[dotancohen]

In what way are Passkeys, as implemented (not theoretical benefits), better than passwords?

Better: not in a single metric but rather as a complete measure of both preventing unauthorized access to a resource and also _enabling_ authorised access to that same resource.

[wolvoleo]

They're better in some ways. They don't rely on a secret with low entropy which is really brute forceable. They can't be used on a phishing site because the URL is part of the secret. Even when you authenticate to a fake site you don't give them the ability to authenticate as you until you change the secret (like you do when you give them your password)

They also have 2fa built in. No need for a separate app, entering codes whatever.

[dotancohen]

That's why I mentioned "and also enabling authorised access to that same resource". Passkeys are great at preventing unauthorized access. But that comes at the expense of preventing authorised access. For example, using another device or even moving to another device. Replacing a stolen or damaged device is also nearly impossible with a reasonable quantity of Passkeys.

[wolvoleo]

Well that's why they can sync between devices. I don't really see the problem.

Even if you don't like to rely on big tech (google/apple), I don't either, there are many options now for full FOSS implementations like bitwarden and KeepassXC.

If you use a yubikey as a passkey then yes, that's not a great option also because most services don't allow you to enroll more than one passkey. But with bitwarden that doesn't matter.

[TeMPOraL]

> Well that's why they can sync between devices. I don't really see the problem.

How do you sync passkeys to someone else's phone to authorize them to act in your name?

This is the basic use case, very common in the physical world, that security industry refuses to accept exists.

Passwords have this capability by nature.

> because most services don't allow you to enroll more than one passkey

Which is dumb and part of what makes passkeys not just useless, but dangerously so. Same story with 2FA, and the many services that only allow you to have one registered authenticator app at the time.

[dotancohen]

  > Well that's why they can sync between devices.

What Passkey implantation syncs between devices? I've only ever seen "cloud sync", e.g. syncing with someone else's computer. Can a user sync iPhone passkeys with her Boox E-ink tablet (Android)? Can either sync with a Debian desktop?

[wolvoleo]

Yes you can do that with Bitwarden or KeepassXC.

Not sure if either works on iOS, I don't use that but they work on desktop and Android (you use KeepassDX there to read them).

[dotancohen]

Great, thanks.

[dotancohen]

KeepassXC now supports Passkeys? All right then, I accept that argument. I do use Keepass and compatible programs.

[wolvoleo]

Yes! Though on Android you need the app KeePassDX to read them, I was mistaken about the name.

[Marsymars]

They're better for both parties with the subset of providers who require one of either SMS 2FA or passkeys.