Why passkeys are a step back for personal security: examining account lockout risks, platform lock-in, hardware key limits, and fragile recovery flows.
Really depends on what you mean by passkey, since it’s actually a fairly vague term for a bundle of technologies.
I don’t really care for password manager passkeys; just use a password, all it really does is save you from needing to enter a username in a login flow.
But I’m a big fan of hardware 2fa using non-resident keys (“passkey” lite); I’ll use a regular login flow with a password manager, then the 2FA step with a hardware token. Basically bulletproof (ditto if you secure your PW manager with hw 2fa) and painless.
android doesn’t allow 3rd party apps to use passkeys nor autofill 2fa consistently. For passkeys, you are forced to use google services for it, or loose access, making it pointless. TOTP codes meanwhile can at least be copied and pasted manually from a password manager.
I just remember my passwords idk lol. I never understood the logic of a password manager, someone hacks your manager they have everything in your life? Rather just run the risk of getting hacked one account at a time rather than they all get hacked at once when they get my password manager.
“use” I bet it just saves everything automatically, and they don’t even know their passwords are there. just “oh look, my password has appeared, lets click it!”
In my experience you’re more likely to find a sticky note on the desk with passwords than someone using a password manager, 2fa, or an ounce of ‘common’ sense.
My current employer will not authorize the use of a password manager. I have a key fob for my Microsoft account, and another account does phone verification. I use one password. If they don’t want to put the effort in for account security then neither do I. I use a password manager for nearly all my other accounts.
That is exactly why passkeys are a good thing. Basically everyone reused passwords everywhere.
A password manager is better than passkeys in 2026
Really depends on what you mean by passkey, since it’s actually a fairly vague term for a bundle of technologies.
I don’t really care for password manager passkeys; just use a password, all it really does is save you from needing to enter a username in a login flow.
But I’m a big fan of hardware 2fa using non-resident keys (“passkey” lite); I’ll use a regular login flow with a password manager, then the 2FA step with a hardware token. Basically bulletproof (ditto if you secure your PW manager with hw 2fa) and painless.
Some password managers can sync passkeys for you! Bitwarden can handle it
android doesn’t allow 3rd party apps to use passkeys nor autofill 2fa consistently. For passkeys, you are forced to use google services for it, or loose access, making it pointless. TOTP codes meanwhile can at least be copied and pasted manually from a password manager.
Maybe 5 or 10 years ago, but who doesn’t use a password manager these days? They generate random passwords and remember them for you
I just remember my passwords idk lol. I never understood the logic of a password manager, someone hacks your manager they have everything in your life? Rather just run the risk of getting hacked one account at a time rather than they all get hacked at once when they get my password manager.
Do you know any non tech people, especially over 40? Literally none of them uses a password manager.
Most of the non-techy people I know use the password manager built into their Web browser at the very least.
“use” I bet it just saves everything automatically, and they don’t even know their passwords are there. just “oh look, my password has appeared, lets click it!”
https://xkcd.com/2501/
Huh I thought it was going to be the correcthorsebatterystaple comic
In my experience you’re more likely to find a sticky note on the desk with passwords than someone using a password manager, 2fa, or an ounce of ‘common’ sense.
My current employer will not authorize the use of a password manager. I have a key fob for my Microsoft account, and another account does phone verification. I use one password. If they don’t want to put the effort in for account security then neither do I. I use a password manager for nearly all my other accounts.
So we should be using passkeys to access our password managers that generate random passwords and remember them for us! Ultimate protection.