In practice, because site owners know users are going to mess up having their passkeys on all devices, I've not seen any insist that a passkey _must_ be used, and you can always log in with your password (or worst case, email magic links) as a fallback.

However, this negates the primary stated objective of passkeys, removing the possibility of users being phished, so I'm not sure how long that will remain the case everywhere.

I've also encountered sites that have a login with passkey prompt that then turns around and asks for TOTP 2FA or email confirmation anyway, which to me seems to negate the primary customer benefit of passkeys...

▲

jolmg 2 days ago | parent [-]

> I've not seen any insist that a passkey _must_ be used, and you can always log in with your password (or worst case, email magic links) as a fallback.

With the exception of Github, and banks.

▲

dfabulich 2 days ago | parent | next [-]

Did you try it? That’s not correct. I just logged into GitHub with a password (+ 2FA), on an account that also has a passkey.

No major bank revokes your password when you setup a passkey, either.

▲

jolmg 2 days ago | parent [-]

Is "passkey" only supposed to mean devices that implement specifically U2F, WebAuthn, etc.? I would have thought TOTP and challenge-response hardware tokens to count, including cellphones with apps that implement such.

As to

> No major bank revokes your password when you setup a passkey, either.

If we're talking about requiring 2FA via TOTP or challenge-response hardware tokens or banking apps implementing such, that depends on the country. It's the status-quo in some places. Some banks even put the input field for the token output as a third input in the login form on their website because all customers have them. The rest separate their login form in multiple steps, but they likely require it of all customers too.

▲

Telaneo 2 days ago | parent | next [-]

> I would have thought TOTP and challenge-response hardware tokens to count

Those are absolutely not passkeys. Passkeys are just WebAuthn (from what i can tell).

▲

jolmg 2 days ago | parent [-]

Such a generic word. I imagine there are tons of CLI utilities out there with a --passkey option that refer to simply files with a key inside. Kind of crazy that it's being used to mean specifically devices that implement a specific protocol.

Kind of feels like "crypto is a type of currency and not all cryptography", or "SQL Server is a specific product of Microsoft".

Wonder if how it happened this time was people read the specs and explanations of WebAuthn, saw "passkey", never seen that word before and assumed it's only ever been used in the super narrow context of WebAuthn so it can only mean that. Maybe "header" can only ever mean "HTTP header".

Thinking about it like that, it may be more like how "latte" is specifically espresso with milk (it's really just milk), or "queso" is specifically cheese dip (it's really just cheese of any kind), or "masa" is specifically made of corn (it's really just dough of any kind, or it's mass like atomic mass is masa atómica).

▲

Macha 2 days ago | parent [-]

Isn't the standard term for what you're referring to a "keyfile"? Google Trends also indicates nobody was caring about "passkey" before 2022.

	▲	2 days ago \| parent [-]
		[deleted]

▲

JohnFen 2 days ago | parent | prev [-]

"Passkey" refers to a very specific authentication method. TOTP, etc., don't count.

▲

LoganDark 2 days ago | parent | prev [-]

Porkbun too