Passkeys are fast becoming a popular way of signing into most websites. Many popular sites, including Microsoft and Facebook, have adopted them to some extent. There is one problem, though, which is that most people store them in their password manager. They were originally meant to be stored on your phone, but this meant they were not portable. This is why services like BitWarden added the capability to store them.
The central problem with doing this is that most people use their password manager as a browser extension, at least in my experience. This is problematic because if your browser is hacked and you’re logged into your password manager, a bad actor can steal your passkey. At this point, I would argue that having a passkey is less secure than having a password with 2FA. I realise, as I say this, that I know many people who store their 2FA codes in their password manager. I even store some, if not all, of my 2FA codes in Bitwarden, but it seems that if you’re relying solely on a passkey stored in a password manager accessed via your browser to keep you safe, that is basically the same as not having 2FA if you get hacked.
One issue I had earlier today was that I couldn’t log in to my Microsoft 365 subscription. Because I don’t have the Bitwarden app installed and just use it in the browser, I couldn’t access my passkey when activating Microsoft Office. I therefore had to copy the password from Bitwarden and then get my 2FA code from my phone. If passkeys are the future they are trying to push us towards, I’m unsure whether I want them. Having thought about it, I can’t help but conclude that, even if you store your 2FA codes in the same place as your password, you are still better off than storing a passkey in your password manager, since at least 2FA codes only last 30 seconds. I know this probably wouldn’t be an issue if you keep your passkey on your phone, but from what I’ve heard, many don’t. Given the rate of software vulnerabilities we’ve seen lately, I wouldn’t trust a password manager entirely, even if it was outside the browser.