I hope not. I'm patiently waiting on 1Password to release their implementation of passkeys so I can have it work on all my devices, Apple or not.

Yep, same with BitWarden. That would be fantastic.

Just use Passkeys. Any account that allows 2FA allows multiple second factors. You should be setting up backup second factors anyway if you don't want to risk getting permanently locked out of all of your accounts.

Plus, putting second factors in the same location as your first factor (e.g., 1Password) seems to pretty much defeat the entire purpose of having a second factor. If you're using strong passwords with 1Password, your second factor is basically only defending against a leak of your password database. If you're storing your second factor in that same password database, what are you gaining?

Well, with the exception of AWS, unless something has changed recently — they notoriously only support one second factor (i.e. if you use YubiKeys or similar, you can only use one).

Yeah, AWS is the only exception I've encountered :)

But if you have backup second factors (you have backup second factors, right?) and you're worried about Passkey lock-in for whatever reason… just use that other second factor for AWS or any other account which supports only one.

You can add multiple MFA devices since November of last year:

> Now, you can add multiple MFA devices to AWS account root users and AWS Identity and Access Management (IAM) users in your AWS accounts. This helps you to raise the security bar in your accounts and limit access management to highly privileged principals, such as root users. Previously, you could only have one MFA device associated with root users or IAM users, but now you can associate up to eight MFA devices of the currently supported types with root users and IAM users.

— https://aws.amazon.com/blogs/security/you-can-now-assign-mul...

Isn’t the whole point of Passkeys that you can’t ever lose them, since they’re tied to your biometrics..

They're not tied to your biometrics. They're stored inside the TPM of your device, which is unlocked by some form of biometrics.

But if you lose all the devices with your passkeys on them, they are gone for good.

> Plus, putting second factors in the same location as your first factor (e.g., 1Password) seems to pretty much defeat the entire purpose of having a second factor.

Not quite! 1password itself counts as two factors: something you know (the master password), and something you have (the additional secret key).

Passkeys in 1password would eliminate phishing as a problem.

I’m super curious what a backup second factor is for the average user who has only one device: a phone, that sometimes gets lost or is stolen.

Feels like these things are designed by Californians with no idea of how the world is.

If you're in this category, your alternative to Passkeys at all is SMS or no 2FA whatsoever. Enabling Passkeys does at least ensure that you have a minimum of two separate devices so you already do effectively have some form of backup of your second factor.

My comment is targeted at someone who is savvy enough to: a) care about having "real" 2FA, and b) is concerned about lock-in, and c) is extremely sensitive to being locked out. For someone like that, you're already buying YubiKeys or some equivalent. And if you don't already have some, you're never prevented from using them later.

Reminds of the occasional comment threads on here about homeless people permanently locked out of new accounts every few months because of stolen devices and the growing corporate obsession with forced 2FA, and all the replies that amount to "if they didn't want to fuck off and die they shouldn't have been poor".

passkeys isn't supported on linux desktop, at all. and if you know how to make it work, please let me know. I have to switch to a Windows machine to login with them.

Yeah, that's why I'd never touch passkeys. It feels like you're basically locking yourself into a weird ecosystem that you'll never be able to escape from.

This is kind of silly.

If you're using hardware 2FA, you should absolutely have backups. I've used YubiKeys for years and have one in my laptop, one on a keychain, and one in a safety deposit box.

Passkeys are just another instance of this. I have added Passkeys to all of my accounts with 2FA and it's somewhat more convenient (significantly more convenient for mobile devices). But every account also has all my YubiKeys attached as second factors.

There is no lock-in. And while it's inconvenient and annoying to have to add multiple keys to every account, that is already the reality if you're responsibly using hardware second factors.

This would be less annoying if we could get actual federated identity that big players would actually accept, as it stands having to fetch a key from a safe deposit box every time I register a new account is a huge amount of friction.

It absolutely is. But that’s a separate problem entirely from “will Passkeys lock me in to the Apple ecosystem”, to which the answer is an unqualified no.

Microsoft is a big player and here you go: https://learn.microsoft.com/en-us/windows-server/identity/ad...

I currently have a Microsoft (Work) account that I'm SSO logged on.

To be clear, I was referring to one federated identity that everyone would accept, as it stands there isn't a single, federated identity provider that Apple, Facebook, Google, Microsoft, Amazon, Bank of America, my power company, etc and so on will all accept. I'd like to secure one spot on the internet as an identity, a digital passport of sorts, and secure that heavily then have it log me in to everything. The closest thing we have currently to a digital identity is an email account, but we should really move past that.