Introducing passkey support to Fastmail
Fastmail’s introduction of passkey-based login prompts debate over whether cryptographic authentication is meaningfully better than strong passwords managed by password managers. Proponents highlight resistance to phishing, database leaks, and replay attacks, and note usability gains for non‑technical users, while critics raise concerns about device dependence, vendor lock‑in to ecosystems like Apple and Google, and awkward edge cases such as logging in from untrusted or shared machines. The exchange also touches on UX trade-offs in new login flows and broader worries about growing reliance on tightly integrated tech stacks for everyday access.
Perceived Benefits of Passkeys
- Advocates highlight: no shared secret sent over the network, replay resistance, strong protection against database leaks and phishing.
- Passkeys are compared to SSH keys or FIDO security keys: origin‑bound, non‑forwardable, and can’t be copied or pasted into chats or phishing forms.
- Seen as especially beneficial for non‑technical users who don’t use password managers or reuse weak passwords.
- Some view them as a “protocol upgrade” for password managers, simplifying security while keeping similar workflows.
Skepticism vs Password Managers
- Several argue good password managers already provide strong, unique passwords and phishing resistance via domain‑matching and autofill.
- Critics say the only significant incremental benefit is replay resistance, and that advantages are being oversold.
- Concerns that people bypass autofill and copy‑paste into phishing sites, undermining theoretical protections.
Usability, UX, and Edge Cases
- Confusion reported among less‑technical users when prompted to “migrate to passkeys.”
- Edge cases raised: logging in on shared/hotel/work computers, device loss while traveling, broken phones, and reliance on backup hardware or recovery schemes.
- Some frame “you can’t log in from an untrusted machine” as a feature; others see it as dangerously inflexible for critical access.
Vendor Lock‑in and Sociological Concerns
- Strong worry that passkeys deepen dependence on big tech ecosystems and cloud keychains (Apple, Google, etc.).
- Fear that once passwords are phased out, users will effectively be forced into particular vendors.
- Counter‑argument: passkeys can also live in third‑party or self‑hosted password managers and hardware keys, potentially reducing dependence on phones and SIM‑based OTP.
Implementation Details and Ecosystem Support
- Questions about Chrome/Windows cloud sync; one reply suggests storage in TPM but details remain unclear.
- CTAP2/WebAuthn flows (QR codes, phone as security key) are cited as a way to use passkeys on other devices without revealing credentials.
- Some complain that discoverable passkeys make older hardware keys with small slot limits less useful.
Fastmail-Specific Feedback
- Login UI with initial “username only” field is divisive: some dislike extra steps; Fastmail staff justify it for passkey/SSO flows and non‑resident keys.
- Billing complaints about inability to prepay long in advance; Fastmail explains constraints of new billing provider and describes grace periods.
- Security critique around DMARC and STARTTLS; Fastmail management disputes the characterization and outlines current practices and rationale.