I don't like passkeys

For years, the tech world has insisted on promoting passkeys as the ideal method for signing into online accounts. Major companies often highlight how much more convenient passkeys are compared to traditional passwords. Google and Microsoft both market passwordless login as the way forward. Passkeys are a clever technology that cannot be stolen through phishing scams because they are tied to specific websites and cannot be recovered from server-side data after a data breach.

This makes them perfect for businesses, but potentially problematic for personal use. For individuals, the main concerns are getting locked out of their accounts, facing automated account bans, and losing access to devices. While passkeys enhance security against man-in-the-middle attacks, they introduce the risk of losing access due to the reliance on recovery methods like SMS, emails, or security questions.

If these fail, users may still be unable to regain access. Unlike passkeys, which can only be added or deleted but never transferred, passwords can be easily exported and stored in password managers like Bitwarden or KeePassXC. However, integrating passkeys into these systems remains complicated and inconsistent. Passkeys are beneficial when accessing accounts on your own devices, but become cumbersome when dealing with other people's computers.

Implementing passkeys can be financially burdensome for users who need to purchase multiple hardware keys and enroll them for each account. Hardware keys also have account limits, necessitating the purchase of additional sets as the number of accounts grows. While passkeys offer improved security over TOTP codes, their recovery and lockout risks may pose a greater threat to personal security than man-in-the-middle attacks.

For some users, transitioning from reusing passwords to using passkeys is a significant improvement, but for others, it may represent a step backward due to the added complexity and potential for loss of access.