When it happened to me I was staying with a family member whose house I’d never been to before, so I didn’t have their wifi. I couldn’t believe it.

Yeah same. Until I accidentally turned it off 1,000 miles away from my computer. That was a sad day.

Until it decides to delete every single side loaded book you have on there, which they like to do from time to time. The only way to completely avoid it is to load all your content via email, which unfortunately only supports limited formats.

Not even close. To be honest you’re operating on so many incorrect assumptions and have such a lack of general knowledge of common attack surfaces or even the average scope of modern breaches, that digging you out of this hole would take so much more than what I can fit in a single comment.

So

If the password is compromised, it means the service is compromised and the password isn’t really protecting anything anymore

No… just no. That isn’t how it works. In reality, what commonly happens is metadata around the service is what’s targeted and compromised. So your password, email, and other data like that are what’s stolen. Maybe in plain text, maybe something hashed that a malicious actor can brute force offline without you knowing. If you’re someone using a password in this situation, your password is then used to access your account, and that actor can do any number of things while masquerading as you, potentially entirely undetected. If you’re using a passkey on the other hand, this isn’t even something you need to worry about. They cannot get access to your passkey because the service doesn’t even have it. You are entirely immune. That is something that no amount of Passwords or bolt-ons will fix.

This is the main value of passkeys, they are not shared secrets. Not only is that a huge difference, it’s the single largest paradigm shift possible. The secondary value of passkeys is that they are immune to phishing. This is also huge, as phishing is hands down the most successful way to break into someone’s account, and happens to even the most security conscious people. If a cybersecurity researchers who write books on the topic can be phished, so too can a layman such as yourself. Hand waving away a phishing immune authentication system is unhinged behavior. And it goes to show you’re not even coming from a place of curiosity or even ignorance, but likely misinformation.

In short:

• Passkeys > Passwords
• Passkeys > Random Passwords + TOTP.

Bitwarden stores your passkeys on your local device. It can sync the passkey between devices but that’s end to end encrypted, bitwarden never has access to any of your passkeys or even your passwords.

It’s just a web based client instead of a desktop one. And it can usually output its own RSS feed that contains your other feeds so you can hook any RSS desktop client on any device to it.

Yes you can use a passkey set up on any given service to authenticate to a service that supports passkeys. You’d need import/export to move a given passkey from bitwarden to Windows.

Sure, and then that one password is compromised.

Which means that entire service you used that password to login to is compromised. If you were using passkeys however, you would have nothing compromised.

so if a service is breached, you’re basically as screwed with passwords as passkeys.

No… with a passkey you would be not screwed at all. You’d be entirely unaffected.

the security benefits are marginal in practice

I mean in your own example that’s a reduction of 100%. That’s kind of a huge difference.

The interoperability already exists in the protocol webauthn, part of FIDO2 which has been around for almost a decade. Interoperability is not remotely an issue with passkeys. Imported/export is/was and also already has a solution in the works.

This is the “Technology” community which isn’t for people who are actually tech-savvy in any functional way, it’s just for gadget-head laymen.

Storing passwords in a password manager is storing a shared secret where you can only control the security on your end and thus is still vulnerable to theft in a breach, negligence on the part of the party you’ve shared it with, phishing, man in the middle potentially, etc.

Storing a passkey in a password manager on the other hand is storing an unshared secret that nobody but you has access to, doesn’t leave your device during use, is highly phishing resistant, can’t be mishandled by the sites you use it to connect to etc.

So the problems you have with them are already solved, in the exact same ways they were solved for password/MFA. If you let Apple manage everything for you, it doesn’t matter whether you’re using passwords or passkeys, you’re locked in either way. But you always have the option to manage your passkeys manually (just like you’re doing with your TOTP) or using a third party cross-platform solution that allows for passkey import and export.

I mean you don’t have to authenticate your passkey with biometrics, you can use a password.

I guess I’m not really picking up on what the benefit is you’re going for. You already have a What You Have and a What You Know or What You Are, and you want a second What You Also Have thrown in there. I mean, I guess having that as an option couldn’t hurt. but I also don’t think it’s really necessary.

Passkeys are already more secure than what you’re doing now. If what you’re aiming for is for them to be even more secure than that, then that’s an admirable goal. But as of right now they are worth it just for the fact that they’re more secure than existing solutions.

I have to get to those servers through a jump box that requires me to unlock my phone and provide a biometric second factor before it will allow me through.

That is also the case with passkeys, if you so choose. Though they are functionally similar to your SSH key, they don’t just allow you to utilize the key just by having it loaded onto your device. When you go to use a passkey you need to authenticate your key upon use, and you can do that biometrically. For example let’s say I have a passkey on my phone which is currently unlocked and in use. If somebody runs over and steals the phone from my hand and prevents it from locking, and then attempts to authenticate to a site using my passkey, they won’t be able to.

Yes, the author is also suffering from the same misconceptions and doesn’t really understand passkeys beyond the surface level, so he doesn’t know that the problems he has with them don’t exist.

He then goes on to reason that because passkeys might result in an awkward experience in exactly one extremely niche scenario, that you’re better off using passwords in a password manager that are less secure. He then proceeds to suggest the use of email as a second factor as an alternative, which destroys every shred of credibility he had. He also completely misses the fact that putting your passkeys in that very same password manager he himself is suggesting, solves the complaints that form over half of his entire argument. It’s super ironic too because the specific password manager that he’s recommending in his own article is a member of the FIDO Alliance and is literally one of the world’s biggest advocates for passkeys.

I don’t think that, you said that. It’s the very first sentence of your comment. You literally said that you misunderstood them to be hardware keys.

And yes, everything else you said is demonstrably false as well. The FIDO alliance and even specifically the companies within it that are pushing Passkeys the most, are advocating for them to be cross platform without any lock in. 1Password is one of the companies pushing for passkeys, they’re even behind the https://passkeys.directory and allow you to securely import and export passkeys so you aren’t locked in. They also made recent changes to the spec itself to make moving and owning passkeys easier. And that’s not even to mention the fact that Passkeys are just key pair, which don’t require any platform or technology to implement that isn’t built into your device.

If companies still allowed you to login via password then any benefit you get from Passkeys would be null and void. In order to implement passkeys properly you have to disable password authentication.

The thing is it’s then on you to secure your passkey with biometrics or a password or whatever you prefer. Your phone most likely will use biometrics by default. If you’re on Mac or PC you’ll need to buy a thumbprint scanner or use camera-based window hello / secure enclave

Was this reply meant for me? I’m not sure what you’re saying

And passkeys don’t solve any sort of MFA problem

They do in fact solve this problem. Passkeys are something you have, and are secured by something you know, or something you are.

They also solve an age-old problem with passwords, which is that regardless of how complex your password is, it can be compromised in a breach. Because you have no say in how a company stores your password. And if that company doesn’t offer 2FA or only offers sms or email verification, then you’re even more at risk. This problem doesn’t exist with passkeys.

Edit: lol

I thought passkeys were supposed to be a hardware device?

Did you just admit to not even knowing what a passkey is and then decide to continue to write another two paragraphs passing judgement on them and the motives behind them anyway?