7 ms·
The website for my HSA required me to set up a passkey last time I logged in. I set it up on my work laptop and my work password manager, which means I can now
by ranger207 2mo ago
The website for my HSA required me to set up a passkey last time I logged in. I set it up on my work laptop and my work password manager, which means I can now no longer access my account from my personal computer. This is fantastic, just what I wanted
- cpburns2009 2mo agoThis is exactly a scenario that worries me. Proponents of passkeys imply you can setup a bunch of passkeys. Evidently that's not always the case.
- AlexandrB 2mo ago"But that's just a bad implementation, many other sites do it right!" And many sites block paste from password managers. Passkeys have so many ways to do them wrong that we're going to see all kinds of new and exciting failure modes that lock you out of your account in the future.
- rdsubhas 2mo agoI think the irony here is missed.
- nitwit005 2mo agoAnd then you call them up, and they allow you in after asking some identity questions, and you learn there's no real security.
- sphars 2mo agoAre you also using HealthEquity for your HSA? I'm the same boat, they're forcing passkeys on me. I can still login using my employer's SSO but I've been putting off setting up the passkey until I have to.
- jeroenhd 2mo agoClick the "lost password" button. Passkeys aren't magic, they're just a funky password. If the website didn't implement a "lost password" button then that says a lot more about the website than it says about passkeys.