Re:Microsoft Confirms Password Deletion for 1B Users
by Wowfunhappy on Thursday December 19, 2024 @12:46PM
(#42463920)
Why do we even have passkeys at this point? Just store a cookie and use email verification for adding new devices.
...this is sort of a rhetorical question, but also maybe not? Slack does it, as do some other services I can't think of off the top of my head. I feel like a lot of normal people who don't use password managers basically always use email resets when logging in from a new computer.
The thing is, email was never designed for this purpose. Password managers are. I stay logged into my email client on my computer, but I have to retype my password to open my Bitwarden vault.
I don't know why this is such a common misconception about passkeys.
Account recovery flows are generally entirely unaffected by moving from passwords to passkeys. If a user forgets their password or passkey, they generally go through an email recovery flow and generate a new one.