How does that make an account with BOTH secure?A password is hackable.
A passkey is not hackable.
My Computer
System One
-
- OS
- Windows 11
- Computer type
- Laptop
Follow along with the video below to see how to install our site as a web app on your home screen.
Note: This feature may not be available in some browsers.
How does that make an account with BOTH secure?A password is hackable.
A passkey is not hackable.
One must realize that there is no such thing as absolutely, totally, 100% secure. There is only the most secure we can make things. Passkeys are more secure than passwords. And that is a fact.How does that make an account with BOTH secure?
You have every right to believe what you like.I will always choose security over convenience, ALWAYS and a passkey is not it.![]()
I agree, absolutely. However, which is more easily hacked, a password or a passkey? From my research, a passkey is more secure. Until that changes, it costs me nothing to add passkeys to all my sites that have them. As always, Your Mileage May Vary!I would prefer to use 2FA every single time, sadly passkey mitigates that and it enforces the "secure" session, which can be stolen.
![]()
Yes, Your Passkeys Can Be Hacked—New Attack ‘Breaks The Myth’
“Millions vulnerable to identity attacks” — act now.www.forbes.com
Agreed. But how secure is an account that has both a passkey AND a password?Passkeys are more secure than passwords. And that is a fact.
You can only use one of them at a time. Use whichever one you like.Agreed. But how secure is an account that has both a passkey AND a password?
So how does adding a passkey to an account make it more secure if a password is left as an alternative?You can only use one of them at a time. Use whichever one you like.![]()
You're asking how the account itself is more secure? Obviously, it isn't if the site itself is hacked.So how does adding a passkey to an account make it more secure if a password is left as an alternative?
(I'm not really expecting you to answer this question, as you haven't answered my last two!)
Yes.You're asking how the account itself is more secure?
A server only stores the public key of a passkey, which is useless to attackers.Obviously, it isn't if the site itself is hacked.
The main advantages are that a passkey cannot be used on a phishing site or from foreign devices.The security in using a passkey is that there is no password being passed and there is nothing for a hacker to hack during the login process.
That adding a passkey to an account is pointless* unless the password is removed.I can only tell you what I know from my own research. What does your research tell you?
Passkeys were designed to be safer, and happen also to be simpler by including two factors in one step.Passkey is meant to be simpler, not safer. It is a password without 2FA.
Which part(s) of my "belief" do you disagree with?OK. I've done my research. Believe what you like.
As soon as I typed that, I deleted it, but apparently not fast enough!Which part(s) of my "belief" do you disagree with?
I could not have said it better, it turned 2FA into 1FA, thus less safe.Passkeys were designed to be safer, and happen also to be simpler by including two factors in one step.
Passkeys always have two factors.I could not have said it better, it turned 2FA into 1FA, thus less safe.![]()
A hacked or stolen device is protected by the passkey second factor.Apparently, an already verified device is safe 4ever, it can not be hacked nor stolen.
Only during the initial setup, then they are safe forever, to the end of days.Passkeys always have two factors.
You type 4 digit PIN on Windows and you have access to all passkeys without any verification.A hacked or stolen device is protected by the passkey second factor.
You don't have to be relegated to a 4-digit PIN if you don't want. I changed my PIN to be alphanumeric. Then I changed my PIN to be a 23-character alphanumeric passphrase.Only during the initial setup, then they are safe forever, to the end of days.
You type 4 digit PIN on Windows and you have access to all passkeys without any verification.
I hate that, but it can not be disabled, it is by design. Retyping the same PIN is supposedly 2FA.
Not true. Every use of a passkey involves two factors.Only during the initial setup, then they are safe forever, to the end of days.![]()
The PIN can be up to 127 characters if you wish, and could include any alphanumeric characters:You type 4 digit PIN on Windows and you have access to all passkeys without any verification.
I hate that, but it can not be disabled, it is by design. Retyping the same PIN is supposedly 2FA.