Supporting multiple passkeys should be a minimum requirement for every Passkey implementation. It's generally worth naming and shaming the websites that don't implement that correctly. People want backup passkeys. People want both iOS keys and Windows keys for the most convenience.

My general advice for non-technical users that seems to work pretty well is "sign up for new sites with passkeys on your phone" because most non-technical people trust the password manager ecosystem on their phone, have some amount of multi-device sync already established, and the QR code started Bluetooth LE flow on desktop/Windows PCs for sharing passkeys works easiest with phone passkeys.

(I run a tiny site that is Passkey Only for login and it's been interesting providing technical support for it. One of the biggest recurring issues at this point is nothing in the Passkey flows themselves but the fact that the Facebook in app browser does not support Passkeys for a number of presumably security reasons, plus Meta being jerks, and having to remind new users to "Open in External Browser" before signing up/logging in when posting links to the site in Facebook.)

> The idea and protocol are pretty solid, though we're back to a "biometrics as password" problem in many device flows

It's still just biometrics as "device PIN". The crucial difference remains that the biometric data never leaves your device. To support Passkeys the remote website only ever sees your Passkeys' public keys, they never see biometric data, they never have a chance to store biometric data in a database to violate PII/HIPPAA/etc standards when it inevitably leaks to "hackers" (or gets sold to the highest bidder).

This is the issue.

I can’t adopt Passkeys if I’m not certain they’re going to work as well as my password manager and Authenticator app, which is to say 100% of the time.

When sites ask to set up passkeys, it’s usually native passkeys (especially on iOS). And figuring out how to get the flow to set up a LastPass key by default seems unusually difficult.

I also use a MacBook, windows desktop, an iPhone and iPad. I use Firefox, edge, brave across these devices.

When I say “passkeys are a trap” they are a usability trap where no one can attest with certainty that I won’t wake up in a painful situation because I decided to adopt passkeys.

This is why I don’t like passkeys. I’m surprised the “use site from multiple devices” use case isn’t more common.

Am I nuts for accessing a site from both my mobile phone as well as from the multiple computers I use?

This also gets super messy when combined with multi-site auth services like id.me where I need to use the same login to access very diverse sites and services from multiple computers (eg, irs.gov, treasurydirect.gov, disburser.treasury.gov).

My takeway from “Passkeys are a trap” is that there are like four different approaches to something that everyone just calls “passkeys”, and they are not the same. For example, some are portable and some are not.

> Some sites, once connected via passkey, make it all but impossible to connect in another way.

That's the issue I had with Okta a few years back. I used a password then later added a passkey through Bitwarden on my work laptop. Bitwarden hadn't yet implemented passkeys for mobile.

I went to authenticate through Okta on my work phone. It prompted me for the passkey. Since mobile passkeys didn't exist, I got stonewalled. I had to make a blood sacrifice just to get Okta to allow password access again.

The trap is the ratchet towards attested hardware and closed-source-only implementations.

> You are not too smart to be tricked. Nobody is.

Maybe, but most websites I really dont care if my account gets hacked. I care way more about being able to login conveniently. Im just as frustrated with seemingly every single website wanting 2fa doing a 2fa check every week or less.

> Many people read that and say, "see, that's why I'm never going to use passkeys! I'm safer managing my own backups, and I'm too smart to be tricked into copying and pasting my password to the wrong site." But they're wrong. You are not too smart to be tricked. Nobody is.

It is not remotely difficult to not fall for phishing attacks. I think I've seen one in my entire life which was actually well crafted such that a person might fall for it even if he was paying attention. One. Everything else is the lowest effort slop where all you need to do is hover over the link to see "this does not in fact go to microsoft.com like it claims".

This may or may not help depending on how technical you are, but at the core a passkey works through public key cryptography, like SSH keys work. Setting up a passkey with a site involves sending a public key to the site, which they store as being owned by your account. Then, to sign in, they use your public key to generate a challenge, you use your private key to solve the challenge, and you respond proving you have the corresponding private key.

This means you never send your private key to the site, so if their database is compromised they only get a public key, which can’t do anything (it is public, after all)

No amount of phishing can get you or your client to hand over your private key, because there is no use case where that is required. There is no possibility of MITM, since your private key is never sent anywhere in any situation.

As for getting locked out of your account, losing your passkey would be the same as losing a password. You would need to follow the site’s password reset flow, and if you can recover from a lost password, you can recover from a lost passkey.

It doesn't help that the primary benefit we get from passkeys, in exchange for a lot of pain and fragility, is that phishing is harder to pull off. That's a big deal for a lot of people, but frankly, I'm not one of them. I already know not to click on links in emails.

I've never fallen for a phishing attack and any attack targeted and sophisticated enough to catch me is probably going to be sophisticated enough to steal/hijack a passkey anyway. In the extremely improbable event that I did get phished and somebody got into my account somewhere, they'd only have access to that one account because unlike most people I don't re-use passwords and recovery would no more complicated than contacting customer service and resetting my password with them.

Considering the horror stories of people who been screwed by using passkeys, I'm sticking with "not worth the trouble"

They are tied to the issuing domain and the system that carries the passkey will refuse to present it to any other domains. It’s more or less impossible to fall for phishing or a spoofed site. Your password manager may have similar functionality for automatic filling of forms but less sophisticated users can often be tricked into providing passwords via copy and paste.

Bull. People need to stop repeating this.

They have to be transmitted. They (or their hash) have to be stored. And so so many get that wrong.

There is nothing to prevent you from entering your super secure unique password on the wrong site if you get phished.

Passkeys don’t get transmitted. They’re used for cryptographic signing.

Passkeys can’t be entered on the wrong site, the sites they work on is an inherent property of the key.

You can’t store a passkey wrong on the server, it’s a unique public key. If your entire database is stolen, it’s useless. No one else can login with your credentials because they don’t have the private key.

Unique strong passwords, TOTP, 2FA, one time sign in emails, none of those offer this stuff.

Passwords are fundamentally broken. They cannot be fixed. Cryptography is the solution in passkeys are the implementation.

A decent degree of phishing protection. And passkeys are not vulnerable to an attack that can transiently read server memory.

AIUI: A password can be entered into a phishing site, a passkey can't.

As I understand it, in theory, there is no "secret" exchange over the network with passkeys, once they are initially set up (one side sends a challenge to decrypt, and the challenge is one-time use. The decryption all happens locally.) And so they aren't as vulnerable to phishing or other common ways to steal passwords (such as key loggers, which don't even involve the network.)

But in my opinion, the solutions that passkeys provide come with the costs that are being discussed here, and I haven't found the trade-off worthwhile.

--------- Oct 14 - 12:30pm... --------- There is a wall of text below your question and _none coherently, concisely answer your question: "What do passkeys offer users that rand strong password + password managers don't?"

Passwords always risk a transferrable oops: "Hi friend, this is the bank calling. We've got a big issue: what's your password so we can fix it?"

Agreed. They put someone else between you and your access, between you and your security.

Lets give the guys at the Home Depot all the keys to our super secure house locks. Any time you want to get in, just roll down to one of 5 convenient locations, authenticate with the HD, and they will issue you a one time entrance pass to the house. Easy.

Bullshit.

I think this is exactly the "Passkeys are a trap" argument though right? If you lock yourself into a single vendor, everything is easy and beautiful. If you choose a diverse set of vendors, it sucks so much more than passwords and password managers ever did.

As a Bitwarden (and Vaultwarden) user on Mac/iOS/Safari, Linux/Firefox and Android I have had zero issues with passkeys since I started using them a few years ago.

The first two accounts I switched over to passkeys were my Nintendo and Playstation Accounts as it made sign-in much smoother.

I now use passkeys pretty much everywhere I have the option (at least on high value accounts such as Amazon) and I have not once had an issue. Not having to use a TOTP (or worse an SMS or email based one use code/link!) is much nicer in my personal opinion.

Some sites have a much better designed on-boarding process than others I 100% agree there. I find the sites that do a poor job with their passkey enrolment are the same sites that also did a terrible job of 2FA/MFA setup as well though.

One blessing with passkeys is since I set it up for my mother with her Amazon account she has not once had to ask me to help me reset her password. At least once every 6 months I would have to help her sort things our as she would forget it, reset it and then forget what she reset it to and can't reset it again as she hadn't clicked to update the password in her password manager so it had an old or incorrect password, etc. Always a pain to sort out. Not happened once since switching her to a passkey which is wonderful for me.

Also it is essentially impossible for her to use the passkey on a fake site. Multiple times she has fallen for phishing emails with realistic looking site logins and she would just blindly enter her username and password as many elderly people do.

Both of my systems are apple, one has a Work Apple account and one has a Home apple account. How do I log into website X with 1 identity WITH FIREFOX? (people are going to jump through hoops when they find out my work laptop blocks mozilla services when I can just use a TOTP token on my phone and everything works.)

>Thankfully, for folks all in on the Apple ecosystem, it should be pretty decent of an experience.

How many people are for now and forever more all in on the Apple ecosystem. You never have to login on another non Apple device ever?

I use 1Password to sync all my passkeys between iPhone, Mac, and Windows. It works exceptionally well!

But you can’t simply switch to Android without recreating every single passkey. Sounds like vendor lock-in to me

> But I also feel like it's time to retire my YubiKeys ...

Why, specifically?

You act as if the experience on Windows is the point of Apple's password manager. I'm not surprised the experience is pretty bad -- as far as I can tell, accessing the passwords and notes is pretty much the only thing you can really do on Windows, and the user experience is significantly impaired compared to Apple devices.

(For example, it only stores the passwords in memory and never persists them locally in any form, because there's no way to secure that, so it has to redownload them from scratch every time you open the app. It also only supports proper Windows Hello PINs rather than normal account passwords, because that's the only way to get proper hardware backed cryptography locked behind authentication, etc. It's a mess)

Same. Fully agreed.

New and interesting ways to get locked out of your system.

Passkeys only make sense if multiple passkeys are supported. What if I lose my Fido key? One issue here is that passkeys don’t have a clear role. If they are replacing passwords, only, then they are 100% an improvement even when not hardware backed, but you still need 2fa. If they are hardware backed, you probably don’t need a second factor and different sites see different roles. Assuming I can setup a backup key, hardware backed covers all of sites’ misconceptions, though.

That's part of the horrible experience I hate. why should I have to have my phone to login on my computer.

Adding the kind of sharing it sounds like you are describing would just shift the attacks to that new attack surface. The attackers would basically try to trigger and intercept those shares.

If machines, browsers, phones etc are set up properly (yes, I know, big ask, especially with the confusion surrounding this, so I acknowledge the caveat), then the vast majority of passkey requests will go right into the preferred method (i.e. 1Password, Bitwarden, even Apple, browser of choice, etc). And most of those now will allow that passkey then to be used on a different device if signed in and synced.

I have found it to work pretty well with a password manager. I would suspect OS level passkeys would be much less "portable", especially across different manufacturer devices, like Mac/Windows, or even Windows/Android, etc. Which is why I waited to start using passkeys until I could use a password manager to store them, and I turned off all other passkey storages (same as I did for password storage before).

Only if the website allows you to use Bitwarden for the passkey.

That's because we are still in the "barely lukewarm" stages of boiling the frog

The objection here isn't to something that uses public keys instead of TOTP. It's that they added support for remote attestation to passkeys, which an enormous red flag and enables That Which Is To Be Prevented, i.e. permanently entrenching the incumbents because many third parties won't support new device makers with no user adoption yet and users won't adopt a device that won't work with many third party services.

Moreover, the large majority of ordinary people are going to use whatever comes with their phone anyway, which can then lock the key in the device's secure processor by default independent of remote attestation. So then it's not getting you anything for those people and the primary thing it does is to impede Linux Girl from using Linux and anyone new from ever trying to create a competing mobile platform or even a usable non-Google fork of Android.

The obvious way to satisfy people is to remove support for remote attestation from the spec.

That it’s possible to know the answers to these questions doesn’t mean the system is good. This is a level of complexity that most people simply do not have the time or bandwidth for.

>>users who want choice have to take responsibility, users that don't can just use Apple

I'm perfectly happy to take responsibility — when using a well-designed system that isn't a massive pain-in-the-arse up front designed for vendor lock-in and to penalize small vendors.

Criticizing the new system isn't avoidance of responsibility, it is demanding a product that is worth using, i.e., NOT designed for the manufacturers to extract more money from us without providing more value or locking in their market position, but designed to be actually useful to the people who will actually use it.

EDIT: add last 8 words