Post #1179587

2026-04-15 20:49 UTC

Just learned why I won&#39;t be using passkeys. Because it requires icloude keychain, and I definitely don&#39;t want apple having a copy of my passkeys. Yes, I know they&#39;re supposedly e2ee and everything, but also, allowing the passkey to transit devices actually means that it isn&#39;t really 2FA anymore, especially if you keep any password in the same keychain. It&#39;s pretty embarrassing how the security industry has managed to rebadge a not 2FA into 2FA.

Replies (5)

@mwl@io.mwl.io 2026-04-15 20:52

@encthenet@flyovercountry.social If I can't print it on paper and store it in my safe deposit box, it's not "something I know." I'm certainly not going to authenticate with "something my computer knows."

Open ##1185420
@JensHannemann@mastodon.online 2026-04-15 21:02

@encthenet@flyovercountry.social You can use Passkeys with 1Password, independent of iCloud. I’m sure other password managers also have that feature. Or you can do what I do and use physical passkeys like a YubiKey. And passkeys were never meant to be a 2FA. The FIDO2 protocol still allows for 2FA, though.

Open ##2238402
@mroach@ublog.mroach.com 2026-04-15 21:17

@encthenet@flyovercountry.social You can use passkeys with other password managers that are open source and self-hostable like BitWarden. Passkeys are supposed to be protected with biometrics or a “something you know” to be used. (I forget exactly which phase of passkey auth requests and enforces this)

Open ##2238408
@LovesTha@floss.social 2026-04-15 22:18

@encthenet@flyovercountry.social I like the move to secure things that aren't passwords, but 2FA where both live in my password manager isn't any better than the best of those two factors.

Open ##2238409
@adingbatponder@fosstodon.org 2026-04-16 06:52

@encthenet@flyovercountry.social Super interesting explainer about #passkeys https://www.youtube.com/watch?v=lypcC79k-gg

Open ##2238410