I can't use a passkey on a device unless I can install my password manager on that device and I am comfortable giving that device access to my passkeys. Passwords are simply unparalleled in their flexibility. You're never going to be locked out because <bluetooth, your TPM, your phone, ...> isn't working today.

I think the bit about TOTP was mostly a joke, the problem with passkeys is that they're billed as a replacement for passwords but they mix lots of MFA concerns in and make interoperability essentially impossible a lot of the time.

▲

johnduhart 5 hours ago | parent | next [-]

> I can't use a passkey on a device unless I can install my password manager on that device and I am comfortable giving that device access to my passkeys.

That's simply not true. I'm able to log onto GitHub on my corporate device using a passkey that's kept in 1Password on my iPhone.

https://bughunters.google.com/blog/passkeys

▲

lukeschlather 3 hours ago | parent [-]

That's fine if you've got a couple of supported devices. The hardware support is however very bad. If my hardware is unsupported (and most hardware in the world is unsupported) that's not very helpful.

	▲	WorldMaker 19 minutes ago \| parent [-]
		This "use a passcode from another device such as my phone" tech mentioned above is just Bluetooth LTE. Every phone and most laptops and desktops in the last decade or so has Bluetooth LTE support. Hardware support is very good. Passkeys are built on Webauthn (and ultimately sort of synonymous with it) and that has always been the web standard for all physical key support such as Yubikey and is basically the same as it has been for decades when dealing with Passkeys only with updated UX on top. Hardware support here is pretty good, too.

▲

Grombobulous 5 hours ago | parent | prev | next [-]

But you can be locked out if the provider decides you need to change your password after a breach, or you forget the password, or you enter the wrong password in too many times.

They’re both equally disposable. You can reset a password just like you can reset a passkey.

▲

true_religion 3 hours ago | parent | prev | next [-]

That's not really true, a QR code pops up, and you can use your other device to read it.

Even if your other device is a mainframe computer thousands of miles away, so long as you can photograph the QR code, you can decode it and send the data string for the passkey device needs to it.

The issue that many have with passkeys is that someone will tie a passkey to an ecosystem that they don't personally control like Apple's and then they can't get into their services without an apple device that's onboarded into Apple's ecosystem.

	▲	WorldMaker 16 minutes ago \| parent [-]
		The other device has to respond "in nearby radio space" via Bluetooth LTE when using the QR code bootstrap, but that's about the only requirement and it can be just about any device.

▲

jazzyjackson 4 hours ago | parent | prev [-]

> You're never going to be locked out because …

Yeah and neither will anyone else!