Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Passkeys Are Not Passwords (neatnik.net)
4 points by todsacerdoti on Aug 14, 2024 | hide | past | favorite | 3 comments


I still don't get passkeys.

Even in this article the author says "don't worry about portability just set up a new one using the email fallback that almost every service provides".

But then what have I gained, if there is still an email fallback?


You've gained the convenience of not round-tripping through your email client every time you want to login/authenticate with the service!

The same is true of passwords, of course; if there's an email-based password-reset mechanism, then your email is your real proof of identity; the password is a shortcut.

Passkeys are a shortcut too; they just pick a different set of tradeoffs (less portable, less user-visible, more secure, harder to get phished, less stuff to remember). IMHO, these tradeoffs turn out to better-match the threat model of the modern web.


Right but before passkeys I was using password + phone confirmation.

So I see why passkeys improve on passwords, but not on 2fa.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: