> Yes, there's the minimal risk of lockout if you lose access to the passkey (though almost every site I've used that implements pk's lays it on top of their traditional user/pass auth flow)

Exactly, if you lose your passkey you just sign in with your password like you did previously. I'm yet to find an app/website that has passkeys only and no passwords.

Seems like a total non-issue to me.

▲

morgoo 3 hours ago | parent | next [-]

One of the big benefits of passkeys is that you can completely remove the ability to log in with a password!

▲

tcoff91 2 hours ago | parent | next [-]

Just spitballing here, but it seems like a good mix of phishing resistance & lockout recovery would be to have passkey-only auth, but with email recovery.

So no password login, but then you can recover your account by adding an additional passkey by receiving an email.

▲

jayknight 2 hours ago | parent [-]

Just make sure you don't lose the passkey to log into your email.

▲

Synthetic7346 an hour ago | parent [-]

Isn't it the same as my password manager's vault? I only remember my master password so if that vault is lost I can't even log in to my email

	▲	jayknight 30 minutes ago \| parent [-]
		Kind of, but I have some of my most important passwords and account recovery codes duplicated on paper in a secure place. If there was ever a service that only allowed passkey login (do those exist?), you can't print those out.

▲

nunez 41 minutes ago | parent | prev [-]

I wouldn't be okay with that. Say you're setting up a new iPhone with a new iCloud account because you forgot the password to your old one. (Unlikely scenario amongst us nerds, but very very likely outside of our bubble.)

If you want to log into, say, Google, but the passkey flow is the only way in, then you're almost-completely SOL unless you have some way of getting the passkey out of your iCloud keychain and into the keychain of the phone you're setting up.

If you still have your old phone, you can scan the QR code and get in that way. If you don't, then you're completely SOL.

▲

epihelix 2 hours ago | parent | prev | next [-]

Ok, so the big security risk that passkeys are supposedly designed to stop, is actually still there?

If you can still be phished, remind me what the point of any of this was, again?

▲

2 hours ago | parent | prev [-]

[deleted]