Passwords suck. Can passkeys replace them?
The article, published on Lobsters, critically examines the viability of passkeys as a replacement for passwords. It highlights that passwords suffer from security issues like phishing and reuse, and usability problems such as forgetfulness. Passkeys, based on WebAuthn and FIDO2 standards, offer a more secure alternative by using public-key cryptography, where the private key never leaves the user's device. The author notes that major platforms like Apple, Google, and Microsoft have adopted passkeys, but cross-platform synchronization remains inconsistent. For instance, Apple's iCloud Keychain syncs passkeys across Apple devices, but interoperability with Android or Windows is limited. The article also points out that passkeys require biometric or PIN verification, which can be a barrier for some users. Additionally, the reliance on device availability means users could be locked out if they lose their device without a backup. The author suggests that while passkeys reduce phishing risks, they introduce new failure modes, such as account recovery challenges. The piece concludes that passkeys are a step forward but not a panacea; a hybrid approach combining passkeys with other methods may be necessary.
Passkeys could reshape authentication, but developers must handle cross-platform and recovery issues.