> They're not, there's a tradeoff here. You can not just make an encrypted vault of all of your passkeys and stick that on a USB drive. And that's a tradeoff that was so severe that every major OS provider got together and extended the standard to allow cloud sync for keys.

Why do the blessed vendors get to do that but not 3rd parties? Syncing your passkeys is just copying the DB to the cloud and then down to another device. If you made a copy of your icloud db, and icloud let you import passkeys (does it?) then you can absolutely make a copy of your icloud keychain and backup/restore it as needed. I don't really understand your point here (everything else checks out though).

> Why do the blessed vendors get to do that but not 3rd parties?

That's exactly what we're all asking :)

I feel like you're arguing that the tech itself doesn't require platform lock-in, and I absolutely agree with that. This is a policy issue, not a tech issue (well, attestation, but that's a different conversation). But it's policy issue that's shared by all of the major companies involved in the FIDO alliance and they're very suspicious against offering any policy solutions or requirements in the passkey specification itself.

There's no technical reason at all why Apple couldn't support syncing passkeys to a local backup that can be imported by other authenticators. From that perspective you're completely right.

They just don't.

Right. I just wanted to make that clear. That’s why I say there’s no fundamental difference between the two technologies and compare webauthn to passwords of yore.

In terms of policy, I am not sure all the players share the sentiment. Google stated they understand the importance of passkeys being cross platform. So at least, if their statement is to be trusted, they’re on the side of consumers.

I come down really hard on passkeys sometimes, but I'm not opposed to the idea of using keys for authentication. I think that's an amazing idea.

I'm mostly down on the passkey ecosystem and who's in charge of it. I guess I don't do a good job of clarifying that always.

There is a theoretical alternate world where the FIDO Alliance approached this differently where I would be 100% on board with passkeys and would be encouraging everyone to switch to them. I'm just really worried about the implementations I think we're going to actually end up with.

I actually like the passkey idea in the general sense. But what I don't like is the involvement of a third party, and the loss of control over my own critical data.

So what I'm hearing through all these answers (many thanks for the info!) is that my original question of "am I screwed if I arrive to somebody's house naked/robbed/with a broken device", the answer is "yes. Thorougly. Unpleasantly. By design."

Am I missing something here?

To be fair -- if you go out and buy another device owned by the same company and you go through their recovery process (and are capable of going through that recovery reprocess) and you stay in their ecosystem like a good little consumer, then you'll be OK (although you won't have immediate access to those accounts until after you've purchased and set up the replacement device).

And if you've preemptively set up your friend's devices as trusted devices and given them access to your accounts or like... purchased a second device from the same company and linked it to your cloud account and then given it to your friend to hold -- in both of those situations you'll be fine (but do you want to do any of that?)

Otherwise, yes, you're out of luck by design. You'll have to go through the recovery options for every single account.