Passkeys lock into a specific device and seem easy until you need to use another device.
But instead of being a credential you own and control, across what could even be a local password manager, it's one password to everything. Maybe it is more secure than a regular password in some cases but it largely seems like a worse fix than existing tools for a problem that has better solutions.
Once 1Password supports proper single export when I make a new passkey I'll store it there and later export it to Apple.
Meanwhile I simply make two passkeys. I've only run into I think two sites that supported passkeys but would not let me make two.
On most sites making a second passkey is as simply as going to your security settings, finding the passkey settings there, hitting the "add another passkey" link, and pointing your phone at the QR code it shows, and then on those phone choosing the password manager that you did not use for the first passkey.
How do I log in to my account if I don't have the specific device the account exists on?
I moved all of them from my iphone to a selfhosted bitwarden in two minutes.
I'm surprised selfhosted services would be allowed in that list. Isn't there the "risk" that you can then extract the raw key from your selfhosted instance?
https://bitwarden.com/resources/passkeys-are-phishing-resist...
it's one password to everything
Passkeys are never reused. Even for the same person, they are always unique across websites, and across devices.
and I can't use this on any other device by default. My passkey is locked within the browser used to set it up.
All password managers support passkeys.
Both apple and google allow exporting your existing passkeys to third party password managers too.
Also each website gets it's own unique public key with passkeys. It isn't a single credential
You're literally arguing a strawman
By single credential, all the passkeys on this browser use my windows user password which is effectively a single key.
It already falls apart for regular interactions like "Can you send me the Netflix password?"
No need to be a part of an 'ecosystem' to use a password manager or passkeys.
Also, remember when one of the maintainers of the passkey standard warned that KeePassXC users would get blocked by relying parties [0]? Would you allow tech companies to determine what password manager you are allowed to use?
KeepassXC was threatened to be blocked.[1]
[1] https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
However, I won't give it things which are meant to represent devices.
People who designed the 2FA model designed with the intention that a password is something you know and a device is something you have.
By putting storing both together you're breaking the assumptions of the people who design these systems.
So I store all my passwords on KeepassXC, everything else has to be elsewhere.
And Windows, you need Bluetooth enabled on both devices, on Linux you need Chrome (and presumably bluetooth enabled). It makes you scan a QR code.
Already you're off-base. Of course it works when your devices are homogenized, but very little folks work that way. Some people have a Windows computer using Brave, an iPhone using Safari, an Android device using Chrome, and a work computer with its own hardware/software limitations and partitions.
Of course it works when your ecosystems are not diversified. Problem is, most people are.
A cross-platform password manager like Bitwarden handles passkeys (and passwords) across multiple operating systems, browsers, etc.
On Windows, I hate them. They always push me towards using a PIN instead of my Yubikey or password.
Consider a user in the Apple ecosystem: you are already conditioned to just do Touch ID or Face ID when asked. I was on Amazon the other day, it prompted randomly for “want to set up a passkey to sign in easier”? I set it up and now I can easily sign in to Amazon on my mac or iphone with zero friction.
For the normal consumer this is not a replacement for “dig out my password manager and copy-paste/autofill my password”, it’s a replacement for “oh it’s prompting for my password again” -> proceed to type your shared password for all sites.