My impression of passkeys has
been, from the beginning, "What if SSH keys were something a third party
megacorp could monitor and revoke", and I haven't yet seen a compelling reason to think any differently

Okay, actually originally it was "never once getting an answer from any passkey booster to the question 'what happens if you break your phone?'".

But now they have have cloud backups… oh, huh, what's that? It ranges from incredibly tedious to impossible to back them up in a way independent from the megacorp's cloud services that they can arbitrarily disable your access to at any time? (https://web.archive.org/web/20251219012600/https://hey.paris/posts/appleid/)

Also I'm noting now that I'm specifically talking about the "mass market" passkeys that literally everyone actually means, I know yubikeys and such exists and use the same technology as passkeys (and are just passkeys). But those are hypernerd and corporate-mandated shit, your mother or a random teenager is not using one of those of their own volition and if they mention "a website wants me to use a passkey instead of a password" they ain't talking about a yubikey and you know it

@nytpu i was under the impression that password managers can just store passkeys (which pushes the problem to "how does your password manager not screw you", but that's a problem you have to deal with right now unless you just do password reuse and remember everything. which is suboptimal.)

@5225225 @nytpu so, on Android i can store my passkeys in any password manager. i currently store mine using KeePassDX. great! except there’s no way to use those passkeys on Linux because nobody’s made a system for that. Yay!

@eri @nytpu Yeah. there's a firefox browser extension that should work, at least in that one browser... but it doesn't seem to, for me.

fun!!

but yeah, a system password manager works great on android.

not so much on linux, and i have no clue how it works on windows/macos.

@eri @nytpu @5225225 the keepassxc extension purports to support it but it’s broken

@eri @5225225 @nytpu anyways other linux password managers like bitwarden do not have this issue, naturally

@charlotte
@5225225 @eri @nytpu
in my experience, you can get it working by making sure the password database is open and connected to the browser extension (by opening/connecting from the extension's side)

suboptimal, but at least it works? (if it indeed does)

@niacdoial @5225225 @eri @nytpu it wouldn’t show up if the pw database wasn’t connected

the broken bit is that the keepassxc extension returns an error to the website. Create a new passkey? passkey is created in the db, but the website says that it failed. Use a passkey? passkey is selected and the counter increased, but the website says that it failed

@niacdoial @5225225 @eri @nytpu I have used keepassxc until just a few days ago and switched because of this issue, I know how to use the extension

@charlotte

[edit2: ok, now I actually saw both messages]

ah, that's... annoying.
I'm sorry, then.
I guess I should have known the "realising it's not actually broken but just quirky, when I try again several months later" is just a skill issue on my side.

[next paragraph now unrelated]
...and now I am realising that password input also requires manual reconnects, rather than being "more automatic".
I guess it just felt that way because the interaction with the extension happens inside the password field itself, rather than the browser taskbar button?
Though, there probably should be a way to hook the browser's attempt to get a passkey to the "do you want to unlock the database" dialog.

@niacdoial also to be fair, it did work well in the past

@charlotte @niacdoial TOTP just fucking works btw

@eri @niacdoial i somehow had issues with totp on akkoma with keepassxc but not bitwarden 🤷

it’s easier to use passkeys tho

@charlotte @niacdoial how would totp stop working they’re fucking numbers

@eri @niacdoial i don’t know, it wouldn’t take the ones that the browser filled in and i had to copy paste it out of the password manager

@charlotte
oh? (I swear if it only works on this machine because I'm using debian this is going to be sad)

@eri @niacdoial @charlotte my take is that TOTP doesn't provide much security over "a randomly generated password in a password manager". you're still vulnerable to phishing if you don't have domain-based autofill

my Theory is that TOTP is pushed since it's a way to force people to use a password manager or authenticator app, in such a way that's more acceptable than "i have assigned you a password. store this." would be.

(my evidence is that github specifically tells you to put your TOTP secret inside a password manager, so it can't be actually about 2 factors, since that's putting both factors in the same place)

@nytpu

I have one financial account that requires a passkey. I also already own a yubikey, because it was handy for $WORK, using the OTP function, not passkeys (but recent changes mean I only use it for one $WORK thing anymore, specifically AWS CLI auth).

So I put the passkey for the financial account on the yubikey and it works from computer to computer, but doesn't work on my phone. Such success

@elithebearded @nytpu Android for some reason treats passkeys a bit separate from general purpose FIDO2 stuff

...installing a shim app that just bridges the gap works perfectly fine and lets me use the USB key over the NFC though

@saphire @nytpu

Yes, this is a totally reasonable thing to do and I would have no problems explaining this to a family member making a frantic phone call

@elithebearded @nytpu In that case I don't think you would be making them use USB tokens in first place, and just throw them at hopefully okay mercies of a password manager...?

Uhhhh, blegh. The ecosystem is really stuttery in terms of support for the APIs on OS level, sadly, and this is turning into a bigger and bigger problem. The worst offender has been Android, and old(-ish) phones are... barely (works with google password manager) to utterly unusable (nothing works \o/) in terms of modern FIDO2/Passkeys support.

I keep pondering poking on linux side of things but... No clue where to start even. Oh how much do I crave for system-wide password management API on Linux T_T