Ben Vidulich

People with the ability to use passkeys _should_ use them. Apparently a micro-phishing kit for a fake MyGov site costs $30 on the dark web and passkeys are completely effective against these.
The point is we shouldn’t leave behind folks that can’t use passkeys or other smartphone-demanding tech. MyGov allows users to ignore the ‘security review’ recommendations to accomodate diverse needs.

2025-07-01 22:06:45 UTC

- reply

exactly right. After the Australian MyGov team rolled out passkeys they discovered that many folks living in remote parts of Australia don’t have phone coverage and access internet via shared computers at community centres. They weighed giving every Australian a YubiKey as it would be cheaper than sending 2FA codes via SMS. Ultimately, they left passwords as an option.