Bob Young on Nostr: The problem with passkeys is the global, military-grade vulnerability created by ...

The problem with passkeys is the global, military-grade vulnerability created by massive centralization of indispensable authentication functions.

On the other hand… today, once again, I dealt with a long-time client that absolutely will not do the most basic things to make password authentication with 2FA easy.
He won’t write passwords down.
He won’t use a password manager.
He has several passwords only because some orgs won’t let him reuse previous passwords.
He has to reset his passwords on a regular basis.
He forgets his passwords.
His Microsoft account showed two authenticator apps - both installed on previous phones, not his current phone, so neither one could be used for password recovery/resets.

On the one hand, he seems like the poster child for why we should switch to passkeys.

But then again, setting up passkeys is NOT easy, it is NOT intuitive, it still requires memorizing or recording a PIN and one-time recovery codes, and authenticating in an authenticator app before you can authenticate in the app you’re trying to use confuses the heck out of most non-technical users.

Conclusion: the problem isn’t all Microsoft’s fault. If the client won’t keep track of his passwords, that’s on him. But Microsoft isn’t innocent, either. Passkeys are not wonderful.