> But I would dread having to try and recover a Passkey with Google, who would I even talk to?

That's not what this blog post is about. This blog post is not about using a passkey to login to your email.

This blog post is about using a passkey to login to a website (404 Media) that currently supports login via "magic links," i.e. instead of passwords, they always send you a "forgot my password" link, which you click on in your email.

If you currently login to 404 Media with a magic link, and then decide to login to 404 Media via passkey, and you lose your passkey, you can just get a new magic link sent you via email and reset your passkey, or, if you want, you could just skip the passkeys and go back to always using magic links.

Using passkeys to login to your email itself is a whole different ball of wax. Gmail does not have a simple "forgot my password" email that it sends. (That would be pointless if Gmail is your only email address!)

The "forgot my password" flow for Google/Gmail can involve a bunch of factors, including backup email addresses, backup recovery codes, recovery contacts, SMS, push notification to other apps you've logged into. Google doesn't document all of the factors they consider, and neither do any of the other major email providers.

I get it: it would be scary to login to Google via passkey if Google is your passkey manager, especially because there's no way to export a passkey from one passkey manager to another. Can you trust Google's recovery system?

That's a hard problem for Google, but it's a trivial problem for 404 Media. They just send you a magic link, and rely on Google to keep your email secure.

And, let's face it, most of us run sites that are much more like 404 Media than they are like Google.

basically "passkey is a good session cache when you already have a password or a magic link"

an entitled dev from apple who shops at Albertsons just like passkey with password-reset-as-login-flow. nothing to see here.

FWIW people don’t actually understand how passwords work either (password hashing etc.), and I am not sure it’s important for most people to understand how passkeys actually work. Also, majority of people reuse the same (extremely weak) password, or they go through an account recovery flow every time they login anywhere. This is why you saw the “magic link” pattern take off in the first place — users were already going through essentially the same flow before. Now at least they can sign in with biometric authentication on a regular basis, using passkeys. And if they do get locked out of their account for some reason, they go through the account recovery flow — same as they did when using their password before.

But at least they won’t get phished anymore! That’s a huge win.

> people don’t actually understand how passwords work either (password hashing etc.)

Those are implementation details that they need not to care about. Password hashing is about mitigating the consequences of you the account provider screwing up. I know, technology and finance are special, in that the more a service provider fucks up, the more it is your fault somehow (see: "identity theft") - but most people didn't get that memo.

Indeed — I am arguing that 99% of normal everyday folks using passkeys also do not need to understand passkeys.

Difference is, passwords break like normal things people are used to. Passkeys break like some alien technology from fifth dimension, there is no reference to everyday experience for the one thing people need to understand, which is how to not mishandle auth on their end, and how to recover when they invariably do mishandle it.

> I use a Yubikey and Passkeys all the time, in a business context where there is an IT admin to go to when there is a problem, I think Passkeys will do great. They'll really improve the average security posture of an organization.

The average user of a service will be worse off for passkeys. Something as innocent and common as losing a phone could result in complete account lockout.

Magic links offer the best compromise between security posture, effort to implement for developers, and easiness for users. It's not the perfect solution, but its the best at the moment across all dimensions.

>Something as innocent and common as losing a phone could result in complete account lockout.

This is the biggest misconception I see repeated about passkeys constantly. Account recovery flows generally do not change at all. Passkeys replace passwords, they change nothing at all about account recovery. If you forget/lose your password or your passkey, you go through the reset flow and create a new one.

If you lose your phone you may also have lost access to your email, if you used a passkey to sign into that.

If you lose your phone and you only have your phone to access your email, then you also have lost access to your password if you're using a strong password and a password manager.

Or do you remember a 20+ random character string for each site and thus do not need a password manager?

My email and password manager are actually the two unique passwords I do remember (the rest are in my password manager). So losing my phone does not mean I lose access to them. I _have_ actually lost all my electronic devices in a house fire, so this is from experience.

2FA does make this more complicated and in my case my password manager did not have 2FA, but TOTP with backup codes does let you store those backup codes somewhere else, while none of the passkey implementations I have seen (Fastmail, Amazon and Toggl) have an equivalent to the backup codes for TOTP. The fact that they still support password auth is probably their failsafe here, but this assumes that password auth continues to exist, which is contrary to to the goals of passkeys.

>I _have_ actually lost all my electronic devices in a house fire, so this is from experience.

I can't speak to other passkey managers, but both Google and Apple have pretty thorough account recovery flows that work even if you lose 100% of your devices.

Google regularly asks me for annoying things even when I have all my credentials. What’s their account recovery flow? I’m not sure I trust it to be good.

I just had to go through it for a friend who had forgotten their Google password. It was good. Tbh it would be more surprising if it was bad since they have millions of users. So the amount of people who go through that flow every day is probably very high in terms of absolutes numbers, even if it’s only a small percentage of users. And Google is known to do a shitload of A/B testing anytime they tweak their UI/UX.

So yeah I think it would be way more surprising to me if this particular flow was bad. If anything it’s likely to be one of their _best_ flows, given their scale and how critical of a flow it is.

And given that they love to track users to serve them ads, it’s also very much in their (capitalist) interest to make sure users don’t get locked out of their accounts.

That has not been my experience with Google, as detailed in the other time you sent this reply.

That’s why you don’t create a passkey for the service that manages your credentials.

Use a pair of yubikeys.

BTW, all major email providers have a flow to allow you to recover access to your account.

When you enable passkeys it doesn’t suddenly deactivate every other way of logging in.

That’s definitely not the position most passkey proponents take.

If I lose my phone I don’t lose my passwords to begin with, because I have my most important account passwords written down somewhere, including the one for the email account used for recovery flows. Strings are an open system after all. TOTPs are slightly more involved but even a layperson can save an image of the original QR code, in addition to recovery codes.

The misconception here is your setting up a strawman.

Password managers like Bitwarden allow you to store passkeys too. Ofc, that only works for services that let you create & use your own passkey, rather than force you to use one managed by them.

Is the strawman that passkey are only available via one device, your phone? Because Google and Apple sync passkeys to devices logged into their respective accounts, so assuming you own a laptop or ipad/tablet, or have an old phone, your passkeys are also available on that device.

Except if you're relying on "an old phone" as your backup device, you'll find you don't have access because you haven't powered it on to sync passkeys, and Google expired your login anyway as you haven't used it on that device in months.

FYI both Google and Apple have an account recovery flow that works even if you lose 100% of your devices.

I once used Google’s account recovery flow on an old dormant (for maybe three years?) account. Did everything asked and reached a state where they wouldn’t ask me to do anything else to demonstrate ownership but I’m still suspicious or something like that. Fortunately I had nothing important there. Pro tip: operate as if Google doesn’t have a recovery flow at all.

This is not true for Google at least. I have been locked out of a secondary google account because they thought it was suspicious that I logged in from a new IP address after 6 months of disuse. I have the password, I have the TOTP codes, I have the recovery email (in fact I even have the email for that account, as it forwards to my primary account), but login is just not allowed until I accept a push notification on a destroyed device.

For some reason, my primary account was not subject to the same probablistic lockout, maybe because it had a more constant record of use, or maybe because it was a GApps account.

So your only change would be needing to store a recovery code instead of the password.

> But I would dread having to try and recover a Passkey with Google, who would I even talk to

same as trying to recover a password: You go through the account recovery workflow.

My opinion on passkey is that they are a wonderful tool to speed up the authentication process with sites in some cases (which turns out to be most cases). Rather than typing your password (hopefully on the correct site...) and then sometimes confirming with a magic link or a 2FA code, all you do is use your platform native's authentication conformation method (face recognition, fingerprint, PIN code, whatever) and you're done. This works independently of which site you're on.

Just as with password managers: If you use the OS built-in solution, you're locked into a specific platform (though I admit that with passwords it's at least possible to move them manually, albeit super painful if the passwords are secure), so if you're using multiple platforms concurrently use a password manager that supports all your platforms - most if not all password managers these days support passkeys.

For all breakages related to passkeys, the same applies as with passwords: You use the account recovery flow (which often is the weakest link on any site).

As such, passkeys feel like a wonderful shortcut with even slightly improved security (you can't present a passkey to the wrong site) in the default case.

Except you don't just have the vendor lock-in of your password manager, you also have the vendor lock-in of a web browser too. Or you are forced to use a password manager that works as a web browser extension instead of a standalone application. This is so much worse than OTP, which already was incredibly user unfriendly, because at least with OTP you still had the freedom to type or paste the secret from wherever you wanted to get it generated.

> you also have the vendor lock-in of a web browser too

1Password allows me to authenticate with my passkey in Safari (my default browser), Chrome and Firefox on macOS and Windows.

you know this is temporary, right?

the site knows the key provider, and it's a matter of time the only accept the three big ones "for security".

Problem with auth methods is the protocol fatigue for the average user. And that even includes some tech savvy people. I have been in the process of teaching my family to use password managers. I subscribed to 1Password family, added everyone and then added the app to their devices, setup their Face IDs/Touch IDs, set the app as default password manager on their devices, added it to their browsers, etc, just to make it as simple as possible for them to just be safe.

They’re still having a hard time grasping the concept of 1 password per site. Or that password do not need to be memorable or the name of their pet plus their birth date. So they fight it.

Often they call me saying some service is broken, emails aren’t working, etc, and I ask for their password and they show me a list of account passwords in their notepad app, bc they were trying to replicate 1 password in their minds, because they absolutely do not trust what they do not understand.

I for one do not like magic links, prefer regular otp, especially because I can add it to my 1Password. I don’t like magic links because it adds an extra step of opening my email app, clicking a link and opening a new tab. It breaks my flow, so I tend to avoid services with magic links unless it’s only for account recovery.

Passkeys, I have skimmed the implementation, and flows, but I can’t get over the lock in and lock out potential.

So going back to fatigue, if my relatives are still in the password manager training phase, I’m definitely not going to confuse them with magic links, much less with passkeys. I will wait, and wait, and wait, until this all settles down and we have a gold standard, and everyone falls in line. Average users do not need the latest, “safe enough” is enough for them.

a text file on the desktop for sites like these are better than any alternative to be honest. at least they aren't reusing their bank password everywhere.