[Omniscient]

Should I add them to HF?

Do you use them on websites regularly?

Give me your feedback on this. I'm contemplating it. Probably fairly easy to vibe code the feature into HF.

[m0hx]

I recently just started setting them up on some of my accounts, and ngl they make life easier (not having to open authenticator and waiting for code etc), but I have love-hate thing for passkeys and I don't know why. Sometimes I just don't want them, sometimes I prefer them.

tbh I don't know much about passkeys and how they work, or how secure are they compared to OTP/2FA codes, but I'd say yea add them to HF cuz most modern sites have them.

[Charlie Sheen]

I use them anywhere that I can. It's nice being able to quickly login as I use a different password for each site.

[Jamika]

I've never used it, and I never will. I think some members here might prefer it and use it, but it's not for me.

[Charlie Sheen]

I've never used it, and I never will. I think some members here might prefer it and use it, but it's not for me.

Just curious your reasoning behind that? They are great to combat phishing. They protect against data breaches. Much more convenient. Most sites are adopting and getting rid of passwords.

[jcole]

I would use it if implemented.

[SoulZeh]

I also use where I can and when, I find it 100% easier and just less hassle.

I'd 100% use it .

[Omniscient]

Why Passkeys Are Better Security

Passkeys offer stronger account protection than using a password alone and are often easier to use than traditional two-factor authentication.

Password Only

A password can be guessed, reused, leaked in a data breach, or stolen through phishing. Even a strong password is still something you must type and something an attacker may be able to capture.

Password + 2FA

Two-factor authentication adds an important extra layer of protection. An attacker usually needs both your password and your temporary 2FA code.

However, some forms of 2FA can still be targeted through phishing, SIM swapping, malware, or convincing a user to enter a code on a fake website.

Passkeys

Passkeys use cryptographic authentication stored on your device or password manager. There is no password to type, remember, or accidentally give to a phishing website.

• Resistant to phishing
  
• Cannot be guessed or reused
  
• No temporary codes to enter
  
• Can use your fingerprint, face, device PIN, or security key
  

Security Comparison

Password only: Basic protection

Password with 2FA: Strong protection

Passkey: Strong and phishing-resistant protection

Passkeys are not magic, and you should still secure your devices and recovery methods. However, for most members, a passkey provides better protection than a password alone and a smoother login experience than entering a password and 2FA code every time.

[Raijin]

No I don't use passkeys. I don't like any kind of stored credentials.

[Omniscient]

No I don't use passkeys. I don't like any kind of stored credentials.

All credentials are stored somewhere. Just reality. Hardware passkeys probably the most secure you can get nowadays. But imho overly inconvenient to use them constantly for mundane online activity.

I'm still iffy on passkeys myself but I do recognize their convenience and all my research seems to conclude they are more secure than 2FA.

AI Quote: Generally, yes—passkeys are more secure than a password combined with ordinary 2FA, especially when that 2FA uses SMS, email codes, authenticator-app codes, or push notifications.

The main advantage is phishing resistance. A passkey is cryptographically tied to the legitimate website, so it cannot be entered into a convincing fake HF login page. Passwords and most 2FA codes can still be stolen or relayed through phishing. CISA identifies FIDO/WebAuthn—the technology behind passkeys—as the widely available phishing-resistant authentication method. ([CISA][1])

A useful ranking would be:

1. Password only — weakest
2. Password + SMS/email 2FA — significantly better
3. Password + authenticator-app 2FA — strong, but still phishable
4. Passkey — strong and phishing-resistant
5. Hardware-bound passkey/security key with secure recovery — strongest practical option

The important caveat is recovery. A secure passkey login can be undermined if HF lets someone bypass it through a weak email-reset or account-recovery process. Also, synchronized passkeys depend partly on the security of the user’s Apple, Google, Microsoft, or password-manager account.

So I would revise the post’s comparison to say:

> Passkeys generally provide stronger protection than passwords with traditional 2FA, particularly against phishing, credential theft, and reused passwords.

FIDO specifically states that passkeys can replace older password-plus-OTP flows while providing phishing- and replay-resistant authentication. ([fidoalliance.org][2])

[1]: https://www.cisa.gov/more-password?utm_s...hatgpt.com "More than a Password | CISA"
[2]: https://fidoalliance.org/passkeys-2/?utm...hatgpt.com "Passkeys | FIDO Alliance"

[Tha Sneak]

Passkeys are a minimum requirement for most highly sensitive areas such as government, military, law enforcement, company computers, and such it would make since to utilize it where available especially in this day and age where AI is bringing a host of side effects to include helping to aid those that are well versed to target websites and leak large data tables of credentials, exploits like never before seen, and malware that is more complex than ever.

I would gladly use it and it is better to have and not need that need and not have.

[Omniscient]

Passkeys are a minimum requirement for most highly sensitive areas such as government, military, law enforcement, company computers, and such it would make since to utilize it where available especially in this day and age where AI is bringing a host of side effects to include helping to aid those that are well versed to target websites and leak large data tables of credentials, exploits like never before seen, and malware that is more complex than ever.

I would gladly use it and it is better to have and not need that need and not have.

But HF is nowhere near that sensitivity level for security. And we honestly rarely have stolen accounts now that there is 2FA across the internet.

If anything, I am hoping it adds a level of convenience. Lost 2FA's because of device changes is the biggest obstacle currently.

[Scrub]

I wouldn’t mind either way, anytime I visit I’m already pre logged in, I had enough issues with Authy when I had got a new phone on my old account lmao

[Omniscient]

I wouldn’t mind either way, anytime I visit I’m already pre logged in, I had enough issues with Authy when I had got a new phone on my old account lmao

I like 2FAS, Authy imho is garbage now.

[Scrub]

I like 2FAS, Authy imho is garbage now.

I don’t have much feedback other then if it is implements I’d use it likely.