I respectfully disagree with the author!

Passkeys have been a massive quality-of-life improvement. Yes, there's the minimal risk of lockout if you lose access to the passkey (though almost every site I've used that implements pk's lays it on top of their traditional user/pass auth flow), but generally speaking most people use iCloud or their Google account to store their passkeys, and because those sync everywhere, this isn't a real risk.

I love not needing to deal with 1Password's autofill being flakey and having to CMD-C/CMD-V passwords/passphrases/OTPs on these sites.

I like Yubikeys as well but they are super inconvenient by comparison when dealing with multiple devices. Setting them up is also very user-unfriendly in general; doubly so compared to passkeys.

Now, what I'd REALLY F'IN LOVE to see go away is the passwordless/magic link auth flow wherein you authenticate by clicking a magic link that gets sent to your email or text message inbox.

"Emails are super easy to hack and we're still not sure whether text messages are safe to send on US carriers, so let's have everyone click on a link sent by email or text so that they don't have to deal with those pesky passwords that iOS or Android will automatically suggest for them." Like, what?

> Emails are super easy to hack

Source? And if somebody hacks my Gmail account, won't they be able to access my Google-synced passkeys?

Magic link auth isn't any less secure than any site that has a password-reset flow.

> what I'd REALLY F'IN LOVE to see go away is the passwordless/magic link auth flow

This seems really naive? That's the only flow that's at the basis if you get locked out. What else, do you put people on the phone to verify people by asking their name and date of birth? That's even worse!

Majority of websites use email to authenticate (“forgot password” flow). Passwords/passkey is just an optional convenience for quicker login.

To the day where your device breaks, you had set a passkey to access your Google account (because the phone did prompted it up and you did not understand and clicked yes), you did not setup a recovery method (such as another email/SMS) or you did setup a recovery method that still depends on the Google passkey access (e.g. a second email account where you sign in with Google or has Google as a two factor verification!) and you are locked out of your Google account. Good luck at that point contacting Google assistance, you may as well consider that account as lost forever since there is no way to talk with an human being.

And unfortunately is something I start to see to family members/friends that are not tech experts when they ask me to setup them up a new phone... at least the passwords they would have written them in some notebook that they had at home, or always used the same for everything, but with passkey... and when you tell them that they lost access to their email, possibly the files backed up to Google Drive/Google Photos, etc they are surely not happy.

Also passkeys makes it difficult to get access to your account in an emergency scenario, what if I loose my phone and I'm not signed in to other devices? Maybe I've setup an SMS as a recovery method, but first I have to get to my phone company to request another SIM card, maybe I'm on vacation on the other side of the earth in vacation for 2 weeks, I'm locked out of my Google account, and from all accounts that uses the passkey as a sign-in method (including, for example, the account that I need to use to check in on my return flight, or my banking app that I need to pay stuff!)

Low risk of lockout, but about as high-severity as one can imagine. Yes in theory sites should offer a password fallback, but how many actually do? And of those that attempt it, how many get it right?

Not even Google reliably lets you fall back to a password, according to the comments in this article. Losing access to your google is anywhere from major inconvenience to professional disaster.

Expecting every user (site using passkeys) to implement complicated flows is a time-tested recipe for disaster, and it's a bummer to see that unfolding yet again with passkeys.

> and because those sync everywhere, this isn't a real risk.

Do they sync between Android and iPhone devices?

I'm in the same spot. It seems like every month a post pops up here that's "I hate passkeys" and most of HN seems to agree.

I use 1Password, but passkeys have made things even easier. I'd rather have them than any 2FA method. So many websites make me use a login/password AND then send me an email or text with a code. Every. Single. Time. You're really telling me you would rather do that than have a passkey?!

And, like you said, passwordless email auth is really terrible.

> Yes, there's the minimal risk of lockout if you lose access to the passkey (though almost every site I've used that implements pk's lays it on top of their traditional user/pass auth flow)

Exactly, if you lose your passkey you just sign in with your password like you did previously. I'm yet to find an app/website that has passkeys only and no passwords.

Seems like a total non-issue to me.