I don't like passkeys

For years, the tech industry has been pushing passkeys as the ultimate solution to logging in. Big Tech companies constantly remind users of the ease and convenience of passkeys. To turn them off, users must either accept them or find the off-switch in the settings. Google labels this setting "Skip password when possible," while Microsoft promotes passwordless accounts.

Passkeys are secure as they are bound to the site they were created for, making them immune to phishing attacks. They also offer benefits in corporate environments, but are less suitable for individual security. The main concerns for individuals are account lockouts, bans, and device loss. Passkeys improve security against man-in-the-middle attacks but can create a false sense of security.

They rely on weak recovery methods, such as SMS, email links, and security questions, which can still lead to permanent lockouts. Passkeys cannot be backed up on a hardware key, as they can only be added or deleted. This can result in costs and scalability issues as the number of accounts grows. Hardware keys support discoverable credentials, but have a limit of 25-100 accounts per key.

If the limit is exceeded, users must delete some accounts or purchase additional keys. Apple and Google aim to anchor users' identities to their operating systems, creating a "happy path" for synced passkey management. If their systems ban an account, users lose access to all their passkeys across third-party accounts. The FIDO alliance is working on interoperability and export options, but the experience is still fragmented.

Passkeys are more secure against man-in-the-middle attacks than passwords, but offer a false sense of security. They require backup on hardware keys, which can be costly and challenging to manage. While passkeys may be beneficial for enterprise users, the ecosystem is not mature enough for personal use. Combining randomly generated passwords with a password manager and a TOTP app provides users with control and flexibility.