That’s what passkeys do, but the experience of using them kinda sucks overall.
If you’re using security keys, you need 2 of them at a minimum to avoid being locked out of accounts. If you use e.g. an iPhone as the key, then you can sync them between your other Apple devices, but not export them to a Google device, you need to create a new passkey on the Google side for each site if you ever switch brands.
Third-party password managers handle passkeys well and sync across all devices. Though they are technically less secure than a hardware-based implementation with a secure enclave, practically it doesn’t matter and the spec actually recommends syncable passkeys in most cases. The passkey protocol differentiates between portable and device-bound passkeys, with decice-bound only recommended for the highest level of security and not for personal use.
On mobile, password managers like Bitwarden to Keepass2Android are able to act as your OS-level passkey provider. On desktop, most password managers rely on browser extensions, but Keepass can plug into the OS-provider with the right plugin.
The problem with passkeys rn is that every services uses the in addition to passwords, but they’re supposed to be a complete replacement for them. Adding a second, albeit more secure, login method doesn’t improve security. It slightly reduces it by increasing the attack surface. I’d love to see more places allowing you to use a passkey in lieu of a password.
That, and to your point, the user experience is heavily reliant on the password manager, which 99% of people don’t put any thought into and vendors have put in no effort to make things easy to use or understand.
What i want:
Click login button
Cryptographic exchange happens
Done
That’s what passkeys do, but the experience of using them kinda sucks overall.
If you’re using security keys, you need 2 of them at a minimum to avoid being locked out of accounts. If you use e.g. an iPhone as the key, then you can sync them between your other Apple devices, but not export them to a Google device, you need to create a new passkey on the Google side for each site if you ever switch brands.
Third-party password managers handle passkeys well and sync across all devices. Though they are technically less secure than a hardware-based implementation with a secure enclave, practically it doesn’t matter and the spec actually recommends syncable passkeys in most cases. The passkey protocol differentiates between portable and device-bound passkeys, with decice-bound only recommended for the highest level of security and not for personal use.
On mobile, password managers like Bitwarden to Keepass2Android are able to act as your OS-level passkey provider. On desktop, most password managers rely on browser extensions, but Keepass can plug into the OS-provider with the right plugin.
The problem with passkeys rn is that every services uses the in addition to passwords, but they’re supposed to be a complete replacement for them. Adding a second, albeit more secure, login method doesn’t improve security. It slightly reduces it by increasing the attack surface. I’d love to see more places allowing you to use a passkey in lieu of a password.
That, and to your point, the user experience is heavily reliant on the password manager, which 99% of people don’t put any thought into and vendors have put in no effort to make things easy to use or understand.
I’d rather my browser not automatically tell sites things about me
If you have javascript enabled, it’s already telling a badrillion things automatically, uniquely fingerprinting you across all webpages.
Uh-huh