# Toward a Passwordless Future **URL:** https://discuss.privacyguides.net/t/toward-a-passwordless-future/25595 **Category:** Articles **Created:** 2025-03-08T16:25:31Z **Posts:** 47 ## Post 1 by @fria — 2025-03-08T16:25:31Z > **[Toward a Passwordless Future](https://www.privacyguides.org/articles/2025/03/08/toward-a-passwordless-future/)** > > Privacy Guides is the most popular & trustworthy non-profit privacy resource to find privacy tools and learn about protecting your digital life. --- ## Post 2 by @jonah — 2025-03-08T16:25:41Z --- ## Post 3 by @phnx — 2025-03-08T16:26:58Z These recent articles are :fire: --- ## Post 4 by @anon36940904 — 2025-03-08T16:27:01Z The published date on the article says March 12? --- ## Post 5 by @phnx — 2025-03-08T16:28:02Z For me it says March 8th. Read time is 12 minutes though. --- ## Post 6 by @anon36940904 — 2025-03-08T16:45:32Z I swear, a few minutes ago it said March 12. Could be a bug? --- ## Post 7 by @fria — 2025-03-08T16:49:34Z It was originally meant to be on march 12 but y’all are getting it early now haha --- ## Post 8 by @anon23428838 — 2025-03-08T20:39:16Z Haha. Funny enough, I was looking into passkeys the other day. I tried them out with PrivacyGuides and I was like “What?! That convenient?” I was also curious about the security advantages about passkeys. This article sums it up very nicely! --- ## Post 9 by @fria — 2025-03-08T20:42:09Z Thank you, yeah I was surprised how convenient they are the first time I tried them out. My parents actually go for them as well whenever they’re available. --- ## Post 10 by @bitsondatadev — 2025-03-08T22:17:40Z > [@phnx](#): > > These recent articles are :fire: Second this! Great job @fria! I have been trying to get everyone to use a password manager. One question, I’ve noticed you can add multiple keys similar to hardware keys on sites. Is that a requirement of FIDO or at least becoming standard? That would supplement password sharing in password managers. Edit: If magically all websites implemented this today, would this remove the need for hardware keys? --- ## Post 11 by @fria — 2025-03-08T22:48:37Z > [@bitsondatadev](#): > > If magically all websites implemented this today, would this remove the need for hardware keys? No I don’t think so. An issue still with passkeys is that they’re not tied to one specific device they’re designed to be able to be synced across devices. So an attacker could hack your password manager on your phone for example and get your private key, hardware keys are still really useful since they’re secure against that kind of attack (although they’ve had vulnerabilities in the past so I’m not sure in the real world how much better they are really). --- ## Post 12 by @fria — 2025-03-08T22:55:36Z > [@bitsondatadev](#): > > One question, I’ve noticed you can add multiple keys similar to hardware keys on sites. Is that a requirement of FIDO or at least becoming standard? It’s definitely a recommendation by FIDO: > **[White Paper: Multiple Authenticators for Reducing Account-Recovery Needs for...](https://fidoalliance.org/white-paper-multiple-authenticators-for-reducing-account-recovery-needs-for-fido-enabled-consumer-accounts/)** > > White Paper: Multiple Authenticators for Reducing Account-Recovery Needs for FIDO-Enabled Consumer Accounts. It doesn’t seem to be a requirement though. --- ## Post 13 by @bitsondatadev — 2025-03-09T00:57:01Z > [@fria](#): > > It’s definitely a recommendation by FIDO I think it is already pretty common for the sites that do so hopefully that trend sticks. > [@fria](#): > > An issue still with passkeys is that they’re not tied to one specific device they’re designed to be able to be synced across devices This has me trying to think of a good balance between having a hardware key and now passkeys as they become a more ubiquitous option. I’ve lost two security keys and its just something I do and have it as part of my security model to lose them but I hate that. Ive legit considered getting a programmable skin implant: [The microchip implants that let you pay with your hand](https://www.bbc.com/news/business-61008730) --- ## Post 14 by @cooolguy — 2025-03-09T01:06:54Z Pretty cool to see some of the history behind the whole concept of passwords in this article. Understanding ‘how we got here’ is so important to understanding the context in which we think about what’s next. Keep up the great work! --- ## Post 15 by @fria — 2025-03-09T01:11:32Z Thanks so much! --- ## Post 16 by @fria — 2025-03-09T06:28:22Z > [@bitsondatadev](#): > > I’ve lost two security keys and its just something I do and have it as part of my security model to lose them but I hate that. That’s the idea behind passkeys I think, bring most of the security benefits of hardware keys while providing a lot more convenience and assurance against getting locked out of your accounts. > [@bitsondatadev](#): > > Ive legit considered getting a programmable skin implant: [The microchip implants that let you pay with your hand](https://www.bbc.com/news/business-61008730) The idea of this makes me squirm haha, I’d rather just use my phone. --- ## Post 17 by @bitosi — 2025-03-09T09:04:40Z > Essentially, password managers try to eliminate the human error element of passwords. But in doing so, they introduce more attack surface: you now have a repository of all your login credentials conveniently located on your device, so if your device is compromised, all your accounts are also compromised. Little correcrion. Attack surface ≠ protected amount of data The password manager itself has very little attack surface. The attack surface would rather be the OS. --- ## Post 18 by @WhinyHamletPayer — 2025-03-09T09:21:20Z Yes, no passwords would be great but there is currently no incentive for companies to make the shift, and that only happens if people gave a damn about security. What was the incentive for companies to switch to HTTPS? Hoping something similar could happen. --- ## Post 19 by @anon48875053 — 2025-03-09T10:11:21Z Will wait until we have open and FOSS implementations on all platforms until jumping on the passwordless train. Currently, you need Google Play Services to use FIDO2, so no thank you. --- ## Post 20 by @TinFoilHat — 2025-03-09T10:43:20Z I briefly tried to set up a Passkey (Security Key) for Proton on computer using KeePassXC, for some reason, Proton just kept saying > Something went wrong registering your security key. Please try again. Maybe Proton does not accept KeePassXC as a Passkey. Will try a few more other services but not holding my breath. --- ## Post 21 by @FateAmenableToChange — 2025-03-10T09:02:31Z If all the passkeys are stored on a device, would a compromised device not be a single of point of failure similar to a password manager? --- ## Post 22 by @fria — 2025-03-10T09:03:29Z Yes. The point I think I didn’t get across that well is you need a password manager anyway and passwords add a lot of attack surface on top of that. --- ## Post 23 by @TinFoilHat — 2025-03-10T10:53:22Z Pasdkey does to a degree protect people from phishing, as long as they try their best not to be lazy and type password instead. Password being a fallback reduced the effectiveness of passkey by 2/3, cause not only people might think a phishing site is legit and type their credential, the credentials can also leak through data breaches. --- ## Post 24 by @bitsondatadev — 2025-03-10T11:57:40Z This is why I really like KeepassXC because I can lock that database with another password like biometric or hardware key (possibly one I store subdermally :ok_hand::smirking_face:). --- ## Post 25 by @Regime6045 — 2025-03-10T15:48:43Z If I were to use Bitwarden for passkeys (I think they support it now) and sync it across devices, is there any benefit compared to randomly generated passwords + TOTP? --- ## Post 26 by @phnx — 2025-03-10T16:31:55Z Yes, passkeys are phishing-resistant; you can’t be tricked into using them on a phishing site like with a password + TOTP. Websites also don’t store your passkey in the same way they store hashed passwords, so there is no risk of their database being hacked and your hashed passwords being cracked. --- ## Post 27 by @Swarming0001 — 2025-03-10T17:30:39Z Wow, what a fascinating article. Thank you to whomever wrote it! I love taking a look at technology from a wider historical perspective. --- ## Post 28 by @fria — 2025-03-10T19:40:11Z Glad you liked it! --- ## Post 29 by @a_user — 2025-03-11T01:33:21Z Flip side: there are a lot of scenarios - particularly in business - where you are managing other people’s credentials. How do you use their credentials without syncing their _entire passkey store_ to your device? If passwords ever go away, this is a concerning situation to be in. --- ## Post 30 by @fria — 2025-03-11T02:21:32Z You can share passkeys just like passwords inside the password manager. You can also have multiple passkeys per account so if they want to add their own passkey they can. --- ## Post 31 by @deimos — 2025-03-11T02:39:19Z This is a great history of passwords and how we arrived at where we are. As written by one of the authors of the passkey standard, [this](https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/) is still true. We are still in “The Enshittocene Period”. My [solokey](https://solokeys.com/) continues to work fine and is hardware and operating system independent. This is as FIDO2/“webauthn” as I get. I have no Google, Microsoft, nor Apple accounts. I barely use a mobile phone. Every service I use still requires a username, password, and now my 2FA solokey. I’ll use passkeys when I can manage them like I mange my ssh keys and my own certificate authority. No service I use asks for a passkey nor to generate one. In theory, I could use (from the FIDO Passkey standard): > Device-bound passkey\*: bound to and used only on a single device (a security key) , but I haven’t found anything that works like this on the command line (maybe skey OpenBSD). I’m open to suggestions for FreeBSD or OpenBSD. --- ## Post 32 by @a_user — 2025-03-11T04:22:28Z That’s good. I know this is possible with at least Bitwarden, but I don’t think you can do it with Apple’s iCloud keychain and probably other passkey implementations? I know iCloud keychain is firmly locked to Apple devices, for example. I also have some concerns about compatibility. Will passkeys work on Linux? On Firefox? Probably not Ladybird, yet… Do they need OS-level support? Every time I see a pop-up asking me to start using passkeys, I worry, “am I going to be able to sign in again if I say yes..?” They seem like a similar trap to “Sign-in with Google”. Only using Bitwarden to store passkeys seems like the safest way. I understand passkeys as an analogue to SSH keys. But they seem really complicated and I have so many questions and concerns about them. I’ve tried to read the docs, but I just kept getting more confused. --- ## Post 33 by @fria — 2025-03-11T05:24:44Z > [@a_user](#): > > That’s good. I know this is possible with at least Bitwarden, but I don’t think you can do it with Apple’s iCloud keychain and probably other passkey implementations? In the apple passwords app you can [share passkeys](https://support.apple.com/guide/iphone/share-passwords-iphe6b2b7043/ios). You can also [airdrop](https://support.apple.com/guide/iphone/share-passwords-securely-with-airdrop-iph0dd1796bb/18.0/ios/18.0) them to other people. Right now they’re working on the [Credential Exchange Protocol](https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20240522.html) to let you securely export passkeys and passwords between password managers so there shouldn’t be any issues once that’s implemented. > [@a_user](#): > > I also have some concerns about compatibility. Will passkeys work on Linux? On Firefox? Yes they work on Firefox and Linux. --- ## Post 34 by @AeroBricks — 2025-03-12T03:58:33Z Emmm, if passkeys are synced across devices, doesn’t it have the same pitfall as all password managers? a single repository of all passkeys stored on every device. (yeah I know it’s E2EE but passwords in password managers are also E2EE) It’s still a single point of failure. --- ## Post 35 by @fria — 2025-03-12T04:00:49Z Yes, my point that I’d didn’t get across so well in the article is that you need a password manager anyway in order to have secure passwords, and passkeys solve most of the issues with passwords. So it’s better to use passkeys than passwords overall. --- ## Post 36 by @AeroBricks — 2025-03-12T05:57:14Z Thanks. This is an awesome article even for the non-technical. --- ## Post 37 by @fria — 2025-03-12T06:16:15Z Thanks! --- ## Post 38 by @JibJab — 2025-03-13T19:32:35Z Thats a nice write-up! I always thought one of the origins was from a guard bellowing “Whats the word to pass!” from a medieval tower. :squinting_face_with_tongue: Am looking forward to a time when I can use passkeys but I see three hurdles. 1. Low adoption rate with no incentive to adopt by most of the sites I use. 2. Inconsistent implementations are the norm. Every site that supports passkeys handles them differently. Even the older FIDO1 security keys arent implemented in a standardized fashion with major sites like Paypal only allowing 1 of them per account. 3. Passkeys are only as strong as the weakest 2FA the site supports and this too often means they also require Email or SMS text as backup. --- ## Post 39 by @system — 2025-09-20T18:12:41Z --- ## Post 40 by @asanyan — 2025-09-21T16:48:47Z Good article. Maybe I’m overthinking this, but I’m conceptually not a fan of allowing websites to interact with the “system keyring”. Maybe I’m worrying about nothing but my gut feeling is that eroding barriers between the browser and the OS isn’t a very good idea, even if the alternative is to deal with passwords. --- ## Post 41 by @MagicLantern — 2025-09-21T17:03:04Z > [@asanyan](#): > > I’m conceptually not a fan of allowing websites to interact with the “system keyring”. It’s safer for a credential manager solution to integrate through the system keyring rather than making a browser extension which sites can potentially tamper with, along with manipulating their UI since it’s embedded in the web page. --- ## Post 42 by @system — 2025-11-07T05:50:51Z --- ## Post 44 by @system — 2025-11-08T06:03:43Z --- ## Post 45 by @Blackbird — 2025-11-08T10:33:48Z This is probably the best article so far, or at least the one I found most interesting! It also finally motivated me to create a second set of Passkeys for my other YubiKey, something I had been putting off for a couple of months now. Thanks! edit. W\*\*! Turns out it wasn’t new, but I had missed it completely. --- ## Post 46 by @Niek-de-Wilde — 2025-11-08T11:18:37Z Entirely the reason why we bump them once in a while :slight_smile: --- ## Post 47 by @Blackbird — 2025-11-08T11:25:56Z It just happened to be the 8th. :sweat_smile: