Passkeys: The beginning of the end of the password
Just here to note that there are several huge problems with this approach from an actual security standpoint:<p>First is that this changes from 2-factor authentication (something you have plus something you know) to single-factor (just something you have).<p>Also be sure to notice in the article that they have changed their term there to 2-STEP authentication, not 2-FACTOR authentication, these are not the same thing, and they know that. It&#x27;s important that you know the difference too if you want any kind of real security. If you use passkeys plus an authentication code app, then you have 2-steps (for whatever that&#x27;s worth) but not 2-factors since they are both just a piece of code on your device, if they are both on the same device, that&#x27;s even less secure since they can both be compromised at the same time, and in practice they will be.<p>Second is that the now single factor authenticator is strictly worse than a password because it is something that can be taken away from you and manipulated without your permission.<p>Third is that the keys are not private since the passkey provider is storing them for you and&#x2F;or copying them around. This means they can be spied on, stolen, or demanded by the government, all without you even knowing someone else got access to your stuff.<p>The last glaring issue I can see for the time being is that it relies on a simple, easily cracked unlock pin, or worse still fingerprint&#x2F;facial recognition bio-metrics as the only way to keep someone, other than Google, out.<p>One might be tempted to think facial recognition or fingerprints are pretty good security but it&#x27;s already been demonstrated that people can break those mechanisms quickly and the cops can and will use your fingerprint and&#x2F;or mug shot to unlock your phone if it&#x27;s locked by biometrics only. They are not allowed to force you to give your real password, but the courts do allow them to use any means they like to break into your phone. Even if they damage it in the process, they just have to pay you back for it, they still get to take your data and use it against you.<p>Just some things to keep in mind before anyone gets too excited about this &quot;new&quot; invention. There&#x27;s a reason we still have passwords even though we&#x27;ve had Smart ID Cards (such as DoD&#x27;s CAC system <a href="https:&#x2F;&#x2F;www.cac.mil&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.cac.mil&#x2F;</a>) and other device driven access controls for decades now.