This argues that while passkeys are technically strong - phish-resistant and asymmetric so servers can't leak usable credentials - they are a poor fit for most personal users today because they raise practical risks that matter more day-to-day: permanent lockout, automated account bans, and device loss. Recovery paths like SMS, email links, and security questions remain the weakest link, and without reliable recovery users can lose access entirely. Hardware security keys can’t be backed up or moved, forcing people to buy and enroll multiple keys and hit storage limits (often 25-100 accounts per key, up to ~300 on premium devices). Platform-synced passkeys from Apple or Google centralize identity and risk losing all passkeys if that account is suspended, and FIDO export/interoperability is still immature compared with the simplicity of exporting a password string.
Third-party password managers that try to store passkeys fight fragmented OS APIs and lack the polished autofill UX passwords enjoy, especially for native apps. Passkeys also break down on unfamiliar or colleague devices where ports, Bluetooth, or hybrid QR flows are inconvenient or unreliable. The conclusion: passkeys make sense for enterprise deployments but today pose more practical harm than benefit for many individuals; a combination of randomly generated passwords in a password manager plus an independent TOTP app gives better day-to-day resilience, while passkeys mainly help those who previously reused passwords.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
The SR-71 Blackbird's ancient navigation technology, known as 'R2-D2,' could become crucial for military operations in GPS-denied environments. This method, used historically, is being revisited to enhance future combat capabilities. (twz.com)
Korea's privacy regulator has increased fines for data breaches to up to 10 percent of a company's annual revenue. This change aims to encourage companies to prioritize data protection and prevent leaks. (koreajoongangdaily.com)
More U.S. military deaths during the Iran conflict have not been fully disclosed by the Pentagon. The actual number of casualties is higher than publicly reported. (washingtonpost.com)
Hackers exploited Anthropic's AI model, Claude, to gain unauthorized access to OpenAI's systems. The breach highlights risks in using AI models for security-sensitive operations. (wsj.com)
Linguistic illegibility refers to situations where an LLM's internal computations are not accurately reflected in its language output or probes. Security measures relying on linguistic self-reporting are therefore insufficient, and alternative techniques like taint tracking and sandboxing are necessary to ensure safety. (arxiv.org)
Classified stealth parts of F-35 fighter jets were diverted to Hong Kong by a shipper and have gone missing. The incident raises concerns about security and potential unauthorized access to sensitive military technology. (politico.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.