Why passkeys are a step back for personal security: examining account lockout risks, platform lock-in, hardware key limits, and fragile recovery flows.
It technically is, it’s not about the amount of actions you need to do, it’s about the amount of actions the platform you are logging in needs to do with you. That both interactions interface with a bitwarden local device makes the weak link your local device, which already was anyway.
I wouldn’t classify passkeys as MFA tho, they are a passwordless method that’s more secure than most MFA methods. Afaik it’s based on signed certificates or something like that and that’s virtually unhackable unless someone gets physical access to your device (and that’s game over anyway).
If you’re using software that properly uses your device’s SE / TPM chip then it’s much more secure against malware, etc. And the main selling point is the much stronger phishing resistance (can’t trick you into logging in via a fake site, etc)
It technically is, it’s not about the amount of actions you need to do, it’s about the amount of actions the platform you are logging in needs to do with you. That both interactions interface with a bitwarden local device makes the weak link your local device, which already was anyway.
Github only asks me for (bitwarden’s) passkey. That’s just a single factor.
I wouldn’t classify passkeys as MFA tho, they are a passwordless method that’s more secure than most MFA methods. Afaik it’s based on signed certificates or something like that and that’s virtually unhackable unless someone gets physical access to your device (and that’s game over anyway).
But bitwarden uploads it to the cloud to be used on any computer, AFAIK.
A securely stored modern certificate is going to be magnitudes more secure than password plus MFA.
The certificate path uses cryptography to prevent disclosure of your secret, and can’t be compromised when the site inevitably gets hacked.
If you’re using software that properly uses your device’s SE / TPM chip then it’s much more secure against malware, etc. And the main selling point is the much stronger phishing resistance (can’t trick you into logging in via a fake site, etc)