> The defining feature of passkeys is that they're stored in your password manager, and you can't read them, so you can't be tricked into typing them into the wrong web site.
That's the biggest issue.
Haven't been tricked so far. On the other hand, I've had a couple of accounts locked because "we don't like your ip", "we want your phone number now", or "we want to send a push notification/text to the phone that just died".
Why would I trade control over my credentials for some potential security gains, while introducing new dependencies on Google, Apple, or whoever runs my password manager - and the very real risk of being locked out of all of my own accounts?
You don’t have to use a password manager that relies on an account. Personally I use Strongbox on iOS and macOS, which stores everything (including passkeys) in a .kdbx file. I then sync the .kdbx file over iCloud, but if I lost access to iCloud then there would still be copies of the file on all my devices. Overall this is not as secure as the more centralized alternatives, but it does leave me in control.
Passkeys in their current state essentially are just SSH keys with added website verification.
A lot of the "slippery slope" confusion in the past couple of articles has been that this "cheap SSH key" approach was built on top of the same standard for "expensive hardware key" (Webauthn). This is great because it means a rich backwards compatibility story across a long history of devices and "expensive hardware key" remains an option for Passkeys. This is unfortunately confusing because Enterprises still need Webauthn for "only expensive hardware key" usage so need options in the standard like "Attestation" which specifies things like "exactly which expensive hardware key vendor was used".
People see this confusion and think it leads to a slippery slope of attestation being required "in the future", but the reality is more that attestation and things like it were required in the past and are optional now because we realize "cheap SSH keys" are good enough for most users (with some standardization and shared "branding").
In best practices for SSH keys you should be using different keys on every device and shouldn't be extracting/copying them. Best practices are also to use different keys for every SSH host in addition to per-device keys.
Passkeys enforcing keys not be extracted/copyed as plaintext and that keys are per-host/domain are just following ancient SSH best practices.
Because yes the SSH world is sloppy with dangerous plaintext (or modest password encrypted) key copying and reuse. That does make it a "simpler" ecosystem, but that doesn't make it a better ecosystem.
That said, Passkeys generally are frequently copied, most of the ecosystems support multi-device sync and backup. They just aren't done in a way that provide plaintext export if you want to print a book of your Passkeys and store it in a safe deposit box or sloppily `scp` them from one machine to another.
I think KeypassXC already provides plain text export and Bitwarden provides some export as well. I guess eventually either passkey ecosystem will become locked to a few specific vendors that won't implement functionality FIDO does not like or passkeys will be extractable. In first case it'll become vendor locked corporate standard, in second - same as passwords with url verification.
Or it can stay a niche standard most people don't care much about, we'll see.
I think it's only technical users and paranoid users that care about export. Non-technical users are fine with device auto-sync and Cloud backup/restore, which is what they get today out of the box from the most common Password Managers.
We are in the era where the average non-technical user doesn't even necessarily know what a file even is, they are used to apps managing everything with Cloud sync and "just working".
Export can be handy for "offline" backup, but in practice the thing to backup offline is the device PIN or Password Manager "master password". Especially because in practice you aren't using just one Passkey, you are using hundreds or thousands. (One per host/domain/app, at least.)
> implement functionality FIDO does not like
The KeypassXC GitHub issue wasn't "FIDO", it was one guy acting like he could make threats on behalf of FIDO, without even the full backing of his employer, much less other members of FIDO. It was bad communication to write a suggestion in the form of a threat and pretending to speak for others.
For many companies the whole reason for this is to pay lower salary and prevailing wage in NYC and SF is higher. I knew a guy who got a small raise before his PERM was filled simply because his salary at the time was lower than salary in PERM. It was 10 years ago and in Florida, I imagine difference now and in HCOL locations is even bigger.
In 3rd world countries having children is also a retirement plan because government does not guarantee much for elderly. Not sure if developed countries want to go there though.
Newegg marketplace is a funny place. Not only many items are more expensive than elsewhere, I had my orders delivered literally in Amazon or Walmart packaging. There are genuine merchants that made a choice to work with Newegg but there are many resellers from other stores as well.
Some people have their dryer far away from where they usually are and cannot hear it, like me. Although I do put a timer for N hours to remind myself rather than having a "smart" dryer.
I do like "smart" lights that are based on presence, and various sensors and "smart" automatic irrigation, but don't see much point in home appliances being connected to my phone/network.
I think we tend to forget that many things can be implemented without "smart" features / wifi access / apps. Ie my 20 year old oven has a "start time" feature. It just uses the built in clock.
I don't think I know of any (big) appliance, e.g. dish washer, drier, washing machine with that option but to be honest I didn't dig deep, is it possible?
That tap in and out system causes unexpected issues sometimes. Many subway stations in Tokyo have different extrances for different directions that are not connected underground. Once I entered such station for a train that went in a wrong way and when I tried to exit gates didn't let me. It was unmanned station so it took me a while to find an intercom and explain my issue to a person so they can unblock me.
In Vienna they don't have gates at all or even much indication where gates supposed to be. My first visit I accidentally didn't pay for my ticket - I'm used to ticket machines being near the gates but I couldn't spot any. I also arrived on a train so I thought that since there was no gates or visible ticket machines between train and subway, maybe my train ticket is valid for a subway trip (happens in some places) but it was not the case.
But isn't that how market supposed to work? Company offers to pay x for the job, can't find anyone for x, so it raises salary to x+y.
I would understand logic of bringing people from other countries when there is a shortage of workers but with current market it doesn't seem to be the case.
Of course not, but you seem to miss the point: no company is going to pay $500,000/year for a part-time office assistant, $200,000/year for a bus boy, $2 million/year for a construction worker, $100,000/year for a farm laborer.
There is no developed country on earth where labor shortages are addressed by "just increase the salary until you find a native-born person to take the job."
This is a misnomer is _my_ point. A labor shortage has a trivial solution, "pay more". It's intentionally framed as "labor shortage" by capital who would prefer the labor pool be near-infinite so they can pick the best for the cheapest. No, no company is going to like it. And that's okay, immigration, and government policies more broadly, should not be about "what would maximize private capital profits?" They should serve the broader American public.
If companies can't find a farm laborer at 100k/yr then that sounds like it's an *incredible* situation for the average worker.
> A labor shortage has a trivial solution, "pay more".
Whenever you think a solution to a problem that plagues an entire nation (especially one the size of the US) is "trivial", you should ask the question: if it's so trivial, why hasn't it been fixed after so many years? And if your answer depends on some sort of conspiracy, you know you're wrong.
There are so many problems with "pay more". Let's start with a simple one: it's based on the assumption that the employer's only alternative to paying more is going without the output. In a lot of labor markets, this just isn't the case.
Jobs get mechanized/automated. They get outsourced to a different country. The employer reduces output (reduces staff) and in many cases at the same time increases prices. Sometimes, as has been seen with restaurants and retail, hours get cut or they go out of business.
Another problem with your "solution" is that in many markets, especially those related to healthcare, it's not just pay that limits hiring. It's things like caps on residency slots due to Medicare funding, a lack of clinical placements, a lack of faculty, etc. You can't pay more to hire workers that don't exist because the market structure doesn't allow for those workers to exist in the needed numbers.
> If companies can't find a farm laborer at 100k/yr then that sounds like it's an incredible situation for the average worker.
Except this experiment has been tried. Look up the Bracero program, which was terminated in the 1960s to increase wages for domestic farmworkers. I'll give you a hint: a study comparing states heavily exposed to bracero labor against states that used little found basically no wage or employment gain for domestic farmworkers.
The farm doesn't survive with a bunch of recent university grads who studied CompSci picking fruit at $100,000/year. The farm mechanizes, where possible, and switches to crops that require less labor. And the market fills the demand for the crops that were switched out with imports.
And let's also be honest: the average 20-something native-born American doesn't want to pick fruit in 100+ degree heat in dusty small farming towns where there's nothing to do, the male-to-female ratios are out of whack, etc. This too has been tried: UFW ran a "Take Our Jobs" campaign about a decade ago and...wait for it...literally nobody wanted to.
Migrants don't really depress wages, except by a very marginal amount at the lowest skilled rung.
That's because adding people to the economy creates more demand
In times of recession, things might be different - but immigration tends to take care of itself in that regard. When a country has unfilled labor demand, immigration goes up. When it has no labor demand, immigration goes down.
The cost of accepting cash is not necessarily lower - you have take into account higher theft risk, miscounts and cost of delivering it to the bank. Also there is no incentive for businesses to pass saved fees to customers.
That's the biggest issue.
Haven't been tricked so far. On the other hand, I've had a couple of accounts locked because "we don't like your ip", "we want your phone number now", or "we want to send a push notification/text to the phone that just died".
Why would I trade control over my credentials for some potential security gains, while introducing new dependencies on Google, Apple, or whoever runs my password manager - and the very real risk of being locked out of all of my own accounts?