Re: Passkeys are a trap. Do not use them.

I see this topic bouncing around the blogosphere here, here and here.

I don't use passkeys. I find their usage and day-to-day workflow confusing. I'm sure that's because I use a 3rd-party password manager instead of whatever thing is built into Google. Like, if I just stopped resisting and let Google take that part over, I'm sure it would be easier, but then what do I do when I need to authenticate with my passkey on my Linux computer? What sort of weird, convoluted export process will I need to perform in order to log in on Linux? I'm rambling now.

I remember when Apple and Google were just rolling out passkeys, and I was worried about the idea that this would just be another lever those companies would use to lock you into their duopoly. And now here we are again, talking about this.

Even though the major players don't currently support attestation, I bet that's trivial for large multinational companies to implement whenever they feel the atmosphere is right. Embrace, extend, extinguish.

But dear reader, fear not. I am making the commitment to try out passkeys using my weird setup of KeePassXC on Linux and KeePassDX on Android, synced via Syncthing. I'll give them an honest try and report back on whether or not my fears, uncertainty and doubt are justified.