I don't like passkeys

For years, the tech world has been promoting passkeys as the ultimate way to log in. Major tech firms constantly remind users of the ease and convenience of passkeys when signing in. The only way to disable them is either to set them up or find the setting to turn them off. Google calls this setting "Skip password when possible" and Microsoft promotes a passwordless account.

Passkeys are secure as they are tied to the site they're created for, cannot be phished, and are not recoverable from server data breaches. This makes them suitable for corporate use but not ideal for personal security. The main risks for individuals using passkeys include permanent account lockout, automated bans, and device loss.

While passkeys improve security against man-in-the-middle attacks, they create a false sense of security as they rely on weaker recovery methods like SMS, email links, and security questions. Passkeys cannot be backed up or moved, requiring the purchase of multiple hardware keys for each site, which can be costly and difficult to manage as account numbers increase.

Major companies like Apple and Google want users to be tied to their operating systems, using their synced passkey management. If their systems ban an account, users lose access to all their passkeys across third-party sites. Passkeys are more secure against phishing compared to standard login methods, but they still rely on weak recovery methods, potentially leading to permanent lockout.

While passkeys offer better protection for enterprise users, the ecosystem is not mature enough for individual use. Alternatives like a combination of random passwords and a third-party password manager paired with a TOTP app provide users with control and flexibility without the day-to-day risks associated with passkeys.