> There is no reasonable way to obtain login credentials for accounts protected by passkeys without physical access to the user's device(s).

Click "I lost my device", enter contact, get a reset link via email/sms

Email and SMS are not reasonable and both have an extraordinary number of flaws.

jmbwell 4 hours ago | parent | next [-]

So use the recovery codes. Or scan the QR code and auth from another device

I’d buy that there are too many different confusing ways to recover from this situation, but not that it’s impossible

	▲	Barbing 3 hours ago \| parent [-]
		>use the recovery codes. Fun fact: Google can decide to reject these. Lose access to the original device, try to rely on recovery codes to login with known current password on family member’s device… nope!

iso1631 3 hours ago | parent | prev [-]

Sure, yet in the real world those are the acceptable means if you want your customer to continue to pay you when they've lost their phone.

4 hours ago | parent | prev | next [-]

[deleted]

[dead]