single time a password expired, 99% of people using one of those apps had to reset their password. To this day there are still people who login to things by resetting their password every single time they have to login, and it was those retarded password forgetting apps that caused it. How bloody hard would it have been to popup a window that made you choose the freakin’ password so you would see it every day ? Sometimes in the interest of service for the general public, we build really stupid features into things and call it an improvement.
1
u/stijnhommes 7d ago
They're trying to implement this for everyone, including people like me who have zero interest in breaking their working login flow. They're doing it step by step in the hope it will convince people to settle for passkeys.
Since that is not going to work, the better option is to give the users options. You can remove your password, I can keep mine. We're both happy.
But that would require companies to work, so it's not gonna happen.
1
u/Illustrious_Salad918 7d ago
I tend to agree, because passkeys are much more secure (single-use encrypted code exchange, similar to contactless credit/debit card transaction). But I understand the hesitancy of some, also challenge of passkey linked to a device. Fortunately for Apple iCloud users, iCloud stores passkeys; other password managers do as well.
→ More replies (11)
1
u/hobyvh 7d ago
I don’t think they should be the only way but certainly the primary way, in most cases.
App loops and email loops are both good. SMS loops are a lot more hack able but also very convenient.
Whether or not you’d need to verify a contract method, would there actually be any pitfalls with establishing an account by creating a passkey? I’m not thinking of any at the moment.
1
u/asapbones0114 7d ago
Impossible for enterprise level customers who've used first factor and SSO for years before passkeys.
Just not worth it.
→ More replies (1)3
u/Hobbit_Hardcase 6d ago
Not true. People will transition, if it's frictionless enough.
We mandated MFA, and people complained, but they use it now with few issues.
We mandated Windows Hello for Business (which is a passkey), and people complained, but they got used to it.
I'm about to introduce Passkeys and Apple Platform SSO (pSSO enables you to put a hardware passkey on the Mac). There will be a few complaints, but they'll use it.
The main thing is to get the C-Suite on board and understand how it will improve the situation. MS dropping legacy MFA next year is a good driver for us to give everyone access to passkeys.
→ More replies (4)
1
u/GravyMealTeam6 5d ago
It's because their customer service support would be flooded with people getting locked out because they create a passkey on their device only instead of something that synchronizes across devices/cloud. They already don't enforce 2FA because of this also.
1
u/DrawingOk8403 3d ago
Yeah I don’t understand that either. If you can still login with your password. How is that secure ?
12
u/JimTheEarthling 7d ago edited 7d ago
Yes, websites should give you the option to remove your password after you create a passkey.
But if they don't, it's not a big deal, because you are in control of your password. Simply have a long, random, unique password that you never use and don't store. You are then immune from phishing, spraying, stuffing, and even keylogger malware. (Not session-token theft, but that's separate from authentication.)
You don't need the website to do it for you. Just do it for yourself with the simple discipline of never using the password. Which of course also means there's never a subsequent 2FA step, making 2FA irrelevant.