Personally I hope to see Passkeys becoming more prevalent.

I'd like a better baked version to be more prevalent.. right now it seems a bit 'how can we standardise a way for everyone to have a walled garden'.

I want bitwarden, or whatever password manager, to be the (cross-platform) provider, not the OS. It's coming, maybe/hopefully?

1Password already has it. I'm sure others will implement it soon enough as well.

Sure, but the man on the Clapham omnibus is going to use Apple's, or whatever's, that's what I don't like - it seems set up to serve incumbents rather than to stand on technical merit.

There's precedent for only supporting certain walled gardens, too: Google MFA sign-in supports Yubikeys et al. only if used in Chrome; in Firefox for example you get the prompt and everything, it just stubbornly refuses to accept it on touch.

> but the man on the Clapham omnibus is going to use Apple's, or whatever's, that's what I don't like

You don't like that people will use the tool that's most convenient to them? I'm not sure I understand your argument.

Right now pretty much all people except us geeks either:

- Re-use the same password everywhere; or

- Use their OS's password manager; or

- Use their browser's password manager.

How is this any worse?

> Google MFA sign-in supports Yubikeys et al. only if used in Chrome; in Firefox for example you get the prompt and everything, it just stubbornly refuses to accept it on touch.

Ok you made me look because I was sure I had been doing this every morning; Myth busted - Logged in to Google using a Yubikey via Firefox (Windows 11) no problems at all.

Most if not all services which I use that supports Passkeys allows you to enroll more than one per account. I have my phone (Android), my laptop (Windows Hello) andnmy primary and backup Yubikeys enrolled. I'm not restricted to a specific platform.

Which platforms allows you to enroll your yubikey as as a passkey? I know Google for example does not support hardware keys within their Passkeys system and that's a major gap IMHO.

Uh.. I enrolled my Yubikeys as Passkeys without any problems with Google.. just be sure Windows Hello doesn't get in the way, and be sure to select your USB device when enrolling.

I also have my Microsoft account enrolled as a Passkey, and Bitwarden is enrolled using WebAuthn.

> Most if not all

That this is not a required part of the spec and that it's possible for a website to go through certification and get an official endorsement of support without supporting multiple keys per-account is a complete failure of the FIDO Alliance.

One of the big issues with how passkeys are being developed is the painful naivety of the FIDO Alliance about actually standardizing good behavior.

Every response is, "but why would providers do X bad thing?" If we're expecting every provider to allow multiple keys, then require it in the spec. Otherwise, if it's important that the spec not mandate that, then don't tell me that every provider is going to allow multiple keys, because apparently there's use-case for only allowing a single key and we're expecting the spec to need to accommodate that behavior.

----

> I have my phone (Android), my laptop (Windows Hello) andnmy primary and backup Yubikeys enrolled. I'm not restricted to a specific platform.

That people are seriously suggesting this as a solution to backup makes me skeptical of the potential of passkeys to ever be simpler or more straightforward than passwords are. Normal users can't be taught not to reuse passwords, they can't be taught to do 2FA, and you think they're going to proactively enroll multiple keys in every website they sign up to?

That's not going to happen; what will happen is they're going to lose their Android phone and they won't be able to do cross-device authentication without it, and they won't have proactively done cross-device authentication on their Windows machine, and the only way to get access to those keys will be to buy another Android phone. "Register multiple devices ahead of time" is only a solution if you expect passkey usage to be restricted to niche technical groups.

Personally, don't

This article isn't even negative! It's pointing out that passkeys could make most security keys obsolete because they lack the storage to store resident passkeys for lots of sites.

It even provides recommendations to work around this problem.

> sentiment about passkeys is overwhelmingly negative in the comments sections of previous articles

(Emphasis mine)

The thread is discussing the general sentiment on HN regarding passkeys (based on previous discussions), not the sentiment of the linked article.

Vocal minority or majority? Hard to tell without a proper survey.