Why? Security isn't an opinion, it's a science and art. It doesn't care about what you think of it.

Perfect security leaves no room for user friendliness. The most secure system allows no users to use it. Only by reducing security do you gain user friendliness. The most user friendly (as in, triviality of use) system requires no security.

The art comes in when trying to create more usability whilst giving up less security, of course.

Passkeys are more secure than passwords. Thus, it's only natural they are less user friendly. If you don't "like" that, then stick to passwords. There's nothing to condemn, however.

Availability is a major part of security (confidentiality-integrity-availability etc), so a process that has significant risks to availability can not be considered secure.

I like the part about passkeys where they avoid having a shared secret. Not so much the platform lock in and creeping remote attestation. Oh, don't worry, it's just in the spec, we're not going to do anything with it... yet. Seems like they're gunning for a world where if you're not using a blessed Microsoft/Google/Apple device you're locked out of it.

> Security isn't an opinion, it's a science and art.

The art side is where opinion lies.

> If you don't "like" that, then stick to passwords.

But the passkey crowd is overtly aiming at eliminating passwords.

And I wish them luck. At least in my country (the same one I assume many of you also live in) our financial institutions haven't even implemented non-SMS MFA options yet. Literally the systems with the most impact on our daily lives (because they hold our money) haven't even stepped up to the security available in 2016 yet.

If a "reset passkey by email" option exists, they don't seem much more secure than a unique complex password + (non-SMS) 2FA.

So for most people on HN (who also probably won't be successfully phished) they offer only new problems, yet if implemented and used widely they're probably a net positive.

It's a bit like the Covid rules. I am more than capable of avoiding other humans without new laws, but "normal" people seemed to need a lot of coercion.

Personally I'll give it a few years and see how passkeys pan out before I switch (if I get the choice).

God help us if people here think "Security is art".

We are screwed.