# Will Passkey Replace Passwords Completely on the Web? **URL:** https://discuss.privacyguides.net/t/will-passkey-replace-passwords-completely-on-the-web/22946 **Category:** Questions **Created:** 2024-12-04T22:25:21Z **Posts:** 33 ## Post 1 by @mongrel306 — 2024-12-04T22:25:21Z Passkey has been introduced by Apple and increasingly by Google and other services. Some supporters of passkey argue that it is a more secure way to replace passwords altogether. On the other hand, there are those who complain about the current design and UX of passkey, and there are those who still strongly support the password option. I find passkeys to be more secure than passwords, at least in some aspects, but I also find passwords easier to deal with. I am curious how it is viewed in this community that is so passionate about privacy. Will passkeys completely replace the use of passwords on the web in the future, or will the password option also remain persistent? If the passkey cannot replace the password, what is the passkey missing? --- ## Post 2 by @fria — 2024-12-04T22:46:08Z Passkeys are both more secure and more convenient. They should ideally replace passwords one day but the way they’re being implemented now isn’t great, because most sites don’t let you delete your password. --- ## Post 3 by @bigdzi — 2024-12-04T22:59:06Z > [@fria](#): > > Passkeys are both more secure and more convenient. I agree with security part, but so-so agree on convenience part though… > [@fria](#): > > They should ideally replace passwords one day NOT AT ALL! It’d be complete disaster security wise if not sth else. Passwords and passkeys will coexist in the way that user will have a choice. What will change is passkeys will become major way of protecting our accounts. > [@mongrel306](#): > > what is the passkey missing? Thats good question :slight_smile: What I find most irritating when dealing with passkeys is lack of the ability to rotate them. Meanwhile, its trivial to bulk rotate passwords (for example on multiuser server-env) --- ## Post 4 by @win11.shading291 — 2024-12-05T00:57:15Z From my understanding, good passwords are better then passkeys. Passkeys are for users who will never bother to use a password manager and have an individual strong password per website/app/software user. --- ## Post 5 by @fria — 2024-12-05T01:15:53Z No passkeys are still better. They’re based on public key cryptography, so they don’t rely on the service provider to securely store them, basically eliminating data breach issues that passwords have. They don’t rely on the user coming up with their own password and remembering it, or janky password manager autofill and autogenerators for passwords. They can’t be phished, even if your password is excellent if you go to [discuss.pr1vacyguides.org](http://discuss.pr1vacyguides.org) and put in your password, you’ve been phished. With passkeys that won’t work at all. --- ## Post 6 by @fria — 2024-12-05T01:21:24Z > [@bigdzi](#): > > What I find most irritating when dealing with passkeys is lack of the ability to rotate them. You don’t need to rotate them. And you can add multiple passkeys to an account if you want and delete the old one, it’s quite easy. --- ## Post 7 by @bigdzi — 2024-12-05T06:28:52Z > [@fria](#): > > delete the old one, it’s quite easy. Deleting passkeys is possible, ofc, but, there is still no good, well-designed UI to manage bulk actions with passkeys. If you have multiple passkeys and want to delete them, you have to go one-by-one. > [@fria](#): > > You don’t need to rotate them. Why not give admins this option? All I want to say is that passkeys are still WIP and shouldnt be used as the only solution available. Rather as backup way of login. At least till they reach product maturity. --- ## Post 8 by @hakavlad — 2024-12-06T11:30:52Z Passkeys reduce availability: I cannot easily log in on a new device with a passkey. --- ## Post 9 by @anon80779245 — 2024-12-06T11:32:08Z I doubt they are. Password+2FA will remain an alternative for a while. --- ## Post 10 by @anon39279085 — 2024-12-06T11:41:53Z especially for mobile and stuff they’ll remain for a while. The alternative I think is going to be Security Keys, where you use your phone or password manager to authorize accounts or QR Codes(maybe) --- ## Post 11 by @Gavin — 2024-12-06T14:21:12Z Probably not. My passkey for my google account just never saved in my password manager, and I lost it… Leading me to have to reset it, luckily I had TOTP, so it wasn’t that hard to remove… But still… Not a great first experience for passkeys --- ## Post 12 by @brivacy — 2024-12-06T14:37:00Z You cant save your passkey in a pasword manager for android it is save in google only works on google. --- ## Post 13 by @anon80779245 — 2024-12-06T15:19:21Z Nope Proton Pass works great. But I think it is only in web Browser --- ## Post 15 by @SaferPriv — 2024-12-06T16:50:31Z I think that such a motto as “Passkeys will replace passwords” is a hyperbole that is common in transitional periods when new standards are added. Passwords and passkeys are different authentication schemes, and each has its own strongness and weakness. Passwords are inherently problematic as knowledge authentication and passkeys are inherently problematic as possession authentication. They are not in conflict or one is absolutely superior to the other, and the choice should depend on the individual’s envisioned use case and threat model. Most people have no problem replacing passwords with passkeys. So the motto that passkeys make passwords obsolete is widely accepted. However, there are some people who still find themselves in situations where using a password gives them an advantage in terms of security and privacy. As long as they need them, passwords will remain. Perhaps passwords will not disappear in my lifetime --- ## Post 16 by @asanyan — 2024-12-06T17:02:19Z I hope not. It’s fine as optional 2FA, but passwords are fine. A passkey is yet another device that needs to be bought, has to be carried around and could be lost, stolen and can break. Maybe a middle ground could be reached where similar functionality (e.g. to prevent phishing) could be implemented by the OS or the browser itself? Browsers already have builtin password managers, I don’t see how/why this wouldn’t be possible if there is interest. --- ## Post 18 by @asanyan — 2024-12-06T17:37:01Z > [@Anon47486929](#): > > It exists and it is what is used with passkeys. The browser and apps sent their URLs and intents, and the credentials manager then validates them and authenticates the key. Sure, I meant something that is available for the end user… Unless there are software-only implementations available currently? If so, do you have a client that you recommend? > [@Anon47486929](#): > > For folks who already do, passkeys are easier to use than password Eh I don’t know about that. May be true for the most part, but it depends on one’s setup. --- ## Post 19 by @fria — 2024-12-06T19:01:31Z You can though. You can scan a QR code or sync them up with your password manager. If you were following decent password practices then you’d be using a password manager anyway and your password would be long and random so it would be even less convenient to log in a lot of times with traditional passwords than with passkeys. --- ## Post 20 by @hakavlad — 2024-12-07T00:44:14Z I hate devices that can scan QR codes, and I assume that they are infected by Pegasus-like by default. > If you were following decent password practices then you’d be using a password manager I would like to be able to use passphrases that I remember for some (less important) accounts, and nothing more, and easily log in anywhere. --- ## Post 21 by @eqrlzo8t — 2024-12-07T05:58:48Z I just tested with Bitwarden and Proton Pass passkey: I registered a test account with passkeys (there’s no passwords) on [https://www.passkeys.io/](https://www.passkeys.io/) successfully with Bitwarden and Proton Pass. Both now have the test accounts with passkeys on their vaults. On my android 14 device, I installed both apps and could sign in successfully with passkeys on both apps. At each test, each app is set as “preferred app” for autofill and passkey. However, on my old android 10 device, I selected the option “Use a different device” \> “Use a different phone or tablet” \> A QR code occurred \> I scanned QR code with my android 14 device \> It then just stucked at “connecting with your devices”, no progress being made and finally it stopped at the screen “devices couldn’t connect”. I tried many times, even paired both devices with bluetooth \> No success. I searched on internet about the issue, and I found kind of similar thread (they say `The android phone times out on "Connecting with your device" to say "Devices couldn't connect.`): > **[Using android phone as a passkey device for Chrome on Windows has stopped...](https://support.google.com/chrome/thread/253633475/using-android-phone-as-a-passkey-device-for-chrome-on-windows-has-stopped-working?hl=en)** No replies with any directions to solve the issue. * * * And this is just a test. I don’t know what to do if I fall into the same situation in a real world scenario. --- ## Post 23 by @eqrlzo8t — 2024-12-07T06:32:16Z > [@Anon47486929](#): > > Because you are trying passkeys via third party in unsupported android 10 (which is also 5 gens behind and should not be used anyway). > > See here: [Android | passkeys.dev](https://passkeys.dev/docs/reference/android/) > > Third party providers were supported in Android 14+. On pre 14 devices you need to use Google Password Manager. Please read again. I don’t set passkey on my android 10 device. I set my passkey on my android 14 device. I was trying to sign in to the website on my android 10 device via the option of “Use a different device” \> “Use a different phone or tablet” . That’s when I use my android 14 device, which sets Bitwarden/Proton Pass as 3rd-party provider for passkey to authenticate that signing-in. * * * And this is also just a test. Please, don’t jump in to the aspect of security support here. I’m just trying to do the sign in to a different device, it could be android 13 which still is in security support but no 3rd-party passkey support. --- ## Post 25 by @eqrlzo8t — 2024-12-07T11:48:24Z I see. The line in passkey link causes confusion for me: > using a passkey from the local Android device So the local Android device here is the current device creating the passkey, not another Android device hosting the passkey connected locally (bluetooth…) --- ## Post 26 by @anon32876053 — 2024-12-07T16:58:02Z When I see statements like “this is more secure, safer, etc.,” I start laughing because it is easy to crack anything man made, no matter if it is software or hardware. Passkey has yet to have a properer shake down, nor does it have history to silly statement that it is more secure. Time will tell. I stick with what is good and true practise, Passwords. And the various vendors competing for their products is another mess I’m not willing to play. --- ## Post 28 by @anon32876053 — 2024-12-07T17:21:48Z Wi-Fi security has gone through 3 different updates, simple because each method implemented were hacked and crack over time, have you forgotten so quickly, so the statement hold true, I am making a broad statement, not an absolute. Why do you think various vendors bring out updates? To give their products new tools, partly, but part of the update, is to fix bugs to stop hackers. Don’t be so quick, what is strong encryption today is weak encryption tomorrow, wise up. > **[Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords](https://arstechnica.com/information-technology/2019/04/serious-flaws-leave-wpa3-vulnerable-to-hacks-that-steal-wi-fi-passwords/)** > > Next-gen standard was supposed to make password cracking a thing of the past. It won’t. --- ## Post 29 by @anon42475305 — 2024-12-07T17:26:25Z Contrary to the beliefs of the former Australian Prime Minister, the laws of mathematics do in fact apply everywhere, even Australia. Implementations can be and sometimes are flawed but math is math and encryption, when implemented correctly, is theoretically unbreakable, contrary to any other form of lock. **[Source](https://www.independent.co.uk/news/malcolm-turnbull-prime-minister-laws-of-mathematics-do-not-apply-australia-encryption-l-a7842946.html)**. --- ## Post 31 by @moonwriting — 2024-12-07T17:29:00Z > [@anon32876053](#): > > Passkey has yet to have a properer shake down, nor does it have history Passkeys are based on the FIDO standard, which security keys have been using for years, so your statement isn’t accurate. > [@anon32876053](#): > > Wi-Fi security has gone through 3 different updates, simple because each method implemented were hacked and crack over time, have you forgotten so quickly, so the statement hold true, I am making a broad statement, not an absolute. Why do you think various vendors bring out updates? To give their products new tools, partly, but part of the update, is to fix bugs to stop hackers. Don’t be so quick, what is strong encryption today is weak encryption tomorrow, wise up. Your example about WiFi kind of works against your claim. Just as we knew with older WiFi standards that there were significant issues with them, we have known for a long time that there are significant issues with passwords, and so, passkeys were invented to address these issues. --- ## Post 32 by @anon32876053 — 2024-12-07T17:37:28Z Technology stand for no man, when it becomes more complex, it is more vulnerable to hackers, hackers have time, vendors don’t. Remember, most people are not interested in updating or going out to buying the latest, greatest products. --- ## Post 33 by @fria — 2024-12-07T20:34:12Z Well if we’re talking about complex, look at how many different technologies you need to make passwords secure. First, the user needs to come up with a secure password which humans are terrible at, so we install a password manager to do it for us. Then, the password needs to be transmitted to the server so we need encryption in between you and the server. Then, the service needs to securely store the password hashed and salted properly. You also need to worry about phishing, so we need some kind of 2FA, a lot of the time SMS or TOTP which can still be phished. You’ll also notice that typically services will force you to give an email or phone number to use as a form of 2FA which isn’t great for privacy. Then you have to worry about the possibility that someone sees you type your password in or a camera records it, so again need to rely on the 2FA. All of this gets taken out of the picture with passkeys, if implemented properly.