> The software industry has zero concept of how much pain and suffering passkeys are going to cause the average person, almost entirely because the average American has an iPhone and a Windows laptop and there's literally nothing built-in to iOS or Windows that will sync passkeys between these two devices

Then you register multiple passkeys for the website, just like you would register several Yubikeys.

It’s a 1-click process, and no HW-token required. Most people will be fine.

> Most people will be fine

this assumes majority of population has the means and discipline to purchase, register and maintain multiple pass keys and/or devices.

There's a world outside the developed countries where a typical yubikey can cost 10-20% of a family's monthly income.

A family where phones are the only tech devices in the household and the phone is typically in a 100-150 USD price range and costs about half of monthly income.

By making passkeys mandatory we are asking them to get multiple of yubikeys/phones per person in the family ?!

They cannot afford to and will not maintain multiple passkeys or backups.

Orgs will have to build a way to help them recover their accounts easily without further costs or just ignore them as "edge cases".

Passkeys are free. You do not need to buy them.

They replace passwords, after all.

> Then you register multiple passkeys for the website, just like you would register several Yubikeys.

So just like Yubikeys, when you lose one of those keys you'll need to go to the 100's of sites where you registered that key and change it. This is not a good plan.

How do you log in on the other device to set up the second passkey?

Using the "passkey on other device" flow, which usually involves QR codes.

What if my phone irreparably broke?

Then you use the "lost my passkey" process, which should be the same as the "forgot my password" process. Most services should treat passkeys like unphishable passwords.

Passkeys do not (and are not intended to) solve the problem of lost credentials.

They're intended to aggravate it instead.

Many services which support passkeys do not support multiple passkeys. The big ones have figured out that we need support for multiple, but sadly just like with Yubikeys not everyone got the message on that.

But, its like I said: You have zero concept of the struggle that is already happening and will continue to get worse. That's what I mean when I say that the software industry has zero concept: You think you have the solutions, but you actually haven't even grasped the full scope of the problem.

This. Almost no-one's even realised that maybe being able to enroll multiple TOTP tokens would be a good idea. I spent some time recently trying to figure out a good, properly secure, robust authentication method would be for various important accounts both personally and at work, and I've more or less concluded that there isn't one, the best compromise that mostly works is TOTP but manually copying the secret across two hardware keys, which is wayyyyy outside the average user's capabilities, and I'm not even sure I'll be able to make it work in practice.

passkeys are not serious until they actually address backups in a way that isn't just "we'll copy the secrets around in our cloud services just like passwords lol"

(And it's not like there's no solution here: firstly make it mandatory in the spec to allow enrolling multiple keys, then standardise a means to enroll a device from another device, automatically, across all devices that other device is enrolled in, and then also it would probably be a good idea if that also offered a way to revoke the other keys)

The only site that uses passkeys I regularly use that doesn't support multiple is PayPal. Pretty much every other site that at one time only supported one now supports multiple. Which common sites still only allow one, other than PayPal?

An alternative viewpoint to consider is how much pain and suffering passwords cause large companies or identity providers.

One example: Large organizations often spend $1m/yr on password resets alone.

"Hello, IT, my toddler accidentally dropped my phone in the ocean. I can't log into anything now. No, I can't restore my iCloud keys onto my Windows laptop. Please help."

I suppose corporate gets to overnight you a yubikey in 2-3 days?

>Hello, IT, my toddler accidentally dropped my phone in the ocean. I can't log into anything now.

It's clear that you are making assumptions without doing any research...

Yes you can. See "Recovery security" section of this article:

https://support.apple.com/en-us/102195

>No, I can't restore my iCloud keys onto my Windows laptop.

Yes you can — see this article:

https://support.apple.com/guide/icloud-windows/set-up-icloud...

Read the KB carefully.

1. Your windows pc doesn't have a SecureEnclave (tpm2.0 doesn't count!) so no, you can't do PassKey recovery only password recovery.

2. You can only do iCloud recovery to another Mac/iOS device. In other words, not your windows PC. Hope you have a spare Macbook hiding out.

That's why I very specifically said: Passkeys solve problems that corporations have, by moving the problems on to consumers.

Our industry was done writing reliable, quality software years ago, so it shouldn't come as any surprise that we want to keep going in that direction. Passwords have such an obvious, fantastic, beautiful quality in how when all else fails you can verbally say out loud "my password is X C J 5 4..." Its the ultimate form of reliability: non-digital, spoken or written language.

Passkeys throw that away. I don't care about any of the other arguments. Our industry wants to build less reliable software, so we built passkeys. I don't know why we're obsessed with building things that are less reliable instead of more reliable, but we are. Its sad, its insane, and frankly I'm getting so damn tired of trying to push for reliability every day and instead seeing Microsoft just throw weight around, get hacked, throw weight around again, get hacked again, and somehow still reap respect for their position in matters of security.

Apple‘s password manager is available for Windows, although I don’t know if it supports passkeys.

Also, there are mechanisms to use a passkey from another device (over Bluetooth I think?)

iCloud Passwords is not built-in to Windows, so users have to know to install it. Most don't. Most iPhone users don't know they're using iCloud Passwords. In fact, many aren't (because it is oftentimes toggled off in settings because their grandson told them to do it or some other b.s. like that).

And, also, it barely works, if the wind is blowing in the right direction; was clearly built by a long forgotten team to check a box.

They've also released a Chrome extension, but no Firefox extension (actually, they did release a Firefox extension, but it only works on MacOS). Again, you have to know to install this.

The Windows Hello bluetooth system for passkeys has never worked for anyone I've seen try to use it. The display & scanning of the QR code works better. But, that only works if the passkey was generated on iOS and is being used on Windows; if the passkey was generated on Windows and needs to be used on iOS, you're probably screwed (I've never seen Windows try to pop open its webcam, if the device even has a webcam, to scan a QR code on another device.)

Yes, its called "hybrid transport", and its a flow where a laptop presents a QR code to a mobile phone, who then sets up a BLE connection for one time use of the passkey.

https://www.corbado.com/blog/webauthn-passkey-qr-code

(Not sure how the "cloud assisted" part of caBLE works)

So... you need to carry two electronic devices for this so-called security solution?

No… you can also sync with iCloud Passwords, or use a hardware token, like a Yubikey.

So a Yubikey is not an electronic device that you need to carry?

iCloud Passwords don't run on an iPhone that is an electronic device that you need to carry?

Those electronic devices that you mention don't each store the keys in a proprietary format and you can't access them without the vendor's cooperation - i.e. vendor lock in?

>Those electronic devices that you mention don't each store the keys in a proprietary format and you can't access them without the vendor's cooperation - i.e. vendor lock in?

Passkey portability is being worked on. Here is the draft of the open standard:

https://github.com/fido-alliance/credential-exchange-feedbac...

News article: https://www.theverge.com/2024/10/15/24270875/password-manage...

BLE seems to be a different way to authenticate than QR codes. Desktop computers may often not have Bluetooth chips.

Apple has a password manager? What is it called? I’m a typical iPhone/Windows user and have never heard of it.

Apple has had a password manager baked into iOS for 11 years now. It was initially called iCloud Keychain and buried in the system settings, now it's been broken out into the "Passwwords" app as of iOS 18. There are extensions for Chrome to use the app on Windows PCs as well.

https://support.apple.com/en-us/120758

Keychain goes back to 1997. The initial selling point for 1Password was that you got the Mac experience across platforms.

It's not quite as bad, your average user with an iPhone or Android phone will be fine. Just scan a QR code on the Windows machine and log in with the phone.

The problem is that the UX for this is extra super confusing, and people will end up with passkeys that aren't backed up anywhere and get locked out of their accounts.

I don't have many things against passkeys for corporate accounts, but I don't think we're going to fully destroy passwords in the personal space. To the hardline Passkey-for-everything advocates, I pose the following situation:

In your sleep, your house has burned down. You have zero devices, and your backup keys are stuck in a building you do not have access to for another several hours. You have made it out of your home with: Your wallet, containing $20 cash, a handful of slightly melty credit cards, an ID that is almost readable, and your keys. The credit cards are fucked and will need to be replaced. Your ID is mostly readable.

This is the situation that I pose for most people to try and get undone from. I then amp it up another notch:

you have no job and are unemployed currently. You cannot make use of any insurance system as you have been deemed "impossible to insure" due to your status. You currently live in a cardboard box behind a restaurant in downtown.

And before you go "why would a homeless person need email", it's required for lots of services, as is a phone number that can at least have voicemail at it (this is a service that Futel^1 provides in some places). You can't assume that physical artifacts will continue being in the possession of a dishomed person. One of the common reasons for losing all your personal effects in this situation is the state literally taking everything down to your clothes away^2.

^1 https://futel.net/ ^2 https://www.realchangenews.org/news/2024/06/05/sweeps-triple...

All of this makes me realize that availability is my biggest risk. My passwords are all 30 character random alphanumerics and I have none of them memorized.

This is, ironically, why I ended up with 1password over bitwarden: Their recovery process is down to "You can recover with paper, or another member of your family with access can break you into jail to get your account back up."

I have tested this process with my partner. the only thing that I cannot replace is the TOTP token to add new devices (however this is bypassed when recovering from paper). I have legitimately considered etching the recovery data into a small glass (borosilicate) dish using selective laser etching.

Why glass over something presumably more durable? Ease of smashing if the gestapo break down the door?

Durability to cost ratio. I can get 90mm borosilicate petri dishes for $10 that I can be pretty certain won't melt into a glop, plus having a "contained" object allows me to have tamper seals that are much harder to violate (nail polish).

Thus, "password recovery material, TOTP QR code, and an SD card with essential documentation" can be passed to next of kin easily.

On bitwarden you can also put an emergency access with an emergency contact: https://news.ycombinator.com/item?id=42413539

For mainstream people uninterested in such things, this isn't a solution, but since the question was posed to "me", one way back into digital life that is not passkey specific is https://dangerousthings.com/product/apex-flex/

> and your keys

Ah, so no worries then. I've still got a passkey for all the services I really care about.

If I'm not supposed to have cloud-synced credentials like so many here dislike with those implementations of passkeys, chances are the copies of my password safes and my SSH keys to the VPS are all cooked as well.

Heck, forget about the fire.

You're traveling in a foreign country without your laptop when your wallet and phone are stolen. You can probably get to a public computer, but how do you get into your email?

This situation strikes me as much more likely than getting hacked. Hence I will never use passkeys unless forced, and if forced I will do everything in my power to switch to another service. Same for forced 2FA as far as I'm concerned.

"Just"? You just added minutes of figuring out where your phone is and how to scan a QR code to a log in process.

Find your phone: https://www.icloud.com/find/

Scanning a QR code: https://support.apple.com/en-us/102680

The time investment could even be worth it, since "Signing in with a passkey is three times faster than using a traditional password and eight times faster than a password and traditional MFA", according to the article.

Find your phone: https://www.icloud.com/find/

-> I have that turned off

Scanning a QR code:

-> My back-camera lens is shattered. Using the front is dodgy at best. I don't feel like I need fork out for an to upgrade as I use a digital camera if I want to take pictures.

What about those don't use smart phones?

Register a passkey on a different device or get a hardware key or whatever. Or call Microsoft support and complain to them. This doesn’t feeling like an honest discussion anymore.

It absolutely is a Valid question. At the end of the day, the problem with passkeys Is that they are explicitly negatives for common people.

Have a broken phone camera? Cannot scan qr codes.

Lost the phone? Cannot log into vital modern day accounts like email.

Your house burned down, and the passkey device with it? Say goodbye to literally everything.

Homeless (temporary or otherwise) persons, random local government sweep just trashes everything you own. Bye bye to the passkey again.

You're going to need some technology if you expect to interact with technology.

Right, but unlike a passkey, my password doesn't discriminate based on the device I use.

If my phone explodes like a Samsung surprise, and my laptop turns into a spicy pillow;

I can in the worst case scenario, still log in via the local library PC.

I could borrow a device from a friend, or buy a second hand Thinkpad and use that.

That is to my knowledge, not possible with a passkey device.

There are syncable and hardware-bound passkeys and you are free to use a password manager that syncs your passkeys. iPhones don’t even let you create a passkey with the built in password manager if you have synchronisation disabled. I don’t know for sure if Google does the same but I expect them to.

If you’re remembering all your passwords there’s a good chance they’re terrible, you frequently re-use them or both. That really helps attackers e.g. when they use leaked passwords to run credential stuffing attacks on your employer.

You just wrote two comments bashing a technology you admit you didn’t properly educate yourself about.

Except, you can't sync the iphone's passkey with non apple products. And it's still tied to your apple ID, which uses a password. This in theory, defeats part of the point. (It's definitely better than the alternative though)

For android, the passkey is clone-able iirc, but again, it's an expensive smart device.

So now I am expected to have at a minimum, two use-able smart phones, per family member. Iphone? Frankly, fuck that shit. Too expensive.

Android, I can manage it. But doing that for all family members is not financially viable.

Also I do use a password manager and an encrypted text file. (Not smart, I know. The file is basically a backup)

But I really cannot expect people like my mother to understand how to set up a passkey. Much less, how to setup multiple for the off chance one is lost. Add onto the fact that Yubikey does not support twins, and many services do not support multiple passkeys.

In terms of computer literacy, using my mother as a baseline (Age:Mid50s) the current passkey system is non-viable.

> Except, you can't sync the iphone's passkey with non apple products

So just make multiple passkeys on the different platforms/devices.

> So now I am expected to have at a minimum, two use-able smart phones

No, you can have passkeys on laptops and desktops. It doesn't need to be a phone. Hardware tokens can be had for like $20.

The "how do you recover from zero devices" problem is a real one. It's not a problem at work because you have a root of identity and access to a human (your IT dept) who can reset you. For public services like Google, if you lose your recovery methods then go fuck yourself.

Something I know is the only authentication method that can't be physically destroyed. When your customers are the masses every failure mode that can happen will happen, usually at the most inconvenient time.

What sucks about passkeys in abstract is that you want at least two failure modes that are uncorrelated— you're unlikely to forget your password and have your house burn down at the same time. Passkeys consolidate everything into to physical possessions which can be and are destroyed all at once.

You do it once the first time you log in, then add another passkey for the service to the laptop. Now you don't need your phone to log in. Also, if you lose your phone, you can log back into the service on your new phone with your laptop.

What if the passkey was generated on Windows and you're trying to sign in to iOS?

It’s your fault for not carrying your desktop and a camping battery with you.

Just install a webcam on it and scan the qr code iOS displays.

/s

>and people will end up with passkeys that aren't backed up anywhere and get locked out of their accounts.

I don't know why this is such a common misconception about passkeys.

Account recovery flows are generally entirely unaffected by moving from passwords to passkeys. If a user forgets their password or passkey, they generally go through an email recovery flow and generate a new one.

Why do we even have passkeys at this point? Just store a cookie and use email verification for adding new devices.

...this is sort of a rhetorical question, but also maybe not? Slack does it, as do some other services I can't think of off the top of my head. I feel like a lot of normal people who don't use password managers basically always use email resets when logging in from a new computer.

The thing is, email was never designed for this purpose. Password managers are. I stay logged into my email client on my computer, but I have to retype my password to open my Bitwarden vault.

Proton Pass does this. It's browser extension will also generate and store passkeys in your Proton account making it accessible to any device.

Not built in. The number of Windows users who use Proton Pass is a rounding error toward zero.

What is a browser extension? Do I need to take a class on that? Where do I buy one?

Really, not being snarky here. If I asked my dad to install a browser extension he would drive his laptop to my house and ask me to install it for him. If I wasn't available - then it just wouldn't happen.

My mom can't see, so maybe she's okay?