We had originally planned to go all-in on passkeys for ONCE/Campfire, and we built the early authentication system entirely around that. It was not a simple setup! Handling passkeys properly is surprisingly complicated on the backend, but we got it done. Unfortunately, the user experience kinda sucked, so we ended up ripping it all out...
The problem with PassKey is simply that they made it way more complicated.
Anyone who has worked with SSH keys knows how this should work, but instead companies like Google wanted to ensure they had control of the process so they proceeded to make it 50x more complicated and require a network connection. I mean, ok, but I’m not going to do that lmao.
Private keys on an anonymous, untraceable smartcard. PIN or Matching-on-card fingerprint for the second factor Everything else can go directly into the garbage bin
Would love for you to describe exactly how it’s more complicated. From my perspective I click a single button and it’s set up. To log in I get a notification on my device, I click a button and I’m logged in.
they must have meant technically complicated, which is also meaningful in consumer technology.
like if it’s true that it requires an internet connection, that’s quite bad, partly because of yet another avenue for possible tracking, and what if the service you want to access is not on the internet, but the passkey doesn’t work without it still
“More” is relative, ofc, so YMMV on whether you agree with me or not on this.
But the problem with pass key is that it has all of the downsides of 2FA still – you need to use a mobile device such as a cell phone, that cell phone must be connected to the internet and you often can’t register a single account to multiple devices (as in, there’s only ever 1 device that has passkey authorization.)
This isn’t an issue with ssh keys, which is a superior design despite it not being native to the web browsing experience. SSH keys can be added or removed to an account for any number of devices as long as you have some kind of login access. You can generally use SSH keys on any device regardless of network connection. There’s no security flaws to SSH keys because the public key is all that is held by 3rd parties, and it’s up to the user in question to ensure they keep good control over their keys.
Keys can be assigned to a password and don’t require you to use biometrics as the only authentication system.
I feel like there’s probably more here, but all of this adds up to a more complicated experience IMO. But again, it’s all relative. If you only ever use password + 2fa, I will give them that it’s simpler than this (even though, from the backend side of things, it’s MUCH more complicated from what I hear.)