The website for my HSA required me to set up a passkey last time I logged in. I set it up on my work laptop and my work password manager, which means I can now no longer access my account from my personal computer. This is fantastic, just what I wanted

▲

nitwit005 2 days ago | parent | next [-]

And then you call them up, and they allow you in after asking some identity questions, and you learn there's no real security.

▲

cpburns2009 2 days ago | parent | prev | next [-]

This is exactly a scenario that worries me. Proponents of passkeys imply you can setup a bunch of passkeys. Evidently that's not always the case.

	▲	AlexandrB 2 days ago \| parent [-]
		"But that's just a bad implementation, many other sites do it right!" And many sites block paste from password managers. Passkeys have so many ways to do them wrong that we're going to see all kinds of new and exciting failure modes that lock you out of your account in the future.

▲

sphars 2 days ago | parent | prev | next [-]

Are you also using HealthEquity for your HSA? I'm the same boat, they're forcing passkeys on me. I can still login using my employer's SSO but I've been putting off setting up the passkey until I have to.

▲

ranger207 2 days ago | parent [-]

yep

	▲	simoncion 2 days ago \| parent [-]
		I've refused to set up an account. I just call them on the phone if I need something special from them, have them send paper statements, and eat the should-be-totally-illegal-because-of-how-obscenely-large-it-is "mail you a paper statement" fee.

▲

jeroenhd 2 days ago | parent | prev | next [-]

Click the "lost password" button. Passkeys aren't magic, they're just a funky password.

If the website didn't implement a "lost password" button then that says a lot more about the website than it says about passkeys.

▲

rdsubhas 2 days ago | parent | prev [-]

I think the irony here is missed.