There needs to be industry and government leadership on this to gradually require hardware token usage, for at least critical financial and government applications. Right now everyone is putting their energy behind passkeys, but those are much harder to understand than a physical token. I don’t know any non-technical people who understand how passkeys are normally tied to the device (or the manufacturer-provided cloud account in some cases), how to set them up on a second device, why you might want to do that, etc. And many technical people still don’t get it either!

Then that family member does not worry like you do worry. The main point is assuming one can have a proper security for Google account - everything else becomes easy.

The fearmongering of losing google account should stop. Yes, some people lose it. There are a larger proportion losing/getting pwned by repeat use. For the majority - just pressing the fingerprint to access an account (like amazon/eBay) via passkey is great.

Fairly technical co-workers - I used to suggest them to buy USB security key few years ago. Now that same fairly technical some how has at least 2 devices with them - so they just skipped the USB security key need - and just use Google (in Android) or iPhone in Apple ecosystem. Everything just works.

Yes, there will be a poor soul that may lost everything with only one device.

This is a fair criticism and needs work, I have some short thoughts on it here: https://news.ycombinator.com/item?id=49755217

It's beyond annoying. It's creating needless toil that no "normies" will ever actually do.

I'd love a hardware sold in multi-packs and "born" at the factory with identical internal device key encryption keys (DKEK). I'd love, even more, if a token just allowed you to "commission" new ones w/ a user-specified DKEK on first use.

I'd use one token as a daily driver and store the other(s) in safe location(s), empty of my personal key material. (Or, if I can just commission a new token w/ my DKEK, store a printed copy of my DKEK in a safe location.)

Give the token a mechanism to "type" a backup of its internal state, encrypted with the DKEK, as a USB HID keyboard. That gives me an easy way to backup the token each time I enroll a new website.

If I lose my daily-driver token I just pull a spare from storage, import my last backup, and I'm up and running.

That would kick ass. No "You just need to buy two tokens and enroll them in every website" bullshit.

>How do I use it on my desktop or laptop then

>What if I switch browsers on my phone

>What if I get a new phone

You can let Apple sync your passkeys between devices using iCloud Keychain. Then you can create a passkey on one device and have it available on all of your devices. Google also syncs passkeys to the cloud and lets you use them on Windows (with Chrome)

>What if I change from android to iOS or visa versa

I resolve this by storing most of my passkeys in my password manager. I still store the "important" ones (like online banking) in my phone so a password manager breach doesn't make me lose my money.

>What if I need to log into the site on my Wii U's browser?

Passkeys were designed to let you have more than one, so if you have a device that doesn't let you use your password manager, then just set up another passkey.

as long as you have one working device all will be OK. Either you scan the QR code shown by the website. or if you did login to Chrome with google account then desktop or laptop will just sign you -friction less. Same with iCloud account.

If you browser vendor has implemented passkey then all good.

Most things are built for the majority users. Most don't change. Most don't debate browser wars in hn. Life is like that.

For Wii etc. You just scan the QR code shown in the TV interface. all just works.

Yes, if you want 100% privacy and will do only your own dovecot server then it is not for you.

A majority have more than one phone. Or at least they can get a new SIM card and sign into the iCloud account. Then all passkeys are synced from cloud.

Yes, if you are edward snowden then not for you. For rest of us - it is useful