And a is why they are being pushed so hard. I'm so sick and tired of this. Why is it that every time there's a new piece of tech or something gets updated it's 1) often categorically worse and 2) seems like its designed in such a way that the goal is eventually to charge a monthly fee?

I'm fed up. I'm not using passkeys because I trust no one to not take advantage them eventually. Not even my beloved bitwarden.

"You will own nothing and you will be happy."

I shared the concern around vendor lock-in initially, and I still do to some extent… but this can be quite easily mitigated by registering multiple passkeys for each account. Where I use them, I have at least two of {iCloud Keychain, hardware FIDO2 key, Google Password Manager}.

CTAP2 works nicely over Bluetooth and NFC so you can usually use these credentials even on machines which don’t integrate with your keychain of course. I actually find them extremely convenient and they’re obviously more secure than passwords across a broad range of common attacks.

As with passwords, they will be misused by vendors and clueless users alike, and it’s up to us to (a) use them correctly for ourselves (maintaining redundancy) and (b) encourage our less tech-fluent friends and family to do the same.

All around though, I think they’re a considerable win for convenience and security.

99% of users do not care about vendor lock-in or understanding the underpinnings of technology

Major implementers are definitely over-complicating things; making perfect the enemy of the good in a way that's hindering adoption. They want to make phishing impossible, not just "really hard", and doing that requires portability features to be ridiculously over-complicated and somewhat at odds with user freedom. In my opinion they should give up on that for now and just let users export a plaintext database the same way they can with any other password manager.

Regarding b) it's extremely simple. Passkeys are private keys (like SSH), stored in a password manager, accessed via JavaScript.

Agreed. Highly portable passkeys get you 90% of the way to where we want to be. I'm looking at implementing passkey support for my authentication library and considering only supporting major password managers because they have solid interaperability between ecosystems.

> Imagine if you could link your email client and your web browser closely together so that every site that offered a magic link "just worked". You click a button, it emails you, your email client silently notifies the web browser and deletes the email, and then you get logged in.

How the hell do you think that’s better? Passkeys are absolutely portable, many of the password managers on the market allow you to export them.

What happens if google suddenly decides to deactivate your account?

> Passkeys are going to be a complete failure, because a) vendor lock-in

It's pretty easy to avoid vendor lock-in. Here's what I do when I decide to add passkeys for a site I use.

1. I press the "create a passkey" button on the site's security page (finding this is usually the most time consuming part).

2. My browser gives a dialog offering to save the passkey in 1Password. I let it do so.

3. I press the "create a passkey" button again.

4. I get the same save dialog. This time I pick the option on the dialog to save elsewhere.

5. That dialog goes away and I get a new dialog for saving the passkey in Apple's iCloud. I let it do so.

That all is just "click", "click", "click", "click", <touch fingerprint reader>.

The result is that I now have two passkeys for the site, handled by two different vendors.

> I can easily move a password around; it's just a string. As far as I understand it, major passkey implementations are basically non-portable

There's a spec being worked on for passkey export/import [1].

[1] https://blog.1password.com/fido-alliance-import-export-passk...