We have been rolling passkeys out at work and have been having to explain to our users the difference between “Device-Bound” and “Synced” passkeys.
Synced passkeys are by nature more vulnerable because they touch the internet. They can be stored in regular password vaults and so on, tosses onto google drive, etc. and then get those compromised, and because passkeys come with an extremely high level of trust, that is a fully busted account at that point. As such, we can’t justify allowing synced passkeys on corporate, especially for admin level accounts.
With that being said, for non-work accounts in your day to day life, synced passkeys are going to be the way to go for privacy and data sovereignty, but it moves the onus of protecting that data onto you the user. I am able to handle that, as are many reading this, but a lot of folks do not have the technical prowess to defend themselves. When I am off the clock, I will champion privacy-focused solutions day in and day out. Work can do work things on work’s dime and work’s time, but they will not touch my personal space - I will not abide it.
Yubikeys are the best of both worlds if you can get them — work paid for mine, but they’re my keys, not theirs, so I can use them for personal accounts as well as work accounts, and not have to worry about them being bound to a work device or insecure from being synced keys in a password vault.
We have been rolling passkeys out at work and have been having to explain to our users the difference between “Device-Bound” and “Synced” passkeys.
Synced passkeys are by nature more vulnerable because they touch the internet. They can be stored in regular password vaults and so on, tosses onto google drive, etc. and then get those compromised, and because passkeys come with an extremely high level of trust, that is a fully busted account at that point. As such, we can’t justify allowing synced passkeys on corporate, especially for admin level accounts.
With that being said, for non-work accounts in your day to day life, synced passkeys are going to be the way to go for privacy and data sovereignty, but it moves the onus of protecting that data onto you the user. I am able to handle that, as are many reading this, but a lot of folks do not have the technical prowess to defend themselves. When I am off the clock, I will champion privacy-focused solutions day in and day out. Work can do work things on work’s dime and work’s time, but they will not touch my personal space - I will not abide it.
Yubikeys are the best of both worlds if you can get them — work paid for mine, but they’re my keys, not theirs, so I can use them for personal accounts as well as work accounts, and not have to worry about them being bound to a work device or insecure from being synced keys in a password vault.