7/22/2026 at 2:59:40 PM
I do not know how to use a Passkey in a way that won’t impede how I log in to systems. I’ve been in tech for 26 years, and I understand the Public/private key behind what a Passkey is. Here’s what I don’t understand:I access a website through at least four different devices (my iPad, iPhone, Windows Desktop computer, and MacBook Pro) and three different browsers on each device (Brave, Firefox, Safari) , and I use LastPass. If I accidentally set up a passkey on my phone (let’s say I use Safari one day instead of my go-to, Brave), can I still log in without that passkey on other devices? Is there a way to ensure that passkey can be used on other devices? Can I add another passkey on another device? How many passkeys can I set up for a particular site/app? I have at least 6 different combination of browser/devices in use.
I don’t want to use Passkeys because I don’t the answers to those questions, and I don’t know whether each website/app that has set up Passkeys has decided the answers to those questions in the same way as the others. For now, I’m going to stick with LastPass and use Passwords; because no matter whether I lose my device or not or whether I’m on my own devices or not, I can be sure I’ll be able to get into a site/app.
Edit: One final consideration, my spouse and I share user/name passwords for some things (notably Pandora and our Amazon Prime account) since they don’t handle things like family logins well; how do both my wife and I use amazon or Pandora with passkeys? Do we each set up passkeys? How do I get her Pass if that’s not an option?
by gortok
7/22/2026 at 5:22:13 PM
A potentially good idea got corrupted by vendors, password managers, browsers, etc trying to assert control. I'm also an engineer and I find the UI around passkeys entirely unclear, but it doesn't have to be that way. It seems like everyone wants to be _the_ password manager for all your passkeys. They don't want to make it easy to understand that is what they are doing though, they just happily offer to "handle it for you".My non-technical friends are extremely confused by passkeys and if they should use them and how to use them and I honestly don't have very good answers. It is a mess. I don't believe an inherit mess, but one created by the companies and projects trying to take advantage of the new system.
by thecombjelly
7/22/2026 at 6:22:28 PM
> It seems like everyone wants to be _the_ password manager for all your passkeys.Which defeats part of the point of passkeys in the first place in that they are supposed to be device-bound, the private key held in the TPM or secure enclave or whatever other security chip, mathematically non-exportable. Storing all your private keys in a cloud vault still leaves you exposed to potential credential theft if your vault gets compromised.
Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey).
by thewebguyd
7/22/2026 at 6:55:58 PM
> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey).
1) When I buy a new device, how do I create 2000 new Passkeys for that device?
2) Can I still do that if I don't have access to the old device? Maybe it was destroyed, stolen, or lost.
3) How about if the new device is from a different vendor than the original device? E.g. switching from Apple to Android?
by dotancohen
7/22/2026 at 9:57:56 PM
The original U2F tokens didn't suffer from this problem that much. It contained one secret, it relied on the website to store and return an opaque website-and-account-specific blob, which was decrypted by the token and used to sign the login request. It would be reasonably easy to expand this in a way where the server also stores a backup credential for use by your second/third/whatever hardware token, encrypted with an asymmetric key during the enrollment of the primary token.But this went out of the window when some genius decided that usernames were too complicated, so Passkeys had to be discoverable, which means they have to be fully stored token-side. Which of course has the nice side benefit of essentially killing hardware tokens and forcing people into using their Android/iOS/Windows device for it.
by crote
7/23/2026 at 8:02:57 AM
This. I would have loved if this original u2f existed. Google has even removed this from their accounts.by omnifischer
7/23/2026 at 3:05:12 PM
> But this went out of the window when some genius decided that usernames were too complicated, so Passkeys had to be discoverable, which means they have to be fully stored token-side. Which of course has the nice side benefit of essentially killing hardware tokens and forcing people into using their Android/iOS/Windows device for it.This part of your comment is incorrect. Discoverable Webauthn absolutely can be used with hardware tokens like Yubikeys.
by chimeracoder
7/22/2026 at 8:29:42 PM
Passkey comprises of public key that the website you created it on holds, and the private key you store on your pw manager or in the TPM/secure element. As long as you can copy the private key to the new device, you don't need to recreate the whole passkey. In your case, you would just need access to a backup of the Keepass database in case you lose the device.The biggest point of confusion in my opinion comes from Windows especially having lacked a way (and kind of still does) to save the private key of a passkey to your password manager, defaulting to saving it to Windows Hello, which saves the private key to your PC's TPM. In this scenario you can no longer easily copy the private key to other devices, and if you lose that Windows PC, you also lose the private key and the whole passkey as a result.
by Itoldmyselfso
7/22/2026 at 9:20:42 PM
People who say users should not be able to export keys are not confused. They believe users should not be able to export keys.by pseudalopex
7/22/2026 at 9:37:08 PM
I was referring to confusion experienced by people new to the passkeys creating passkeys for the first time ("Where am I saving this to?", "How do I store this in my password manager?").by Itoldmyselfso
7/23/2026 at 2:26:43 AM
You don’t. You don’t store anything at all.On registration, a keypair is generated, then the private key is encrypted with the long-term key burned into your security key fob or hardware. The encrypted blob is sent to the server and stored there.
On authentication, after you enter your login, the server sends the encrypted blob and your security key tries to decrypt it with the long-term key it has. If it succeeds, it then request a challenge from the servers, signs it along with the server name and timestamp and sends back to the server. Server validates the signature and if it’s good, log you in.
Expanded: As long you as the user has the security key fob, you can login. You should have 2.
by ivlad
7/23/2026 at 3:36:25 AM
> You don’t. You don’t store anything at all.Yes, you do.
Whenever a website offers to create a passkey, it could end up in any of these:
- Samsung's Password Manager (if using a Samsung phone)
- Apple's Keychain (if using an iPhone)
- Google Password Manager
- Your operating system's keychain
- A bespoke password manager (e.g., Bitwarden or LastPass)
- Your hardware key
Most users do not have a security key fob. Instead, the proposal being mostly pushed is the idea that users can store keys on their own smartphones, making use of the modern TPM and chip security. Most of the discussion here revolves around that idea: "What if I lose my phone? What if I switch phones?" and that's why the problems seem so obvious to you.
I absolutely agree the best solution is to use hardware keys, but I'll admit it's cumbersome if I need them for hundreds of accounts (which I do have), having to register both for every website and praying that I never lose both at the same time in the case there's no viable recovery flow for some of the accounts. Also, most of these hardware keys are limited to 25 or 100 resident keys, which again makes them unable to substitute passwords. Observe the usage of the term resident keys: passkeys do rely on the private key being stored on the hardware key, as that allows discovery.
by doodlesdev
7/23/2026 at 9:53:56 AM
I was talking about the non-resident FIDO keys. “Passkey” term is meaningless unfortunately because FIDO Alliance did not define it initially, it was a marketing term invented by Apple and then re-introduced (or shoved down the throat) by the FIDO alliance.In non-resident keys scenario you don’t store anything and from what I see there is no security downside of using non-resident keys.
Loosing both (or multiple) security keys is like loosing all your car or home keys. Very inconvenient, agreed.
Anyway, I think we can agree that FIDO authentication protocol implementation is a mess. Apple and Google made it messy because they wanted to lock down users to their platforms and then password managers followed. As a result, the current implementation is not more secure than “login with Apple” or “login with Google”.
by ivlad
7/23/2026 at 5:57:36 PM
I agree!Indeed, the only advantage to Resident Keys (i.e., Passkeys) is the discoverabillity of them, so you can login without even using a username. It's a shame all of the terminology around WebAuthn/FIDO2 and Passkeys is so loose and badly defined.
Honestly, I think OAuth logins are still an ok option for the average user, unfortunately, as I would never recommend someone I love to use Passkeys and put them through the burden of having to understand and deal with all of this mess.
by doodlesdev
7/23/2026 at 5:46:02 PM
I have to think people aren't doing any research. Both Android and Apple sync your passkeys to your account. You can toss all your devices in a wood chipper, buy a replacement and still have access to all your passkeys.by zdp7
7/23/2026 at 5:53:05 PM
Yeah, they do. But what if you want to move from Android to iPhone or vice versa? That's the big problem regarding these keychains/password managers. Some of them didn't even allow you to export your Passkeys until a few months ago, meaning you were literally locked into their platform.Remember that your average user has no idea what a passkey is, doesn't remember half of their passwords and has no idea what a password manager is.
by doodlesdev
7/23/2026 at 7:41:43 PM
If you want to change it maybe tough. It doesn't have to be. Bitwarden has an open source self hosted option(you can also use their service), that can be set as provider in Android and Windows 11. KeepassXC is an option everything is in your kdbx file. Passkeys are so much more convenient and secure. If you do get stuck having to migrate, you can use your password (I would actually prefer just using multiple passkeys.) You don't need to do them all at once. Your average user is probably using whatever their device offers or nothing at all. I'd argue anyone that is tech savvy shouldn't be using either Google or Apple. If your account is disabled, you probably just lost anyway to retrieve your account unless you use a separate email address. I recently discovered cross device auth when a device I had a passkey was able to open my account on my pc that didn't have a passkey. TLDR ther are simple solutions that solve the 'lock in' issue.by zdp7
7/22/2026 at 10:02:44 PM
dotancohen would not be allowed to store Passkeys private keys in a Keepass database in the case thewebguyd specified. Relying parties would block password managers which allowed this.by pseudalopex
7/23/2026 at 4:29:45 PM
1) Install a keepass client and use it for passkeys.2) See #1
3) See #1
KeepassXC supports passkeys. They suggest a couple mobile apps that also do.
by zdp7
7/23/2026 at 6:00:39 AM
[dead]by baybal2
7/23/2026 at 6:43:03 AM
> Let's assume that they were all Passkeys.Lets assume I put all the effort to explain.
I will give you a better example.
- Lets say you have a google account with pixel phone
- You are using it and added 1000 passkeys
- All are synced to your Google account
- Destroy and Get a new phone. Login to your google account with recovery code.
- All your passkeys are in your phone again.
There are plans in fidoalliance.org to make it portable. Pretty sure you are still not going to move to it.
by ilchalpenl
7/23/2026 at 7:19:21 AM
It works fine until Google suddenly decides that your new device is not you and asks you to confirm login from previous device...by sandmn
7/23/2026 at 8:04:05 AM
Or until Google decides that you did a wrongthink and bans your account, including locking you out of your old phone.by account42
7/23/2026 at 10:17:40 AM
[flagged]by marysol5
7/23/2026 at 7:37:18 AM
See.. the sad thing for doomsayers like you is that if even 1% of users were affected then there would be mass exodus from Gmail. It does not.Yes, you don't use Gmail so it does not matter. You may be don't know. And often even average Joe some how has a oldphone or iPad that has oldgmail account there or logged into wife's phone or phone based SMS whatever.
it is ok to hate passkeys or google or love only self-hosted but let others do what they want.
I have been user of solokeys (since the first one) - only opensource hardware keys. works for me...
But if you go to the local highstreet then there are tons of people doing this screenrepair etc just to recover the account. Average Joe doesnot mind paying for that. Even will give the repair guy full password to transfer all data from old to new phone.
by ilchalpenl
7/22/2026 at 7:15:53 PM
Apple's keychain or google password manager - can hold 2000 passkeys easily.by ilchalpenl
7/22/2026 at 7:39:27 PM
Nothing in the post you're replying to is about "is 2000 passkeys storable", it's about "if I have 2000 passkeys and I need to move between an Apple device and an Android device, do I need to establish a second set of 2000 passkeys"?by blochist
7/23/2026 at 6:23:12 AM
Not at the moment. But if you sign into google account in iPhone then you can use Google's passkeys in iPhone.At the end, passkeys are built not for the tin-foil, (I hate Google Apple fellows), I want to keep every single locally, RMS fans. No.
A majority will benefit. End of matter.
A majority don't change platforms (I have not seen them do it).
And lets be honest - even if they were portable are you privacy person that is going to do it? No.
by ilchalpenl
7/23/2026 at 1:13:33 PM
No, the majority will not. If through some miracles, passkeys gain sudden and wide adoption, there will be a day of reckoning come around the next mobile refreshment cycle, maybe earlier.People break their phones. That is normal experience. Entirely unsupported by passkeys as they are today.
I'm actually surprised we didn't have more pushback for ubiquitous 2FA, as they have similar threat profile - i.e. addressing the tin-foil threats of cybersecurity aficionados, while entirely ignoring the common threats to real people, in particular the one of broken or lost mobile device.
by TeMPOraL
7/23/2026 at 6:25:24 PM
Incorrect. They break but they fix it.People break their phones less often compared to telling them keep their keepassdatabase in sync across devices.
Even recently my friend fixed his iPhone XR (10 year old) 3rd party. Everything including passkeys work fine.
by coffe2mug
7/22/2026 at 9:55:09 PM
No you don't. I use the same passkeys for all my devices sync'd with bitwarden.by nightski
7/22/2026 at 9:59:22 PM
Exactly. Bitwarden, not the Apple/Google/Microsoft keychain. That's the problem.by crote
7/22/2026 at 7:37:56 PM
Did you not read the comment thread you're responding to?by Petersipoi
7/22/2026 at 8:27:09 PM
Dunno why the downvotes, if you're willing to trust Apple or Google this is a good method for passkey usage. because your touchID/faceid/opticalid auth gate the keyring's on either of these vendors your passkey works without having to migrate them. EDIT: Also ANY device that you add to your iCloud has access to the passkeys you've made... it's a dream for secure access.by chews
7/22/2026 at 10:24:01 PM
What happens when the user decides to move to an Android device, or even is suspended from Apple for a suspected breach of the terms of service, or Apple decides to not support their country anymore? There are countless reasons to prefer to manage one's own access.by dotancohen
7/23/2026 at 6:32:03 AM
True... Theoretically correct but in practical sense?All these doom mongering of suspension happens so rarely that majority don't care.
There are countless reason to DIY. Agree. But passkeys will help the majority.
Also note that the kind of people - like journalists etc - that need to use DIY/local are the ones that are likely to use passkey. Reality.
by ilchalpenl
7/23/2026 at 6:27:52 AM
Downvotes does not matter. People here that are privacy inclined always find ways to argue about Google or Apple (any major companies). But if you look at their private lives - they adopt tech ASAP. A majority have Apple Pay or Google Pay. Paypal. At the same time use bitwarden also. (And that is fine)These privacy zealots fail to realise that majority of population does not have time to setup bitwarden server or lineageos or zfs storage etc.
by ilchalpenl
7/22/2026 at 8:47:10 PM
The downvotes are because the commenter did not read or at least did not fully comprehend the meaning of the post they were responding to.by fugalfervor
7/22/2026 at 6:42:15 PM
> Which defeats part of the point of passkeys in the first place in that they are supposed to be device-boundIf you watch the original Apple WWDC talk presenting passkeys, you will find that they were always intended to sync, at least for the consumer use-case.
What you are describing is how the WebAuthn standard had been implemented by Yubico and Google up until the point of the introduction of “passkeys” by Apple.
The reason passkeys have their own name and definition is because they are meant to be a phishing-resistant primary factor that competes with the UX of passwords. And a great usability trait of passwords is that they’re convenient to use across all your devices. With a technology involving public/private keypairs, the only possible way to compete with that UX is to sync the private key across the user’s devices.
by jesseendahl
7/23/2026 at 12:42:48 AM
> The reason passkeys have their own name and definition is because they are meant to be a phishing-resistant primary factor that competes with the UX of passwords. And a great usability trait of passwords is that they’re convenient to use across all your devices. With a technology involving public/private keypairs, the only possible way to compete with that UX is to sync the private key across the user’s devices.Another way would be auto-enrolling passkeys from other devices you own through a standard API. Enroll your trusted Apple device in your Google Account's settings, or your Bitwarden/KeePass, and vice-versa. When your iPhone creates a passkey at a site, iCloud notifies Google, which issues a new passkey and sends the public key to iCloud, which auto-enrolls it at the site alongside the iCloud passkey. BitWarden gets the same treatment. When you open your KeePass vault it checks Google and iCloud and picks up any pending offers for passkey enrollment and completes them.
Simple, secure, opt-in, and users control their devices and passkey vaults with minimal hassle. If a device is lost, the other services can help you automatically delete the compromised passkeys and set up your new replacement device.
Matter does something very similar with cross-compatibility between Apple and Google (and the rest of the ecosystem) when new devices get enrolled with the user's choice of PAA; the only thing missing is roughly cross-PAA enrollment but that would be just one additional trivial trust relationship in both ecosystems.
by benlivengood
7/23/2026 at 6:14:27 AM
I like it.The high level UX of this idea feels very compelling to me as a "yes and" -- aka a world where vendors continue to offer end-to-end encrypted syncing within an ecosystem, but then this idea gets layered on to solve the cross-ecosystem problem. I think the trickiest part would be how to do it in a privacy-preserving way, but that's solvable.
by jesseendahl
7/22/2026 at 9:29:58 PM
> the only possible way to compete with that UX is to sync the private key across the user’s devicesThis is my issue with passkeys. Either we lessen security to improve UX (syncing across devices implies extracting private keys from secure enclaves, at which point it’s no different to password syncing), or we have a proliferation of different keys per website across devices (assuming the website supports multiple passkeys).
Perhaps this trade off is not resolvable in a way that happily satisfies both the security constraint and the UX requirement.
by phs318u
7/22/2026 at 9:59:21 PM
"A better version of password syncing" is exactly what Passkeys are and ought to be. Just like passwords, but unphishable, unguessable, not reusable across sites, not vulnerable to data breaches, and with better UX.Stranding private keys in clone resistant secure enclaves has unacceptably bad UX for the average user, which is why very few implementations try to do that.
by Ajedi32
7/23/2026 at 2:37:31 AM
So just a password manager?by inigyou
7/23/2026 at 6:17:47 AM
Passwords are still significantly less secure than passkeys even when using a password manager.by jesseendahl
7/23/2026 at 9:09:27 AM
Why?by inigyou
7/23/2026 at 11:37:55 AM
Passkeys cannot be stolen. Yes, don't say that what if someone steals my iPhone, PIN, and adds their fingerprint.Let's say eBay asks user to login. With passkey. Press and hold fingerprint etc. login done. Even with laptop.
And average Joe doesn't want to maintain a keepassdatabse sync it. Yes, you can always use your own server etc but others have life.
by coffe2mug
7/23/2026 at 11:56:41 AM
how do I back it up and transfer it to a new device? This is relevant because an attacker can also do that.by inigyou
7/23/2026 at 12:11:00 PM
Buy a new iPhone. Sign into it. Everything is now available.That is the reason: for the average Joe not having exportable passkeys is good.
Average Joe doesn't have to do backup. It is all automatic.
by coffe2mug
7/23/2026 at 1:31:20 PM
Because as I just outlined, passwords, even when stored in a password manager, can be misused. (Phished, set to something weak/guessable, reused on multiple sites, leaked in a database breach, etc.)Password managers make it easier to avoid those pitfalls, but passkeys make it nearly impossible to fall into them.
by Ajedi32
7/23/2026 at 1:16:12 PM
It's still ignoring one of the main features of passwords for regular people, which is authority delegation via password sharing, aka. "could you please log in to my ${service} and do ${something}, my password is ${password}...".Yes, that is a feature and a normal use case that has equivalents in meat space, that security aficionados refuse to recognize even exists, much less support.
by TeMPOraL
7/23/2026 at 3:53:20 PM
Not only that, they don’t need to worry if they lose their phone they’re locked out of their accounts too!by lazide
7/22/2026 at 10:00:26 PM
> at which point it’s no different to password syncingYou still get the phishing resistance, though!
by crote
7/23/2026 at 1:26:01 PM
Is the "phishing resistance" just inability to view and manage your own data? That's a bug, not a feature then.by TeMPOraL
7/23/2026 at 1:47:17 PM
Downloading and keeping safe local data is a bug for othersby coffe2mug
7/23/2026 at 4:34:47 AM
Password managers prevent phishing as they check for the domain name before inputing the password.by choo-t
7/23/2026 at 6:20:11 AM
Password managers do not architecturally, cryptographically make phishing impossible. Ultimately a user can still be tricked to copy/paste their passwords into fake websites, even when using a password manager. You could blame end-users for this behavior, but attackers don't care about blame. Ultimately, it doesn't matter who's at fault when there are massive phishing attacks happening at scale every single hour of every day. The only real solution to solve this problem for the entire internet is to make credentials architecturally, cryptographically unphishable by design. That's what passkeys give you.by jesseendahl
7/22/2026 at 6:29:18 PM
Right; but THAT idea is consumer hostile by design.So your account is now tied to a physical device; great, but the device is dead, or you own a dozen devices, now what? Each vendor has their own idea about what THIS means. Heck I have a couple that allow, max, a single Passkey at a time.
by Someone1234
7/22/2026 at 6:43:51 PM
> Right; but THAT idea is consumer hostile by design.No argument from me there, just stating what the design actually calls for.
It was never meant to be consumer friendly in the first place, it's an enterprise standard. It was just shoehorned onto consumers with the synced credential compromise to make it easier, instead of coming up with something better, and then just calling it a "Passkey" which now has dual meaning.
But the real solve is difficult. If a system requires a consumer user to manage, remember, or safely store something extra, it will fail.
by thewebguyd
7/22/2026 at 7:10:40 PM
The FIDO set of standards (UAF, U2F which predated passwords and passkeys) haven't even started as enterprise standards. There are multiple origins for what became FIDO, but the main ones I know are:1. PayPal was looking for a physical authentication solution for their users, Michael Barrett was their CISO at that point and he became the president of FIDO.
2. Google developed Gnubby (which was internal, and therefore enterprise) and they wanted to push a similar authentication to their end-users, supported directly on Chrome. They wanted this to become a standards, so donated the underpinnings of the Gnubby technology which became FIDO U2F.
I might be wrong but at least these are the two parts I know.
And while the original FIDO could be called dual-use, Webauthn and especially Passkeys were developed to be first and foremost a customer-facing standard.
It doesn't mean they are not confusing, but they are clearly designed with end users in mind.
by unscaled
7/23/2026 at 10:18:56 AM
Eh, PassKeys are consumer friendly by virtue of allowing the keys to be synced across multiple devices. That actually breaks some of the security of it for the benefit of the end user.No end user wants to export and store a keychain. So they hand that off to somewhere else.
by marysol5
7/22/2026 at 7:03:16 PM
> Every device is supposed to have its own unique private key, stored in TPM, released only when passing the user challenge (biometrics or pin, or a yubikey).This is a misconception. A particular service can choose to enforce those class of passkeys, but most don't need that and shouldn't.
Passkeys are primarily meant to replace passwords and be hard (but not necessarily impossible) to exfiltrate.
The key difference is during normal usage you don't have to type the secret in anywhere, it's strictly asymmetric, so a unwitting user is far less likely to get fooled into accidentally leaking the actual credential.
by packetlost
7/22/2026 at 7:27:46 PM
Passkeys is basically a brand name for "discoverable credentials" (a Webauthn term). They do a little more than that technically, but in practice their purpose is what you said. Replace passwords. Or more accurately usernames and password pairs. This is in contrast from 2FA, but even before Apple started marketing Passkeys the FIDO standard supported the concept of Passwordless authentication, alongside 2FA.Passkeys came together with multi-device syncing when Apple introduced them and IIRC it was pushed as their killer feature by Apple back then, but passkeys can also be completely device-bound. The marketing around this was all quite confusing, but it's a bit too late to fix now.
What we got, as far as the average consumer should be concerned, is that "passkey" is any authentication mechanism (not the actual credential) that can replace a password. And it's still confusing.
by unscaled
7/23/2026 at 2:38:18 AM
I think in Apple stack they cannot be made hardware bound anymore. Platform claim is ignored on creation and the keypair is always in Keychain and syncable unless iCloud sync is disabled.by ivlad
7/23/2026 at 10:19:46 AM
Lest we forget that enterprises have had passwordless auth long before any of thisby marysol5
7/22/2026 at 8:45:41 PM
> Passkeys are primarily meant to replace passwordsUnfortunately, the designers of passkeys decided they should replace passwords and usernames and second factors.
Also they decided they should be cloud-synchronised, so the something-you-have second factor doesn't impose the burdensome requirement for you to have something, which was apparently a big usability problem.
by michaelt
7/22/2026 at 11:36:57 PM
> Unfortunately, the designers of passkeys decided they should replace passwords and usernames and second factors.They obviate the need for a user identifier as the key is itself unique, but removing the 2nd factor is a choice of the service, not the designers of the Webauthn standard.
> Also they decided they should be cloud-synchronised
The earlier versions of the spec required that the keys be resident in hardware, but it was updated to allow "roaming" keys. The important part is it's up to the service to decide on whether they want to require hardware resident keys (which cannot be synced via the cloud). Most do not.
The usability problems are actually larger than that, see sibling comments for why. Passkeys, even when cloud synced, are still better than cloud synced passwords and still give the option of hardware backed keys for those whose threat model warrants it.
by packetlost
7/23/2026 at 2:58:49 AM
> The important part is it's up to the service to decide on whether they want to require hardware resident keys (which cannot be synced via the cloud).From what I know, Apple ignores `platform` and `ResidentKeyRequirement` claims and always creates cloud-synced key pairs.
Moreover, the strongest claim value allowed for the `ResidentKeyRequirement` is “discouraged”, which per spec is treated as SHOULD in RFC 2119 since. In other words, browsers are free to ignore it when “they know better”, which Apple always does.
by ivlad
7/23/2026 at 12:00:18 PM
The service may require attestation and verify the actual authenticator metadata.If the passkey is not accepted by the service, it can use the signaling API to indicate that the passkey was not registered validly.
by atanasi
7/23/2026 at 3:07:12 PM
Sure, but you can still use a Titan T3 or recent Yubikey model on an iPhone. If I had the threat model to justify it, I would not set up the passkey in Apple's infrastructure.It is too bad they ignore that though. That's really disappointing.
by packetlost
7/23/2026 at 8:10:33 AM
> A particular service can choose to enforce those class of passkeysAnd that's exactly why the technology should be rejected while we can. It's no business of a particular service how I use my devices.
by account42
7/23/2026 at 8:25:38 AM
Device bound is a bad idea especially if in the future sites is designed to be fail secure, you might be able to recover your account but not your data. The provider will then have to take a negative PR risk for something they cannot doPeople lose their device all the time, there's tons of horror story where people got locked out because they lost their sole method of 2FA and if there is a method to bypass that then it is inherently insecure
For the layman yeah it is probably enough
by BetterThanSober
7/23/2026 at 8:15:07 AM
> supposed to be device-boundDevice bound is horribly broken idea. Credentials must be me-bound, so I and only me fully own and control the credential. I want to access the site from wherever I want to access it.
by jjav
7/22/2026 at 6:31:53 PM
This is exactly all the stuff normal people don't care about.If your system requires any basic intelligence or interest scrap it and go back to the drawing board because you just lost your customers.
by TitaRusell
7/22/2026 at 6:43:59 PM
Stronger than "don't care about" (at least if I and some friends I've discussed this with count as normal people): this is actively what I don't want! I want control over my authentication and I don't want it bound to device, browser, OS, etc.by sib
7/22/2026 at 6:36:44 PM
I mean, no one ever said it was a good design.But the original FIDO2 standard wasn't made with consumers in mind in the first place, it was driven by enterprises that wanted high-assurance security. It works in that environment because, well, a big IT department controls it, can support the employees, and you can mandate and control its use.
It was just sort of haphazardly shoehorned onto general users/consumers, prematurely IMO, via synced credentials as a compromise instead of coming up with something better.
by thewebguyd
7/22/2026 at 7:48:43 PM
Device-bound would be a nightmare. I don’t want to have to think about different credential for phone vs. laptop, etc.by richstokes
7/22/2026 at 10:09:34 PM
Easy: it's the token on your physical keyring, right next to your house key and car key.by crote
7/22/2026 at 11:35:08 PM
I have 7 house keys and 2 car keys. Getting a new house key is a breeze and cheap, and even if I lose them all, a lock smith can make me whole again. Getting a new car key is a bit more expensive, but also largely not a hassle.Having spare Yubikeys is more of a hassle than both of those (and more expensive!), and the worst case scenario of losing them all is much more catastrophic. If I have no house key, I still get into my house. If I have no car key, I still get into my car (after a fair bit of hassle). If I have no Yubikey, I have permanently lost access to the accounts it was tied to.
If physical hardware tokens were as cheap as house keys and not much more difficult to set up and copy, then it would be kind of reasonable. As it is, it's unworkable. Even password managers manage to make this work. You can throw your database on every storage device you have and write the master password down on paper, and the chances of you not being able to have access to it are pretty darn close to zero.
by Telaneo
7/23/2026 at 11:43:51 AM
No one is forcing you. You can continue to use passwordmanager.We are talking about the rest the people that want convenience.
In a way that is the reason passkeys synced with Google or Apple just work. No need of hardware keys.
by coffe2mug
7/23/2026 at 4:59:40 AM
It's not a nightmare, in fact different sessions of the same user could be used to grant different capability levels across sessions depending on the trust level.by anticensor
7/22/2026 at 8:32:39 PM
Seems like the flow should be:1. All passwords stored in password manager. 2. Login with password manager when logging in for the first time on a device. 3. Combination of OS and site/app notice that no passkey has been created for this account and offers to create one. This is presented to the user as “setting up the current device for password-less log ins.” 4. OS negotiates with site/app to install the passkey and use it for future log ins on the device.
It’s presented to the user as a convenience clearly tied to this device.
…but you still have your text password stored in the password manager’s servers…
by jimbokun
7/22/2026 at 9:11:08 PM
By still having the password the user can still be attacked via phishingby akdev1l
7/22/2026 at 9:36:39 PM
The user can always be attacked via phishing so long as account recovery methods exist (and they need to exist for obvious reasons). Use passkeys, but so long as you can also log in via password, or SMS code, etc., it's phishable, you can get sim swapped.Your master password to your cloud PW manager's vault is also phishable (hence why passkeys were ideally device specific, non-exportable).
Its phishing resistant not phishing proof
by thewebguyd
7/22/2026 at 10:05:28 PM
> hence why passkeys were ideally device specific, non-exportableNot true. The original concept was always for them to be cloud synced.
This has nothing to do with their anti-phishing capabilities. The anti-phishing capabilities come from the fact that the password manager authenticates the application before handing out the passkey. It doesn’t matter if they are synced across devices or not.
You are correct that other login methods might be weaker than passkeys. I’m not sure how that’s related to passkeys though. In real security sensitive applications the recovery process is “go to the bank’s branch and show them your driver’s license”.
> Your master password to your cloud PW manager's vault is also phishable
No, it’s not. You would need to steal my yubikey to get access.
by akdev1l
7/23/2026 at 2:46:33 AM
> Not true. The original concept was always for them to be cloud synced.It was not. The original U2F spec was created before that idea was around and it talked about hardware security keys as means to store the primary key pair.
by ivlad
7/22/2026 at 10:08:36 PM
Yeah, but it's an order-of-magnitude more complicated. It's no longer "click a link and fill in your creds on a legit-looking website", it turns into "hack someone's email, request a password reset, wait the mandatory 24 hours, do a social attack on the provider to pull off a sim swap, and fill in the 2FA code".> Your master password to your cloud PW manager's vault is also phishable
... which is why all sensible cloud vaults have a separate enrollment key, requiring an explicit action to grant a new device access.
by crote
7/23/2026 at 7:59:11 AM
Good. Device bound keys are a mistake.by account42
7/22/2026 at 9:23:27 PM
In the Apple ecosystem, passkeys are stored in your iCloud, and access to the passkeys is device bound. So if I generate a passkey on a MacBook, I can then use it from my iPhone as well, because it's encrypted to all my hardware devices.by j0057
7/22/2026 at 9:39:12 PM
Replace the word passkey with password in your comment. What’s the benefit of passkeys again?If you’re not storing the actual private key in the Secure Enclave but only the “access to it” what’s changed from how Apple’s keychain already manages password syncing to iCloud?
The only benefit (and it’s still a decent one) is that some random website breach can’t disclose your private key.
by phs318u
7/22/2026 at 9:59:08 PM
A random website breach can't disclose your password either, assuming you use random high-entropy passwords and the website only stores a hash of it. I haven't really seen the benefit to passkeys over passwords. Pretty much everyone is using a password management service that securely syncs both passwords and passkeys across devices. In that context I don't see the difference.by krferriter
7/22/2026 at 10:14:31 PM
> Pretty much everyone is using a password management serviceIn the US, only about 34 to 36% of adults use a password manager. Of the ~64% that don't, an alarming 20% reuse the same password across almost every service, and a ton just rely on browser autofill.
If you use a password manager, you are in the minority. Hell, even if you don't use a PW manager and you at least use a different password for different services, you are ahead of most people.
The general population is largely computer illiterate, and have a staggering lack of basic security hygiene.
by thewebguyd
7/23/2026 at 2:42:03 AM
FWIW, browser autofill is a basic password manager.by inigyou
7/23/2026 at 11:51:01 AM
A random app cannot eat your passkey. Platform authentication ensures more safety. I am not an expert but definitely it does use secure enclave in some ways(maybe decryption).UX usability is far better. With password and 2FA you have at least 2 steps. Here
Open the app: device like phone or laptop just asks your fingerprint or facial and done.
That is a great benefit for average Joe. Some one trying to scam remotely cannot access the account. The 89 year old grandma will say - I just give fingerprint. Done.
Yes, it won't cover all situations. Like if there is sim swap or bank employee does fraud.
by coffe2mug
7/23/2026 at 12:44:21 AM
The far bigger benefit is phishing resistance (with hardware-contained keys themselves being phishing-proof on a non-compromised system).It moves to the account recovery flows, but that can be much more difficult to phish.
by mwwaters
7/23/2026 at 2:41:30 AM
Why would a key need to be "hardware-contained" to be difficult to phish? My SSH private key is unphishable and it's right there in a file. It's unphishable because I know there's never ever a reason to send it to someone - in a scenario where that would be needed, I'd generate a new key just for that situation.by inigyou
7/23/2026 at 4:24:59 PM
Desktop operating systems don't have very good separation between programs. If some malware gets access, it will be looking for e.g. ssh keys and using a keylogger to get the passphrase if you encrypted your ssh keys. Tpm protected passkeys are much better protectedby ptman
7/22/2026 at 11:20:13 PM
I don't want my computer to be able to decide I'm not allowed to access something. I'll never use these.by Lammy
7/22/2026 at 9:14:06 PM
I do not want my identity to be device-bound. I want it to be me-bound.by jknoepfler
7/22/2026 at 9:53:26 PM
That's self sovereign identity. But you still need someones that can issue those verifiable credentials, and we (as a global society) can't decide who that should be in the web of trust? Our banks? Governments? Schools? Doctors at time of birth?Arguably, that's the only way forward. SSI is also nice because you get to fully control what you share and don't share (e.g., age verification, you get to only share "I am over 21" and no other information).
Passkeys were (are?) supposed to be just a password replacement though. That services are using them to replace a username AND a password AND 2FA is a problem that's turning the device into your identity, instead of keeping the identity as three parts (What you know, what you have, who you are (biometrics)). Now we've just turned the "something you have" into the entire identity stack.
by thewebguyd
7/23/2026 at 1:33:27 PM
> we (as a global society) can't decide who that should be in the web of trust? Our banks? Governments? Schools? Doctors at time of birth?Yes? I mean, that's what literally is there by default in every country. They're not either/or either, they're part of a chain.
Most importantly, none of that is device-bound. Or even person-bound. Which allows for delegation, which is a feature that cybersecurity people keep insisting is not real.
by TeMPOraL
7/22/2026 at 10:42:01 PM
Put yourself in the role of a consumer for a second.As a consumer, I don't give a shit. I use my driver's license to apply to jobs, my passport to fly, and a password (with 2FA depending on how much I / my employer cares) for everything else. I prefer whatever I use for 2FA to not be device-bound, because that's obnoxious, error-prone and constraining.
As a consumer, I don't see any reason for my auth to be more complicated than that.
by jknoepfler
7/22/2026 at 10:13:06 PM
How do we verify that you are you? It can't be linked to fingerprints, iris scans, or DNA, as those are trivially leaked, impossible to change, and a privacy nightmare.Until we find a way to securely implant a Yubikey in people's brains, it isn't going to happen.
by crote
7/22/2026 at 9:29:08 PM
Wouldn’t it be better to use envelope encryption and sync the passkeys? I mean with envelope encryption somebody would probably be able to create a rfc that would support cross browser/password manager sync a passkey by using a encrypted envelope that would be able to be deceptively wither via tpm or by using credentials so when syncing it would ask for upn/password of the original device or something so it can even be e2e encrypted, so some kind of federation protocol for password managers that you ownby merb
7/23/2026 at 10:21:26 AM
> they are supposed to be device-boundWhich in and of itself should already be a super obvious total no-go. Every device will eventually go out of service or will be decommissioned, for a multitude of reasons. Then what, I lose all access, because I went from an iPhone to Android? WTF?
by zombot
7/23/2026 at 3:52:19 PM
Except I literally never want to have auth tied to a device. That’s ridiculous.by lazide
7/23/2026 at 3:09:26 AM
What I find particularly annoying on Windows is that it tries to take over the Passkey workflow with Windows Hello. I wish I could just tell it to not handle Passkeys at all, and let me deal with it through my Password Manager (KeePassXC) and my hardware tokens (2 YubiKeys).by m-p-3
7/23/2026 at 2:34:28 AM
If a good idea falls apart when confronted with reality, it's a bad idea.by inigyou
7/23/2026 at 6:47:50 AM
How is it corrupted by vendors and password manager? Why is password manager being passkey so bad or do you believe password manager should have no role there?How would it look if it wasn't corrupted?
by YetAnotherNick
7/22/2026 at 3:23:54 PM
This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email.(But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices.)
The weird part is that password managers provide no way for you to copy and paste your passkeys. To present a passkey, you have to use a password manager. This makes it impossible to copy and paste your passkey to the wrong person (someone trying to trick you).
Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourself. Instead, the password managers each have their own finicky app-to-app mechanism for transferring passkeys from one password manager to another. (I think all the password managers kinda like that lock in.)
Finally, note that for logging into your password manager itself, you'll always require something outside your password manager to login, probably a password, but possibly a YubiKey; your choice. (It's your one "last password," as they call it.)
https://danfabulich.medium.com/passkeys-are-just-passwords-t...
P.S. It's past time to move off of LastPass. LastPass lost all of your passwords again last month, just like they did in 2022. The most similar service is 1Password. If you like LastPass, you'll like 1Password about the same, but 1Password hasn't had multiple terrible security breaches.
by dfabulich
7/22/2026 at 3:43:01 PM
>This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager.The issue isn't what passkeys _are_ (e.g. explaining they are like public/private "ssh keys" and hoping that type of explanation ends the confusion).
Instead, it's the workflow around passkeys. The websites show very confusing dialog popups and choices that a lot of normal people will not understand. This is a good article with screenshots showing the confusion: https://arstechnica.com/security/2024/12/passkey-technology-...
I have senior citizens asking me about passkeys because their bank and medical websites keep reminding them about switching to passkeys every time they login into their accounts. My recommendation to them is not to do it unless they have a simplistic single vendor setup such as only Apple iPhone and MacBook with iCloud Passwords app. If instead they have a mixed Windows + Apple setup with 3rd-party password manager, they could accidentally put a new passkey into the os or browser instead of their external password manager and not realize what has happened. This happens because the different parties implementing passkeys all have different agendas that suits their interests and that's what makes the workflow confusing for normal people.
by jasode
7/22/2026 at 5:21:36 PM
The what and why make sense. The how is poorly done. People are generally familiar with passwords but passkeys are different.by selicos
7/22/2026 at 5:02:18 PM
sadly it seems like most of the banks I use still enforce antiquated password rules, no MFA and rely on stupid questions most of which can easily be guessed from public records.by Reddit_MLP2
7/23/2026 at 5:32:29 AM
That might change on the country. At least here in Brazil, all logins require some sorth of MFA.This changes by banks, some send code to our phone number (thought WhatsApp or SMS), others send SMS+email + face ID. All of them require at least the face ID. Some biggest banks requires you to go to ATM to authorize app access. You insert your card, password and authorize there.
There's Mercado Pago, which supports passkeys and standard MFA too. So you can store on bitwarden even.
by vitorgrs
7/22/2026 at 6:33:59 PM
Just the other day I was creating an ID on a government web site, which offered a list of security questions such as "Title of your favorite movie" or "Someone that you admired as a child" and the answer was not allowed to have any spaces.Just absurd.
by bdamm
7/22/2026 at 9:39:15 PM
Security questions have always been ridiculous, but I'll especially never understand how "favorite [thing]" ever made it to production anywhere. "Favorite movie" can change multiple times in the same conversation.by enobrev
7/23/2026 at 8:41:29 AM
Still better than the government (!!!) website that a few days ago gave me the option of using "What's the name of the company you first worked at?"by thevinter
7/22/2026 at 8:16:24 PM
You can also just put any answer into the question as long as you will remember it.by Melatonic
7/22/2026 at 8:53:56 PM
It should work for all people and not depend on these “tricks”.by edwinjm
7/23/2026 at 9:21:40 AM
Yet they still work and people generally don't have their accounts stolen. Why? Because security is more than technology. Stealing a bank account is illegal and you will be prosecuted for it.by account42
7/23/2026 at 10:25:50 AM
hahahahahahahahahahahahahahahahahahahahahahahahahahaNobody hacks because that's illegal
by marysol5
7/23/2026 at 11:50:19 AM
The optimum amount of hacks is not zero.by account42
7/23/2026 at 6:40:11 AM
No doubt preaching to the Choir here but I just generate a new pass phrase and store it in Bitwarden. If course for the non HN audience, much more confusing and dangerous.by thrixton
7/22/2026 at 5:16:12 PM
You're agreeing precisely with the parent commenter that passkeys are, from a user's perspective, just passwords that require the use of a password manager. The difficulties many people have understanding or using passkeys are valid to point out and criticize, but they're precisely the same difficulties people have moving from the paradigm of "memorizing or writing down all my passwords" to "using a password manager."by tshaddox
7/22/2026 at 10:05:35 PM
> they're precisely the same difficulties people have moving from the paradigm of "memorizing or writing down all my passwords" to "using a password manager."Errr, no.
You can transfer a password from one manager to another. Those very same password managers won't let you transfer a passkey they hold.
And if you know the password, you can use it anywhere by just typing it in - no complex technology or protocols involved. But using a passkey involves your secure computer talking to another computer, using a complex protocol that can't go via eyeballs and fingers. If you don't have a way to connect the device holding the passkey to the computer wanting your id - say your USB A Yubikey isn't recognised by your phone, then you are out of luck - you can't use that passkey, even though it's sitting in your hand.
And you can't work around that by copying the passkey to a device that can communicate with the service you're using, because you aren't allowed to copy.
It's an unworkable mess. The mess is not created by passkeys themselves, because, as others have said elsewhere the protocol is pure elegance. The mess is created by vendors choosing lock in over transportability. I'm hoping it's a passing phase.
by rstuart4133
7/23/2026 at 1:21:26 AM
That’s a fair point. My thinking was that, once you’re using a password manager, you’ll A) use it to generate random passwords that would be unwieldy to memorize and B) have passwords synced to all your devices such that you will never deal with the plain text password directly.Of course it is conceivable to want to directly access the plain text password for reasons you mention, although that would be exceedingly rare (at least for me). In those cases I agree that passkeys don’t work, although I might argue that if the average user thinks they need to access the plain text password, there’s a significant chance that they’re being phished!
by tshaddox
7/23/2026 at 1:38:23 PM
> Of course it is conceivable to want to directly access the plain text password for reasons you mention, although that would be exceedingly rare (at least for me).It's a daily occurrence for me, because especially because of going through steps A) and B), step C) which is copy-paste is needed to actually transfer the unwieldy, unmemorizable password from the password manager that stores it, into the app that requires it, when the autofill service refuses to communicate between the two.
by TeMPOraL
7/23/2026 at 5:19:12 PM
But that sounds like precisely what standardized passkey integration in the browser and website solves! This is honestly how I think about passkeys: they're a standard API for browsers and websites to integrate with password managers without needing a browser extension to manually look for and fill out text inputs on the page.by tshaddox
7/23/2026 at 10:21:26 AM
>I have senior citizens asking me>instead they have a mixed Windows + Apple setup with 3rd-party password manager
Why do I feel like this scenario is entirely fabricated.
What fucking "senior citizen" is confused by a passkey, but has multiple devices and password managers?
by marysol5
7/22/2026 at 5:56:14 PM
So you're saying that if you're inside Apple's walled garden, it works really well! Hmm...by fragmede
7/22/2026 at 6:11:53 PM
> So you're saying that if you're inside Apple's walled garden, it works really well! Hmm...Or google. If you use android and chrome then it all just works.
But god help you if you want to use a password manager to keep everything in sync; I haven't yet found a way for a mobile app or web page to explicitly signal to the device that the passkey to be created should live in $password_manager and not whatever built-in/on-device key-store exists.
So I only really use pass keys for desktop/web things because that's the only place the "store/read from $password_manager" flow _works_.
by baby_souffle
7/22/2026 at 6:17:37 PM
It's probably not something the app or web page should have any visibility or control over. It's more something the browsers and OS should allow a straightforward selection of where you want your passkeys stored (ideally something you can configure the default for globally). But of course the OS and browser vendors are trying to compete to do it, so they're not incentivised to make it obvious or fair.by rcxdude
7/22/2026 at 6:25:22 PM
>I haven't yet found a way for a mobile app or web page to explicitly signal to the device that the passkey to be created should live in $password_manager and not whatever built-in/on-device key-store exists.On Android 17 (on Pixel) you can select the password service under Settings -> Passwords and passkeys -> Preferred service.
If you have an alternative password manager installed, it will be listed there along with Google's own password manager. iOS has a similar setting but I don't know exactly where off the top of my head.
by fauigerzigerk
7/22/2026 at 7:02:35 PM
> On Android 17 (on Pixel) you can select the password service under Settings -> Passwords and passkeys -> Preferred service.I have this set to my password manager but I still can't _use_ the pass-keys in my password manager to sign in to most apps.
by baby_souffle
7/23/2026 at 11:54:54 AM
https://f-droid.org/packages/de.noisruker.openPasskeyAuthUse this then totally offline
by coffe2mug
7/22/2026 at 8:20:51 PM
"Most" apps? So it works in some apps, but not others?Setting your preferred password/passkey manager on Android 17 to 1Password works fine in Chrome and Firefox to log in to any site, presenting passkeys managed in 1Password. It also works in all of Meta's native apps. (I'm pretty sure it works the same in Bitwarden.)
Whatever issue you're having, it's not an inherent limitation of Android passkeys. It might be a bug in your passkey manager…?
by dfabulich
7/23/2026 at 2:12:39 AM
> Setting your preferred password/passkey manager on Android 17 to 1Password works fine in Chrome and Firefox to log in to any site, presenting passkeys managed in 1PasswordI went to `github.com` in chrome (not my default browser) and firefox and tried to sign in with pass key. I never even got a prompt from 1password to unlock to use the pass key, just a "no pass keys available" message from what looks like the system UI.
When I go to passwords & passkeys, 1password is the only item listed under preferred service. Google shows up under additional services but I have the toggle set to off.
so yeah, I just auto-fill my username and password like it's 2018.
by baby_souffle
7/23/2026 at 1:40:57 PM
> Setting your preferred password/passkey manager on Android 17Which approximately no one is using yet. Maybe in two weeks, when the new Samsung flagships roll out, to two months, when they start updating current generation devices...
> to 1Password works fine in Chrome and Firefox to log in to any site, presenting passkeys managed in 1Password.
Perhaps. But does it work with System Web UI, which I imagine is Chrome but have no clue how it's accessed?
by TeMPOraL
7/22/2026 at 8:14:43 PM
Works fine on iOS. All my passkeys are in 1Password, and every prompt to use or save a passkey goes through 1P. You can also control which password managers are active on iOS (eg, I disable iCloud passwords, and only allow “autofill from” 1Password.)So yeah, this is cross platform on iOS, macOS, Windows, and Linux.
by anon7000
7/23/2026 at 11:53:09 AM
No one is convincing you need to use it. If it makes it makes other people's lives easy then okby coffe2mug
7/22/2026 at 6:45:54 PM
[dead]by raggi
7/22/2026 at 3:59:39 PM
I don't think you're giving those seniors good advice. When the banks ask people to "switch" to passkeys, they're not removing the passwords; they're adding passkeys as an alternate login mechanism.If you lose your bank passkey, (e.g. if you put it in the wrong password manager and you can't figure out where it is) you can just sign in with your bank password.
In the worst case, banks actually don't make it very hard for seniors to reset your password/passkey; just show up at a branch with photo ID, your bank card, and your PIN, and a teller will help you reset your credentials. They do it all the time.
And, remember, seniors could also put a randomly generated password into the wrong password manager. In that case, they'll either have to reset their password, or they'll have figure out what they did, retrieve their password from the OS password manager, and transfer that password to their preferred password manager.
The exact same story applies to passkeys, except, because passkeys can't be copied and pasted, you'd have to figure out how to use the finicky app-to-app transfer system ("Credential Exchange Protocol"). That's probably too complicated for most seniors, so falling back to a password is almost certainly their best bet.
by dfabulich
7/22/2026 at 4:29:55 PM
> In the worst case, banks actually don't make it very hard for seniors to reset your password/passkey; just show up at a branch with photo ID, your bank card, and your PIN, and a teller will help you reset your credentials. They do it all the time.Maybe... I just ran into an annoying scenario where the largest bank in Canada made an administrative error where they mislinked an account belonging to me to my wife's profile.
I went to a physical branch to get it fixed and was told that branches don't have that kind of ability so I'd have to call customer support.
I called customer support and failed the verification questions because the expected answers were wrong, based on their own clerical error. After failing the verification questions, I just got a "we have to end this call, no additional information can be provided, please visit a branch."
I was able to get around it by calling back in and providing the incorrect, but expected answers to pass the verification step - I imagine, however, that this could have turned into a real nightmare for seniors, or anyone who wasn't able to deduce what the expected verification answers were.
by Marsymars
7/22/2026 at 6:07:41 PM
> I went to a physical branch to get it fixed and was told that branches don't have that kind of ability so I'd have to call customer support.What are the branches even for if not customer support?
by Telaneo
7/22/2026 at 6:17:28 PM
> What are the branches even for if not customer support?Lots of physical locations make the bank seem big/safe/reputable.
Beyond that, it's sales and a place to have ATMs. I have sometimes been able to get a replacement card issued at a branch instead of waiting for one to show up in the mail.
Some branches will accommodate special requests like "can I withdraw $200... in two dollar bills" / take coin deposits but that's been increasingly rare.
by baby_souffle
7/22/2026 at 7:41:50 PM
My local branch has had a sign on the front door "our coin counter is broken, sorry for the inconvenience" for the past 6 months. I refuse to believe they don't have a working coin counter in a bank branch; they just don't want customers bringing in a big jars of coins.by SoftTalker
7/22/2026 at 8:18:30 PM
I didnt even realize you could do that - I just assumed you still had to roll your own coins or use a service like Coin Starby Melatonic
7/23/2026 at 10:24:14 AM
Banks don't want to run physical branches anymore, hence why, at least in the UK all local branches are done. And central branches are all that exist.They want to close even them because the only services they have now is ingesting cash, which is getting less and less anyway.
But yeah, any time I've gone into a branch, which they made me do a few months ago to "validate" my documents for a mortgage. Which was just scanning and uploading to their internet..., they've made me sit on the phone to their call centre.
by marysol5
7/22/2026 at 6:43:11 PM
A meeting space to discuss business services, and a terminal for people who insist on depositing cash. They are definitely not a customer support terminal.by toyg
7/22/2026 at 10:16:07 PM
Sales. They are there to talk you into getting the premium mortgage.by crote
7/22/2026 at 6:22:12 PM
This is more a statement of how awful Canadian banks are than anything else. For anyone unaware we have an oligopoly of five identical banks all of which treat their customers like shit and effectively extract tax from the Canadian population while providing nothing.by andy99
7/22/2026 at 6:39:35 PM
> while providing nothing.You forgot about the endless frustration and annoyance.
by ChoGGi
7/22/2026 at 9:03:45 PM
Ironic given the prime minister's former employmentby YuccaGloriosa
7/22/2026 at 11:27:30 PM
With advent of ai-based impersonation, I wonder why in-person reset is not the priority right nowby kuekacang
7/22/2026 at 7:05:04 PM
[dead]by no_no_no_no
7/22/2026 at 5:43:46 PM
> just show up at a branchIn the UK at least, there are very few brick & mortar branches anymore - banks expect everything to be done online.
by zabzonk
7/22/2026 at 4:20:14 PM
Uh, if you set up a passkey it becomes the default almost always. Then on another device it'll pop up looking for it and look like login failure and you need to "try another way". That's alarming to anyone, not to mention seniors.by pishpash
7/22/2026 at 4:31:09 PM
Sure, that's alarming, but if you set up a passkey on the "wrong" password manager, you've (temporarily) lost your passkey. You should probably be kinda alarmed about that.You can click "try another way" and use your password, and then you'll have access to your bank. But then, you should try to resolve that problem. If you (or a trusted friend/family member) can figure out how to use settings to remove the passkey from your bank's account settings, you can do that, or you can ask a bank teller to help you, instead.
(And, luckily, you won't need a bank teller, because you'll still have access to your account.)
by dfabulich
7/22/2026 at 4:48:03 PM
> you can ask a bank teller to help youAt virtually all banks, the bank tellers cannot help you with login problems. You will have to call the bank's tech support and somehow navigate AI-modulated phone menu hell.
by tetromino_
7/22/2026 at 5:11:20 PM
Citation needed. Walk in with photo ID, a bank card, and your PIN, and all the major banks will send you a reset-password email.by dfabulich
7/22/2026 at 6:02:19 PM
I went to my bank with all my ID and my bank card, talked to the teller and was told to call a support line. One of my parents went through the same thing.I don't have a citation for you just recent experience, do you have a citation?
by soupbowl
7/22/2026 at 7:43:28 PM
Switch to a better bank.My credit union has people who can help with any online banking/website login issues. They aren't tellers, but they are there. You just need to ask to speak to a customer service rep.
by SoftTalker
7/22/2026 at 10:19:18 PM
Tried this, they weren't even able to verify my ID for KYC reasons. Had to go a second time after they blocked my account with zero warning. I have zero expectation that they will be able to help me with a password resetby crote
7/22/2026 at 6:25:41 PM
I help run a non-profit and the only time I have ever been able to get this kind of service is when I visit a bank that has in-person business services. Tellers do not have any ability to do any of this.by tekla
7/22/2026 at 5:23:34 PM
Even my primary Credit Union is limiting teller roles in branches. There are still people to help, but then you have to go in person. My nearest branch is a day trip away but I can do most banking tasks at any partner CU location.by selicos
7/22/2026 at 3:48:58 PM
I am an engineer and have some insights on the discussions and developments around it.ITS NOT SIMPLE AT ALL
1. The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing).
2. Majority of industry players shared the vision of a credential which is available across the platforms and browsers
3. The vision for collaboration never materialized so everyone went their own way to implement it. Examples would be google rolling out browser (Chrome) managed authentication which led to this situation where even on the same machine you have to remember which browser you used to create the Passkey credential.
4. Interestingly enough the earlier popular name was WebAuthn, Apple started calling it Passkey on fly, given Apple's popularity everyone just caved in.
5. My personal interpretation is that in some sense Apple wanted to be the default password manager on Apple devices.
6. This is when all password manager companies jumped in strongly to save their business and the protocol went into a direction where you can use your existing password manager to store the credential/Passkey as well
Personally its a mess, the phishing resistant aspect has its own benefits though. If you are using it with security in mind then my recommendation would be to use a hardware backed security key with NFC enabled. Everything else is pretty much lipstick on pig, they are worse than passwords in some sense from usage perspective.
by sandeepkd
7/22/2026 at 4:30:16 PM
Yes, this is exactly the problem.Multiple pieces of software vying to be your passkey provider, often using dark patterns so you don’t realize you’re making a choice, and not using the term “passkey” so people are using the technology without knowing what it is or how to research it.
Kind of reflects the state of the web today, where every company wants to be your intermediary in every interaction, from making a purchase to transcribing a meeting.
by smelendez
7/22/2026 at 6:27:40 PM
> Multiple pieces of software vying to be your passkey provider,Which entirely defeats the point of using passkeys. There shouldn't be a passkey provider the "provider" is your device's TPM/secure enclave + your biometric challenge. They are supposed to be mathematically non-exportable, device-bound.
by thewebguyd
7/22/2026 at 7:35:25 PM
"supposed" is doing a lot of heavy-lifting here. According to who? The FIDO2 or Webauthn standards? Or in a perfect world?FIDO 1.0 started as two different standards: UAF and U2F. U2F was for USB keys used as second factors (so almost always stored in a TPM-like chip and device-bound, but not provided by your platform and there could be multiple of them). UAF were either provided by your platform or by any software and there was no requirement for them to be stored in TPM. Back in the day, very few platform had any FIDO support built-in, so in practice UAF was always done in software (usually based on whatever biometrics/TPM the hardware provided).
So competing options were the default for early FIDO, getting a default platform option is something that came later.
by unscaled
7/22/2026 at 6:48:59 PM
Yeah - and as a user, I don't want my device manufacturer to have that level of influence or control over the authentication that I use for unrelated services.by sib
7/22/2026 at 6:55:43 PM
> They are supposed to be mathematically non-exportable, device-bound.Which would make the whole scheme unworkable (at least for me).
by JohnFen
7/22/2026 at 7:15:29 PM
I pair of hardware keys (Token2, Yubico, etc) has the benefits from both worlds.by l11r
7/22/2026 at 10:22:16 PM
Except enrollability. Got a new account? You need physical access to both tokens to enroll it. Got a new token? You'll have to individually enroll every website - provided they even support multiple tokens at all...Yubikey tried to solve this, for obvious reasons. Their proposal was DOA.
by crote
7/23/2026 at 2:58:20 PM
I believe it was DOA because it defeated the main idea of tokens.by l11r
7/22/2026 at 8:39:03 PM
The anti-phising benefits are still very much there even if you sync them to pw manager. Yes it introduces single point of failure (pw manager), but at the same time you no longer need to go reset all your passwords to every service you use if you happen to lose that device. Tradeoffs.by Itoldmyselfso
7/22/2026 at 11:44:48 PM
> The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing).Honest question: If the main issue is phishing, why wasn't something like Yubikey adopted more widely - or dongles, or the venerable chip cards we have since the 80s?
Everyone knows what a key is - I mean the thing you open doors with. Most people know the basic security implications as well as what to do if you lose one.
The simplest way to translate that to "electronic keys" would be a dongle or chip card - that lets a device use its identity as long as its plugged in, but is not physically locked to that device. A user can unplug it, take it home with them or plug it into a different device. What a user can't do is copy them, so the same phishing protections as with passkeys are provided.
But for some reason, this never caught on except for niche solutions. Instead, the industry is increasingly moving to systems where the keys are fused with the devices themselves, using TPMs or similar technologies that can't be removed from the device. Which gives you all the well-kniwn hassles if keys have to be moved or devices get lost or stolen.
But I don't understand why this is done.
by xg15
7/22/2026 at 7:00:51 PM
I don’t see hardware tokens (like Yubikey) in the list. Those are the only ones that provide a true second factor, to protect against the theft or compromise of your primary device.I’m a little afraid that hardware tokens are getting lost in all the passkey marketing BS. At least they continue to work for now.
by iamnothere
7/22/2026 at 7:40:41 PM
> I don’t see hardware tokens (like Yubikey) in the list. Those are the only ones that provide a true second factorpasskeys are not meant to be a second factor; they are meant to replace the password as a primary factor.
>to protect against the theft or compromise of your primary device.
I love Yubikeys, but the only additional protection you get by making the passkey hardware-bound is preventing an attacker who has already compromised your operating system from stealing the credential.
But! Unless you are also doing hardware binding of the session (aka cookie) after sign-in, then doing hardware binding of your credential is mostly security theater, because the attacker can just wait for you to sign in and then steal your session.
And there is standards work happening separately for hardening session security, such as DBSC: https://w3c.github.io/webappsec-dbsc/
I have no idea if Yubico is involved with DBSC, but I would hope that they are, because it would help them make Yubikeys live up to the security guarantees that I personally feel are heavily implied by their marketing.
by jesseendahl
7/22/2026 at 7:29:15 PM
There are some parts of this that are correct and other parts that are incorrect:>1. The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing).
This is incorrect. The idea was to provide a phishing resistant primary factor that could compete with the usability of passwords to the point that consumers would actually want to adopt it.
>2. Majority of industry players shared the vision of a credential which is available across the platforms and browsers
This is correct/accurate.
> 3. The vision for collaboration never materialized so everyone went their own way to implement it. Examples would be google rolling out browser (Chrome) managed authentication which led to this situation where even on the same machine you have to remember which browser you used to create the Passkey credential.
IIRC at least Chrome's default on Apple platforms is to save to the Passwords app by default. There are then multiple fallback options in the case that the user isn't using the default credential provider -- ultimately falling back all the way to cross-device passkey sign-in (the QR-code initiated sign in) or Security Key.
The security engineering behind the QR-code cross-device sign-in stuff is interesting: https://www.corbado.com/blog/webauthn-passkey-qr-code#4-pass...
That said, I strongly agree that fragmentation of where passkeys get saved is super confusing and I wish there:
(a) was stronger guidance from the FIDO alliance on both educating users that it's totally fine to have multiple passkeys across different ecosystems (e.g. one in Apple, one in Google), and;
(b) that all the credential managers could figure out a better way to place nice together and make it super clear to the end-user where a passkey is getting stored, what context it's for (e.g. personal vs. work), and actively help them store it in the right place (which might be different credential manager app for personal vs. work!).
> 4. Interestingly enough the earlier popular name was WebAuthn, Apple started calling it Passkey on fly, given Apple's popularity everyone just caved in.
This is incorrect -- passkeys are not just another name for WebAuthn. If you go back and look at the original definition Apple gave for the word passkey, you'll find that it was meant to be a discoverable WebAuthn credential that syncs across a user's devices with end-to-end encryption. There was a bunch of industry thrash around the definition, but it seems like the original Apple definition has largely stuck/settled now, and when passkeys don't sync they're typically called "device-bound passkeys" rather than just "passkeys".
>5. My personal interpretation is that in some sense Apple wanted to be the default password manager on Apple devices.
If you go back and watch the original passkeys announcement from Apple, their stated goal was to create something that is both a better user experience and more secure than passwords. By "better user experience", they meant the act of creating credentials and then repeatedly using those credentials (logging in).
Part of actually achieving that goal means there needs to be something that "just works automatically out of the box" which means there needs to be a built-in credential manager. That said, Apple credential manager had already existed for many many years by the time passkeys came around. The only thing that changed was instead of being solely accessible from inside System Settings (which was hard for the average user to find), the functionality moved into a standalone Passwords app.
>6. This is when all password manager companies jumped in strongly to save their business and the protocol went into a direction where you can use your existing password manager to store the credential/Passkey as well
I think it's a huge positive that all the password managers jumped on board, and that they could jump on board (since WebAuthn is an open standard). I think this is a good thing for consumer choice and for overall adoption and perception of passkeys. A lot of folks (including on this thread) have big tech lock-in conspiracy theories about passkeys, and the conspiracy theories would be even more prevalent without a wide spectrum of consumer choice for credential managers.
>If you are using it with security in mind then my recommendation would be to use a hardware backed security key with NFC enabled. Everything else is pretty much lipstick on pig, they are worse than passwords in some sense from usage perspective.
Passkeys protect against phishing attacks, and you get that protection regardless of whether the credential is hardware-bound or not. That protection comes from the cryptographic binding of the credential to the domain at the time of credential creation.
The only additional protection you get by making the passkey hardware-bound is preventing an attacker who has already compromised your operating system from stealing the credential. But! Unless you are also doing hardware binding of the session (aka cookie) after sign-in, then doing hardware binding of your credential is mostly security theater, because the attacker can just wait for you to sign in and then steal your session.
And there is standards work happening separately for hardening session security, such as DBSC: https://w3c.github.io/webappsec-dbsc/
by jesseendahl
7/22/2026 at 9:14:54 PM
I try to be accurate when sharing information like this. Some things are fact and some things are opinions, I already tried to annotate the opinions as interpretation. Most of the information is first hand, I was a member of FIDO alliance in past, have been watching these discussions.1. This can be subjective, Unfortunately Customer identity is not on the highest priority from security perspective, its all about ease of product use when it comes to customer identity. For customer identity, most account recovery methods still fall back to email or SMS even if you have 2FA configured. The real money lost with phishing is with enterprise identity, when some one poses as an employee. The recovery of these accounts can be managed. If a customer account gets hacked then the business is not really on the hook to make it even.
> Usability of passwords
This is the biggest point of contention as per my interpretation. The industry did a very poor job of securing their infrastructure leading the massive leaks of password databases. Instead of fixing that goal post changed, with the by introduction of PASSWORDLESS. The passwordless works just fine for enterprise identities, not the customer identity. Even for enterprises, you cannot get rid of passwords if you get into AAL concepts (guidelines provided by NIST for authenticator assurance levels)
4. I was working on WebAuthn when the term passkey was not there, I was there when the term was introduced, I saw how every one was trying to map their existing definition/understnading with the new terminology specially the part where Apple just announced them to be syncable. Enterprise companies had to actually disable the Apple Passkeys for this reason to begin with. I found it interesting to see how Yubico changed their documentation overnight, they switched every instance of WebAuthn keyword with Passkey. It took some time to settle on how to categorize discoverable credentials (where meta information about user is on the device in addition to credential) and non-discoverable credentials (hardware keys, they are limited in space so they did not store user meta information in earlier versions). Eventually google took the lead in calling the credential where private key cannot be synched as Security key and everything else as Passkey. Resident key, syncable, synched are all different bits of the WebAuthn assertion
5. Thats an interpretation of how I read things based on the overall play going on.
> Passkeys protect against phishing attacks, and you get that protection regardless of whether the credential is hardware-bound or not. That protection comes from the cryptographic binding of the credential to the domain at the time of credential creation.
The security aspect is tightly coupled with the authenticator implementation. The phishing aspect is the only default good in here, it just means that the credential is strictly tied to a particular domain, the one on which it was set, that too is highly dependent on the client (browser) doing the right thing. Additionally you have to count on the server to not get compromised as well (There is a a feature to support multiple domains).
Most importantly, when you make something this hard and complex to understand then be advised that people are going to make mistakes in implementation and leave gaps in security.
by sandeepkd
7/22/2026 at 5:04:33 PM
WebAuthn is the standard for token authentication.(I.e., Yubikeys and other USB sticks.)
It works fine and it a no-brainer to use.
The problems start when vendors start trying to shoehorn their shitty cloud auth services into WebAuthn.
by otabdeveloper4
7/22/2026 at 5:36:49 PM
How well does that Yubikey work with an iPhone?by NetMageSCW
7/22/2026 at 5:54:52 PM
Works just fine, you have to get the one with NFCby sandeepkd
7/22/2026 at 6:37:00 PM
You can also plug them in to the USB-C port, works just fine.by bugcheck7b
7/22/2026 at 9:20:54 PM
Some functionality is not supported via USB-C. Namely HMAC Challenge does not work via usb-c but will work via lighting port.by akdev1l
7/22/2026 at 6:58:35 PM
Works great, they even have ones with USB on one side and Lightning on the other for older iPhones.by iamnothere
7/22/2026 at 5:58:46 PM
iPhones are a lost cause.by thyristan
7/22/2026 at 6:41:18 PM
Passkeys on my iPhone works awesome.Too bad for Yubikey. I don't need them any more.
by bdamm
7/22/2026 at 4:24:08 PM
It should have never been a cloud password manager play. It should be hardware device only, and tied to the device. One passkey on each hardware device.by pishpash
7/22/2026 at 4:37:08 PM
That leads to the cross-device usability issues from the original post. Even for an experienced engineer, it's a headache to manage multiple devices across multiple sites.With the "cloud password manager" angle there is some hope of being user friendly, although we're certainly not there yet for most folks.
by jallmann
7/22/2026 at 5:13:22 PM
Then most of us would never use it. That means either:- Only one specific device can ever login (bad).
- It doesn't limit login to one specific device, therefore it does nothing.
Linking Passkeys to a physical device was always DoA. At least not without a way to enroll every device you own, and strong recovery strategies. But considering how inconsistent every company's Passkey implementation is (inc. many that only allow ONE TOTAL!), it is DoA.
by Someone1234
7/22/2026 at 6:32:22 PM
> Only one specific device can ever loginThat's entirely service dependent, and the standard doesn't mandate "Service must not allow multiple passkeys"
> It doesn't limit login to one specific device, therefore it does nothing.
It's not nothing. It provides an attestation that you the user are in physical possession of the device, and have passed the challenge to release the key form the TPM (biometrics, pin, something like a yubikey).
Giving your private key to a cloud password vault makes it phishable again (via an attacker getting acsess to your vault, just like with passwords). The private keys are supposed to be non-exportable, and the cloud password managers defeat that as well.
by thewebguyd
7/22/2026 at 6:51:16 PM
>> Only one specific device can ever login> That's entirely service dependent, and the standard doesn't mandate "Service must not allow multiple passkeys"
Unfortunately, given the laziness, incompetence, and cost-consciousness of organizations like traditional financial institutions, telcos, governments, etc., many of them have & will end up with that implementation.
by sib
7/22/2026 at 10:17:23 PM
> That's entirely service dependent, and the standard doesn't mandate "Service must not allow multiple passkeys"In fact WebAuthn is explicit that you should allow multiple tokens. But every time I see an HN thread it has people who insist this doesn't work or at least isn't common. When asked for examples, if they give any answers...
1. Most often these are sites where you can't use this technology at all. They'll have TOTP or something and apparently "I don't know anything about this" == "I know everything there is to know about this topic" in the increasingly LLM-crazy world we inhabit.
2. Usually otherwise it's AWS. Which is pretty annoying, but it's one site. I have like a couple of dozen places where I use WebAuthn and in all of those two (or three, or in a few cases four) tokens are enrolled. I don't have an AWS account, my employer is a Microsoft-only shop in this respect.
by tialaramex
7/23/2026 at 3:39:25 AM
Why? The "one device" can be something portable like a Yubikey-like USB key, or for that matter, a smart phone, because people are already forced to use phones to do authentication codes, so it is kind of assumed a phone is always with you. In fact there is an existing workflow for this, where you use the phone to scan a QR code and pass the challenge back.by pishpash
7/22/2026 at 7:04:52 PM
Then I wouldn't use it, and I would probably stop using services that tried to push me in to it.I use multiple devices and I want to log in to things using only my master password. I also want to be able to back up my credentials to local encrypted storage so I can restore them if my password manager service provider stops operating or becomes untenable.
by Zak
7/22/2026 at 5:13:18 PM
This is not much simpler than they think it is.> But you're not going to lose it, because you use a password manager, and the passkey will be stored there and synchronized to all of your other devices
That's just wrong. I use android, my partner uses ios. If he creates the passkey in safari, it's not going to get synced over to my phone. And that's just the first of the family sharing passwords issues. Same person issue is also present if somebody uses an iphone and a windows laptop, or chromebook.
It doesn't help that all modern browsers eagerly try to step in and offer their implementation of passkeys for logins, and they're not featured enough to support the type of shared access or synced access many people would expect from a password manager. How useful is your firefox passwords on an iphone? Or Mac OS's keychain I use as a daily driver on my windows gaming desktop?
> Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourself
This is wrong. Every single major password manager supports export. Lastpass, 1password and bitwarden all do that.
> It's past time to move off of LastPass. LastPass lost all of your passwords again last month
That just isn't true. Last month, their third party customer support portal was breached. That did not involve passwords.
by malfist
7/22/2026 at 5:22:50 PM
> Every single major password manager supports export.They all support exporting passwords, but, check your CSV; you won't find any passkeys in the CSV export for Apple, Google, Microsoft, Mozilla, 1Password, or LastPass.
(Bitwarden, Proton Pass, and KeepassXC do support exporting passkeys to CSV, which undermines the phishing protections, at least somewhat. It’s possible to trick you into exporting your passkeys from Bitwarden and sending the file to an attacker. It’s up to you to decide whether protecting yourself from being tricked into exporting your passkeys is worth sacrificing your ability to read them.)
> How useful is your firefox passwords on an iphone?
Did you try it? That's the primary feature of the Firefox app for iPhone.
(Especially since the Firefox app for iPhone is just Safari's WebKit wearing a Firefox disguise.)
> Or Mac OS's keychain I use as a daily driver on my windows gaming desktop?
https://apps.microsoft.com/detail/9pktq5699m62?hl=en-US&gl=U...
> With the iCloud for Windows app, you can access photos, files, passwords, and other important information from your iPhone or other Apple devices on your Windows PC.
When Apple's your password manager, you use Apple's password manager app to synchronize passwords and passkeys.
by dfabulich
7/22/2026 at 5:26:30 PM
> That's just wrong. I use android, my partner uses ios. If he creates the passkey in safari, it's not going to get synced over to my phoneIt would, if the people implementing it weren't all so obsessed with pushing their own platform-specific solutions over enabling open standards. LastPass works fine on Android, iOS, Mac, and Windows, but each one of those platforms defaults to saving passkeys in their own platform-specific store unless you jump through hoops to specifically save them somewhere else.
by Ajedi32
7/23/2026 at 4:12:10 AM
But this is well established behaviour in the real world. That the passkey design doesn't take this into account only proves even more that it was designed in a vacuum.by porridgeraisin
7/23/2026 at 1:33:49 PM
The passkey design does take this into account, it's only the implementations that don't.by Ajedi32
7/22/2026 at 5:34:45 PM
>That's just wrong. I use android, my partner uses ios. If he creates the passkey in safari,There. You just violated the premise of his point, that you use a password manager that syncs to all your devices.
by s3p
7/22/2026 at 5:41:09 PM
> That's just wrong. I use android, my partner uses ios. If he creates the passkey in safari, it's not going to get synced over to my phone. And that's just the first of the family sharing passwords issues. Same person issue is also present if somebody uses an iphone and a windows laptop, or chromebook.The passkeys sync just fine between iOS and Android on our devices using 1Password.
by izacus
7/22/2026 at 5:17:53 PM
> Instead, the password managers each have their own finicky app-to-app mechanism for transferring passkeys from one password manager to another. (I think all the password managers kinda like that lock in.)It's a nice simplifying step to talk about password managers here, but in the majority of the cases this won't be handled by a password manager, but rather by the device operating system, and the device manufacturers really like that lock in.
They're also in an especially good position to abuse it, because they now know every service that you authenticate and the webauthn "attestation object" field lets them set up a side channel with those services such that they can sell additional information about you.
Some people will tell you that the attestation object is not used in the consumer passkey system, so there's no way for this abuse to occur, but since it's usually going to be the device manufacturer who controls the password-manager-like component here, and they're the ones who stand to profit most from this kind of abuse, I think we need stronger guarantees than "the spec says you shouldn't do this unless the user is your employee and you paid for their device".
Until they fix this, I'm sticking with my mess of TOTP authenticators and yubikeys.
by __MatrixMan__
7/22/2026 at 9:19:26 PM
All of the major operating systems and all of the major browsers are password managers. Apple, Google, Microsoft, and Mozilla are all password managers. They all have apps that let you access their password managers on other operating systems.You're right that all of the major password managers like their lock in. The Credential Exchange Protocol is just barely good enough that OS vendors can say they "support" it, but tricky enough to find that ordinary users probably will never try it. (Not to mention that it doesn't even work yet on Windows or Android.)
As for attestation, the good news is that Apple always returns 0s for the attestation ID (because Apple, like you, opposes it as a side channel), and so any public site/app that insists on attestation would reject all Apple devices. This gives smaller password managers like Bitwarden sufficient cover to 0-out their attestation as well.
by dfabulich
7/22/2026 at 10:13:32 PM
> As for attestation, the good news is that Apple always returns 0s for the attestation ID (because Apple, like you, opposes it as a side channel), and so any public site/app that insists on attestation would reject all Apple devices.The bad news is this could change.
by pseudalopex
7/23/2026 at 3:07:15 AM
The risk is not that the site would insist on attestation, it's that Apple would volunteer it. They could pass an ID through that channel, use it to strike up a separate conversation which makes them some money, informs Palantir about what protests you've been to, and the service in the middle gets a finder's fee.If we want this to be usable by consumers we need to prevent this kind of thing, not thank Apple for their restraint.
by __MatrixMan__
7/22/2026 at 4:24:18 PM
Having to rely on a possibly proprietary password manager app to use a passkey sounds like a nightmare. A lot could go wrong with the password manager like becoming incompatible, becoming subscription based, lack of updates for bugs, etc. I don’t passkeys for the same reason as the original commenter.by aetch
7/22/2026 at 3:29:15 PM
I looked up the June 2026 breach and there is no mention of passwords being stolen. Only some PII (Phone, name, email, address) through a third party.by kodt
7/22/2026 at 4:36:16 PM
So to login using a public PC, you need either USB access (and carry around your password manager) or you need to install the password manager on the PC to log into a website?by xboxnolifes
7/22/2026 at 8:31:26 PM
There’s a process to scan a QR code with your phone and your phone then authenticates with the passkey.by realityking
7/22/2026 at 11:39:55 PM
Discord has an option to login with qr code. And it's very often used maliciously to steal accounts.by archargelod
7/23/2026 at 12:57:21 AM
The passkey method uses Bluetooth to ensure proximity.by mwwaters
7/22/2026 at 3:32:51 PM
> Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourselfThat's a red flag to me. It's enough that phone backup systems go out of their way to prevent you from accessing your own data, too, for unexplained "sekhurity" reasons.
> P.S. It's past time to move off of LastPass. LastPass lost all of your passwords again last month, just like they did in 2022. The most similar service is 1Password. If you like LastPass, you'll like 1Password about the same, but 1Password hasn't had multiple terrible security breaches.
That's the most annoying thing about password managers, and a major reason I still don't use them: there exists no password manager that is cross-platform (desktop/mobile in particular), local-first, and isn't sketchy or enshittified or otherwise on HN's current "don't use it, use <whatever> instead" list.
For core security tool class, that doesn't inspire confidence.
by TeMPOraL
7/22/2026 at 3:37:49 PM
Apple, Google, Microsoft, Mozilla, and 1Password don’t let you export passkeys to a file that you can read and backup, but Bitwarden, Proton Pass, and KeepassXC do.I think Bitwarden is on HN's current happy list. (I just use Apple iCloud myself.)
Allowing passkeys to be exported to a plaintext file undermines the phishing protections, at least somewhat. It’s possible to trick you into exporting your passkeys from Bitwarden and sending the file to an attacker.
The major password managers say that this is the reason they don’t allow exporting passkeys, and it’s not false, but they’re also making it harder to switch password managers, which may be their ulterior motive. (You can’t even import those exported passkey files into any of the major password managers, which they would be incentivized to do, if those smaller players had significant marketshare.)
It’s up to you to decide whether protecting yourself from being tricked into exporting your passkeys is worth sacrificing your ability to read them.
by dfabulich
7/22/2026 at 5:01:41 PM
I’ve relied on iCloud as well, but just learned that it allows apps to store persistent data. This data is synced between all devices, and there’s no way for you to view or manage/delete it. Even determining which apps do this requires you to enumerate the apps entitlements, which is nontrivial. And so an app you install on your iPhone can have configuration or credentials persist to each iCloud-connected device, and you have no control over it. This is certainly convenient, if that’s the behavior you want; if not, there’s no visibility or control.by threecheese
7/22/2026 at 5:24:53 PM
Is this different from the per-app enumeration in Account —> iCloud —> Storage? That provides a means to delete per appby alwa
7/23/2026 at 1:08:03 PM
Does it provide a way to edit or at least view it?by TeMPOraL
7/22/2026 at 4:37:21 PM
Depends on what qualifies as a password "manager", but I've been using pass (https://www.passwordstore.org/) for years on multiple desktops, and have recently added iOS app sepass to my setup (https://sepass.modiot.com/).Quite complicated to get it all setup (definitely not for non-technical users), but both are GPL and I now have all my passwords available with hardware protection (yubikey on desktop, secure enclave on iOS) in all locations.
by floathub
7/22/2026 at 7:45:16 PM
It doesn't even have to be something as bare-bones as pass. You can have a full-fledged password manager that is open-source and local-first. KeepassXC (and the OG Keepass) were always OSS and local-first. The original version of Keepass 1.0 for Windows was released long before Lastpass or 1Password[1], so we had an open-source local-first password manager before we had commercial cloud-based managers.[1] To be more accurate, although it was always proprietary, 1Password was also local-only at first, with syncing only supported by putting it on something like Dropbox. They only added native cloud syncing later and eventually made it cloud-first.
by unscaled
7/22/2026 at 4:19:21 PM
> That's the most annoying thing about password managers, and a major reason I still don't use them: there exists no password manager that is cross-platform (desktop/mobile in particular), local-first, and isn't sketchy or enshittified or otherwise on HN's current "don't use it, use <whatever> instead" list.I had the same frustration, I ended up with Keepass, the store is a open spec db[0] that has several clients, I use it across windows, android, and Linux without any issue and just sync with your favorite file sync tool.
by saratogacx
7/22/2026 at 4:15:29 PM
> That's the most annoying thing about password managers, and a major reason I still don't use them: there exists no password manager that is cross-platform (desktop/mobile in particular), local-first, and isn't sketchy or enshittified or otherwise on HN's current "don't use it, use <whatever> instead" list.I've used pwsafe for years now. I think it checks off all your boxes. Works on desktop and mobile. Local-first but allows cloud if you really want to. No ads or enshittification. Bonus: Open Source. Other Bonus: Not owned by BigTech or LittleTechThatValuesMonetizationOverSecurity
by ryandrake
7/22/2026 at 9:26:12 PM
> This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager. If you lose your passkey, you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email.This is why I don't bother with these if they have a weaker workaround, which will be open to remote hacking.
by gblargg
7/22/2026 at 10:54:32 PM
I am not happy about a trade-off which involves me having to cede control of my digital identity to 'providers' who will not give me access to it, in exchange for maybe not getting phished. If passwords continue to exist for a long time then this entire exercise is pointless as they can still get phished. If passwords go away and we can only use passkeys then you're only entry point to any kind of digital account is through one of the designated providers. If you don't have a provider that spans all of your platforms then you're screwed or have to manage multiple pass keys which is also stupid. Even the current crop of online providers as you illustrated in your post are unsecure and unreliable. No thanks.by jhhh
7/22/2026 at 4:54:03 PM
Wait a sec. My understanding is that passkeys are public/private keypairs. Public is in server, so even breaking into a server does not reveal the private key.The big risk with passkeys is storing the passkey where it will be held hostage. Don't store it in most single-ecosystem devices like Apple. Bitwarden can export, and I think 1Password can as well.
by dwheeler
7/22/2026 at 5:17:59 PM
That's where the attestation feature comes in. It allows them to force you into a hostage situations by restricting passkey implementation. There's a reason that was part of the spec from the get go but a passkey transfer system wasn't.by deltoidmaximus
7/22/2026 at 9:35:19 PM
> Passkeys are just passwords that require a password manager.Passkeys are passwords which allow a relying party to control what password manager you can use.[1]
by pseudalopex
7/22/2026 at 8:41:56 PM
> This is much, much simpler than you think it is. Passkeys are just passwords that require a password managerCool. So can I write down my passkey on a piece of paper and put it in a safe?
> you'll reset your passkey the same way you reset your password, probably with a "forgot my password" email
Cool. But what if I lose the passkey to my email account?
> and the passkey will be stored there and synchronized to all of your other devices
Cool. Surely backups and synchronization never fails.
> The weird part is that password managers provide no way for you to copy and paste your passkeys
Uh oh. So you are saying passkeys are not like passwords? Last time I checked, every password manager lets me copy and paste my passwords just in case.
> To present a passkey, you have to use a password manager
Uh oh. So you are saying passkeys are not like passwords, like at all? Last time I checked, I can just type in my password using a keyboard on all websites I visit.
> This makes it impossible to copy and paste your passkey to the wrong person
Uh oh. So it means I can't just give my password to a family member sitting in the opposite side of the room? Sorry mom, corporate has decided that you are trying to trick me.
> Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourself
Uh oh. So is there a registry of Major League Password Managers that are guaranteed to implement Corporate Strength Cybersecurity Measurements? Will I be blocked by services if I happen to have landed on a minor password manager?
by pibaker
7/22/2026 at 3:47:21 PM
> This makes it impossible to copy and paste your passkey to the wrong person (someone trying to trick you).It also, unfortunately, means it's not possible (via most passkey implementations) to back those passkeys up to paper. Which is quite unfortunate: backing up to paper is one of the most stable and human accessible ways of ensuring redundancy and continuity, an inevitable but also oft-ignored part of credential management.
Security folks would like to pretend "solving continuity" isn't a problem, or is a problem that doesn't need to be accessible.
by lelandbatey
7/22/2026 at 5:00:09 PM
> back those passkeys up to paperIs writing down passwords something people do? I have countless passwords saved over >20 years and I don’t think I’ve ever recorded one to paper. I even checked a couple of popular password management solutions and they don’t seem to have “print” functionality.
by no-name-here
7/22/2026 at 5:12:42 PM
Yes, this is extremely common, both as a continuity means and/or as a localized password manager. Know someone who uses a Rolodex for hers, which is funny and yet it works.Doesn't work well in office environments, but at home the local threat model is largely fine with this.
by syntheticnature
7/22/2026 at 6:22:35 PM
Yes. Old people constantly do it, since they have no hope of remembering 15 passwords. Sometimes, they can barely remember 1 (one).I've written down one: the master password for my Keepass database, along with instructions on how to get to and open that file. It's in a 'open if I'm no longer alive' envelope.
by Telaneo
7/23/2026 at 3:11:36 PM
Yes: Paranoid password printing with a Raspberry Pi
https://7402.org/blog/2020/paranoid-password-printing-pi.htmlby 7402
7/22/2026 at 5:09:26 PM
It is absolutely a thing people do. Google even offers a convenient printout as a way to provide account recovery.by cwillu
7/22/2026 at 7:01:53 PM
> Is writing down passwords something people do?Yes, it's pretty common.
by JohnFen
7/22/2026 at 5:18:21 PM
The passphrase to my bitwarden database is in my will. And a bitlocker decryption key is right beside it.by malfist
7/22/2026 at 5:28:52 PM
It is what the vast majority of people do.by tekla
7/22/2026 at 5:40:05 PM
I doubt if that’s true since the vast majority of people no longer have printers. Not even the vast majority of online people.by NetMageSCW
7/22/2026 at 6:23:22 PM
Both pens and pencils exist.by Telaneo
7/22/2026 at 5:49:31 PM
I was not aware writing down a password required printers.by tekla
7/23/2026 at 10:21:15 AM
> Passkeys are just passwords that require a password manager.How come I log into my corporate Windows laptop by typing a passkey instead of a user/pass combo?
by boobsbr
7/22/2026 at 5:44:20 PM
This seems like a consolidation of risk to rely on a password manager, especially software defined, especially if it relies on a password. I like the hardware token idea (yubikey). But even that seems cumbersome because you should be making a copy for safe keeping. And how do you securely do password recovery if most security questions can be obtained via osint or the reset links are sent to a site you are similarly locked out of is compromised?by giantg2
7/22/2026 at 5:34:11 PM
I love that you wrote 6 paragraphs and linked to a medium post all without actually answering the question posed by the comment you replied to.by throwaway-blaze
7/22/2026 at 9:42:20 PM
Yes, I did. When you set up a passkey on your phone in your password manager, you'll transfer it to your other device using your password manager.Either your password manager will automatically synchronize for you, or you can transfer your passkey to another password manager that will do the synchronization, via the finicky app-to-app transfer system (Credential Exchange Protocol). You can transfer from Apple to Bitwarden and vice versa.
The family sharing question was added later, but the answer is: all of the major password managers have finicky family-sharing features for passwords and passkeys.
For passwords, most people don't bother with formal family-sharing features, and just share passwords via copy and paste. For passkeys, you have to use the family-sharing features, which means you and your family member have to use the same password-manager vendor to share those passkeys.
It’s up to you to decide whether protecting yourself from being tricked into exporting your passkeys is worth sacrificing your ability to read them.
by dfabulich
7/22/2026 at 10:16:27 PM
> It’s up to you to decide whether protecting yourself from being tricked into exporting your passkeys is worth sacrificing your ability to read them.Until a relying party uses attestation to decide this for you.
by pseudalopex
7/22/2026 at 5:39:34 PM
> The weird part is that password managers provide no way for you to copy and paste your passkeys.The main feature of passkeys is that they can't be pasted into a website they shouldn't be pasted in to. That means you can't copy them, by design.
by robertlagrant
7/22/2026 at 6:17:12 PM
They're just text behind the scenes, so you can copy them if you really want to. KeepassX lets you do it, and got into a kerfuffle about it.[1]It's an impossible design. It's all just obfuscation, most of which is confusing to users.
[1] https://github.com/keepassxreboot/keepassxc/issues/10407
by Telaneo
7/22/2026 at 6:14:58 PM
> This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager.This is not true. There are device bound passkeys where the private key is stored in a HSM (TPM2.0, Android SE, or apple SE) instead of a hosted service (iCloud, Bitwarden.com). You can just add multiple Passkeys to a single site to have another backup device should your other one be unavailable.
by preisschild
7/22/2026 at 8:16:09 PM
Speaking about hardware tokens:If I have to go get the backup out of "secure" storage each time I want to add a new Passkey it's not really a backup.
The design should have allowed, even if it was just within only the purview of a single manufacturer, a method for the device to export an encrypted dump that could be reloaded onto a factory-new device. Heck, make it a value-added service that the manufacturer has to initiate and tie it to some real-world identity verification.
The idea of having to put backup devices in-hand regularly is a bad design.
Phone apps. get around this idiocy by backing-up the encrypted Passkeys to a hosted service.
by EvanAnderson
7/22/2026 at 9:40:15 PM
> If I have to go get the backup out of "secure" storage each time I want to add a new Passkey it's not really a backup.Yes.
> even if it was just within only the purview of a single manufacturer
> Heck, make it a value-added service that the manufacturer has to initiate and tie it to some real-world identity verification.
No.
by pseudalopex
7/22/2026 at 9:05:15 PM
Just have the 2nd device when you create any account. But have it away from the 1st device always. Just update 10s or 100s of accounts for every new device. Just never use sites which allows 1 Passkey.by pseudalopex
7/22/2026 at 8:15:14 PM
Oldschool KeePass ftwby Melatonic
7/22/2026 at 3:07:02 PM
This is the main reason I've avoided passkeys. I have these exact questions and there's no a clear explanation given for these. I don't want to lose access to important accounts.by cpburns2009
7/22/2026 at 3:22:35 PM
Agreed, it's the exact same as me, I haven't seen someone put it into such succint words before, so bravo.I think the reason is because I've anchored passkeys into my understanding of how 2FA works, and the pain of migrating 2FA from one phone to another.
So, I don't want to bother with it.
by dijit
7/22/2026 at 5:50:19 PM
use an app where you can backup the 2FA DB.https://f-droid.org/en/packages/org.liberty.android.freeotpp...
by pas
7/22/2026 at 5:51:20 PM
oh my god, so not the point.by dijit
7/22/2026 at 5:49:45 PM
> there's no a clear explanationthere's. it depends on how the site implemented passkeys.
I'm using multiple devices and passkeys via keepassXC. I haven't lost access or even got locked out of any accounts.
but it's like 2FA, and almost all sites have a clean fallback (backup codes) for 2FA.
by pas
7/22/2026 at 6:01:41 PM
> there's. it depends on how the site implemented passkeys.so. no clear explanation.
by thyristan
7/22/2026 at 6:48:17 PM
the same is true of passwords. some sites provide password reset some don't. how is that not clear?by pas
7/22/2026 at 7:16:27 PM
> some sites provide password reset some don'tI'm yet to see a site that doesn't provide a password reset (excluding websites without passwords). What inane webdev though that'd be a good idea?
by Telaneo
7/22/2026 at 8:24:07 PM
How do you sync the KeePassXC file?by Melatonic
7/22/2026 at 9:43:43 PM
I use KeePassXC, just not for passkeys. I used to use Dropbox but now I use Syncthing. I use a strong password and a key file that IS NOT synced.by cpburns2009
7/22/2026 at 6:53:56 PM
This is the #1 most common misconception I see about passkeys. They do not make it more likely that you will lose access to your accounts. They actually have nothing to do with account recovery. They are just a stronger primary factor than a password.Most providers continue to offer email-based recovery in the case that the end-user loses access to their primary factor, regardless of whether the primary factor is a password or a passkey.
And email based account recovery does not make the security advantages of passkeys disappear, which are:
- credential that's guaranteed to be unique
- credential that's guaranteed to be strong
- credential that cannot be phished (due to cryptographic binding to the domain at the time of credential creation)
- changes the incentives for compromising servers (there's nothing worth stealing from the server -- only public keys)
- if/when an app/website transitions to retiring password-based authN, then it will entirely eliminates credential stuffing attacks
And if the account recovery scenario in question is your Gmail or Apple account, then you would need to go through their account recovery flows regardless of whether you were using a password or a passkey:
https://support.google.com/accounts/answer/7682439?hl=en https://support.apple.com/en-us/118574
by jesseendahl
7/22/2026 at 7:01:17 PM
If you use something like 1Password it's very easy. It stores your Passkey and it syncs cross device. It's another thing but once it's set up it's less of a pain than using authenticator apps or having to find some random iPad that Google popped up an approval prompt on.by brentm
7/22/2026 at 7:43:08 PM
This is how I use them but you have to admit that this assumes 3-4 things about a user just to save them the hassle of supplying two factors at login time. It's also unclear to users if passkeys can be migrated from one password manager to anotherby sylens
7/22/2026 at 5:40:51 PM
In practice, because site owners know users are going to mess up having their passkeys on all devices, I've not seen any insist that a passkey _must_ be used, and you can always log in with your password (or worst case, email magic links) as a fallback.However, this negates the primary stated objective of passkeys, removing the possibility of users being phished, so I'm not sure how long that will remain the case everywhere.
I've also encountered sites that have a login with passkey prompt that then turns around and asks for TOTP 2FA or email confirmation anyway, which to me seems to negate the primary customer benefit of passkeys...
by Macha
7/22/2026 at 6:06:58 PM
> I've not seen any insist that a passkey _must_ be used, and you can always log in with your password (or worst case, email magic links) as a fallback.With the exception of Github, and banks.
by jolmg
7/22/2026 at 6:13:09 PM
Did you try it? That’s not correct. I just logged into GitHub with a password (+ 2FA), on an account that also has a passkey.No major bank revokes your password when you setup a passkey, either.
by dfabulich
7/22/2026 at 6:50:19 PM
Is "passkey" only supposed to mean devices that implement specifically U2F, WebAuthn, etc.? I would have thought TOTP and challenge-response hardware tokens to count, including cellphones with apps that implement such.As to
> No major bank revokes your password when you setup a passkey, either.
If we're talking about requiring 2FA via TOTP or challenge-response hardware tokens or banking apps implementing such, that depends on the country. It's the status-quo in some places. Some banks even put the input field for the token output as a third input in the login form on their website because all customers have them. The rest separate their login form in multiple steps, but they likely require it of all customers too.
by jolmg
7/22/2026 at 7:14:39 PM
> I would have thought TOTP and challenge-response hardware tokens to countThose are absolutely not passkeys. Passkeys are just WebAuthn (from what i can tell).
by Telaneo
7/22/2026 at 7:22:39 PM
Such a generic word. I imagine there are tons of CLI utilities out there with a --passkey option that refer to simply files with a key inside. Kind of crazy that it's being used to mean specifically devices that implement a specific protocol.Kind of feels like "crypto is a type of currency and not all cryptography", or "SQL Server is a specific product of Microsoft".
Wonder if how it happened this time was people read the specs and explanations of WebAuthn, saw "passkey", never seen that word before and assumed it's only ever been used in the super narrow context of WebAuthn so it can only mean that. Maybe "header" can only ever mean "HTTP header".
Thinking about it like that, it may be more like how "latte" is specifically espresso with milk (it's really just milk), or "queso" is specifically cheese dip (it's really just cheese of any kind), or "masa" is specifically made of corn (it's really just dough of any kind, or it's mass like atomic mass is masa atómica).
by jolmg
7/22/2026 at 8:16:28 PM
Isn't the standard term for what you're referring to a "keyfile"? Google Trends also indicates nobody was caring about "passkey" before 2022.by Macha
7/22/2026 at 7:04:26 PM
"Passkey" refers to a very specific authentication method. TOTP, etc., don't count.by JohnFen
7/22/2026 at 6:09:47 PM
Porkbun tooby LoganDark
7/22/2026 at 3:11:43 PM
Same here, also what if I lose the device?I can safely write down a password on a piece of paper and keep it somewhere phyisically safe.
Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.
by juancn
7/22/2026 at 5:59:34 PM
password managers do the backup for you based on how you set them up (eg. to your google drive, or to a simple SFTP/FTPS/S3 URI)those that don't have this built-in (eg. KeePassXC) recommend using Dropbox or some external sync mechanism
but the keys are stored in a file, which you can back up.
> all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor
no, not at all. it still gives you better UX, because when you use the passkey you know it's the site you want to log in to. (because there's mutual authentication.)
by pas
7/22/2026 at 6:50:47 PM
>Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.Most providers continue to offer email-based recovery in the case that the end-user loses access to their primary factor, regardless of whether the primary factor is a password or a passkey.
And email based account recovery does not make the security advantages of passkeys disappear, which are:
- credential that's guaranteed to be unique
- credential that's guaranteed to be strong
- credential that cannot be phished (due to cryptographic binding to the domain at the time of credential creation)
- changes the incentives for compromising servers (they're nothing worth stealing from the server -- only public keys)
- if/when an app/website transitions to retiring password-based authN, then it will entirely eliminates credential stuffing attacks
by jesseendahl
7/23/2026 at 7:50:25 AM
Hopefully your e-mail is not tied to the passkey that you just lost.by spaqin
7/22/2026 at 7:47:29 PM
That doesn't really explain if I can use said website on my phone with a password if I login with a passkey on my computerby realusername
7/22/2026 at 6:27:52 PM
2FA secrets can be backed up, and everyone should do that, for the same reason you'd want to do it with passwords.Passkeys can too, but there it's even more obfuscated than with 2FA.
by Telaneo
7/22/2026 at 3:27:28 PM
You do the same as you do when you lose your SSH key. Restore from backup and move on with your life.Why is there so much misinformation nonsense around passkeys?
by izacus
7/22/2026 at 3:38:16 PM
How do you use a restored passkey from backup? Aren't they locked to the device?by cpburns2009
7/22/2026 at 4:10:41 PM
That's all I want to know. How do I restore from a backup? Specifically, a backup that I make to a medium I control, like a piece of paper or a burned CD-R in a safe deposit box. If I could get a good answer to that, I could be onboard. But from the conversations that I am getting here, it looks like only certain managers allow it, and with device attestation, they could be banned at any moment by any website with no recourse.by fhdkweig
7/22/2026 at 5:24:01 PM
> * and with device attestation, they could be banned at any moment by any website with no recourse.*Isn't this true of any authentication method? It doesn't seem unique to Passkeys.
by nozzlegear
7/22/2026 at 5:33:37 PM
Now that I think about it, you are right. But if they could ban my use of written passwords as easily as banning my use of a particular passkey device, why go through all the extra hoops to just be as vulnerable as before? This seems like a whole lot of extra work to do that gains me nothing.by fhdkweig
7/22/2026 at 7:57:06 PM
I think it is important to explain why I and others are so reluctant to this.In security, you identify reasonable threats. You can't protect against all of them, and some may even be contradictory.
When I get a call on my phone that says "Potential Spam", I have never even once in my life decided to run over to my list of passwords and hand them over to the President of the Spanish National Lottery. Not even once.
But on many, many occasions I have dealt with a simple system that was replaced by a more complicated one and something in that Rube Goldberg machine broke down and deprived me of access to money, email, even a parking permit to my office.
Passkeys seem to protect against the former case that has never happened to me, while increasing the chances of the latter that has happened way too often.
by fhdkweig
7/23/2026 at 4:05:19 PM
You aren't considering all the advantages of passkeys.Passkeys only work on the domain they were created for. Password managers usually default to providing the password of the current website, but nothing stops you from pasting that in at any site.
There is no danger to the credential db being stolen. The website only has your public key.
A website using passkeys can support cross device authentication which allows you to login to on a computer without it ever seeing your credentials.
I'm sure that isn't a complete list. My last point, despite all the comments here, there is no vendor lock in. Bitwarden provides an open source self hostable option. On both Android and Windows 11, you can change your passkey provider to Bitwarden. A proper passkey implementation, should allow multiple passkeys to provide access. My bank does exactly that.
by zdp7
7/23/2026 at 10:05:20 PM
> Passkeys only work on the domain they were created for. Password managers usually default to providing the password of the current website, but nothing stops you from pasting that in at any site.Considering how my bank has changed the sign-in domain three times (as well as some other sites), I consider this a feature, not a shortcoming.
by Izkata
7/22/2026 at 9:28:57 PM
It should go without saying that, while you've never given your passwords over to the President of the Spanish National Lottery, there people who do get duped into doing exactly that all the time.by nozzlegear
7/22/2026 at 9:50:59 PM
I don't like the default option being to treat everyone like they are a moron. I don't like being treated like a moron.by fhdkweig
7/22/2026 at 9:29:57 PM
I don't think the goal of passkeys was ever about making it easier to back them up or protecting you from websites that could ban you. I think (correct me if I'm wrong) the goal was always to make it nigh impossible for attackers to phish your credentials.by nozzlegear
7/22/2026 at 5:19:37 PM
If you use Safari, they're locked to all of the devices on your iCloud account, not to a single device.by nozzlegear
7/22/2026 at 8:01:25 PM
I login to 1Password on another device and all passkeys are there, and usable.The OSes I use where that works fine:
- Android - Windows - Linux - macOS - iOS
by izacus
7/22/2026 at 5:14:37 PM
How? Where are they stored? Which password protects them? How do I back them up? How do you move them to another device? Can I print them out on paper as a last resort measure?Nobody fucking knows.
by juancn
7/22/2026 at 5:54:54 PM
it depends on which password manager you are using. if you use Google's then it gets backed up to your Google account.BitWarden, KeePassXC, and probably a bunch of other password managers have very thorough support for import-export, automatic/periodic backup, sync/merge, etc.
by pas
7/22/2026 at 9:07:39 PM
And that's a HUGE issue. SSH keys are easy to manage in comparison to PassKeys.by juancn
7/23/2026 at 12:35:57 AM
Are they easier to manage if you have a few hundred SSH keys?by tzs
7/23/2026 at 7:00:08 AM
Why are you making stuff up? Of course people know where they're stored in password managers and how they're synced.by izacus
7/22/2026 at 3:12:46 PM
Sounds like something security services would love people to use. Instead of using wrench to extract the password - and distressed person may lose memory, they can just locate the passkey.by varispeed
7/22/2026 at 3:19:29 PM
Nobody is safe from a nation-state "attack" they'll just go threaten your providers to give up your data. Passwords written on paper are probably safer than a centralized password manager for almost every circumstance other than a government coming after you.by msandford
7/22/2026 at 3:28:49 PM
Papers: Safe - yes. Easy to lose/misplace: also yes.by odux
7/22/2026 at 3:36:22 PM
Humanity having millennia of experience securing them: also yes.by TeMPOraL
7/22/2026 at 5:41:53 PM
I’d like to see them threaten Apple or Bank of America.by NetMageSCW
7/22/2026 at 3:45:04 PM
My issue is that they're touted to the consumer as secure, and they're not really doing much more than a complex password.How do you generate a new key if you need one? Same process as a password reset. Does it prevent session stealers? Not at all.
Its "benefit" is grandma can't read it to an attacker. OK, well can grandma click a link and have a session stealer bork her life instead? Yeah, and attackers know that and just shift methods. Session stealing isn't a sophisticated attack, and so all that's being done is shaving a cost on PW resets in the interest of shareholder value, at the cost of security theater and locking up your keys in a single domain that holds control over our access to everything.
by 3RTB297
7/22/2026 at 5:34:26 PM
There is security value. A passkey will not work anywhere except the actual website. Fake look a like sites can't get the credentials. Evidently they can trick you into authorizing their device.by zdp7
7/22/2026 at 6:08:00 PM
That's also how any good password manager works. You'd have to manually copy-paste the password to get around the same-site fill restriction (whether it's autofill or manual fill).by harshreality
7/23/2026 at 12:50:38 AM
Passkeys have an advantage in that the server doesn't have your password and every passkey should be unique.by zdp7
7/22/2026 at 6:04:18 PM
Sure? MitM isn't a new kind of attack, and I'd be surprised if the ball-of-wax-and-javascript that is WebAuthn isn't vulnerable to that...by thyristan
7/22/2026 at 6:34:01 PM
This is one of the key security features of passkeys. I did a little searching and the work around is to do a standard fake website that prompts for your standard credentials. That should be a fairly simple fix. Require access from a new device to be authorized from another source with an explanation that they will never request this info.by zdp7
7/22/2026 at 3:22:21 PM
Listening to Yubikey and OnePassword talk about this, they actually say "One Person, One Device". Which really speaks to their failure to understand their users.by helix90
7/22/2026 at 3:57:18 PM
Because the original FIDO/WebAuthn standard was built for device bound credentials. They imagined unique keypairs tied strictly to a specific piece of hardware. Synced passkeys were a compromise, mostly driven by Apple and Google, because per-device credentials are too much friction for general use. It's not that they failed to understand users, it's that they incorrectly assumed the level of inconvenience people are willing to tolerate to be textbook secure (the answer is almost zero inconvenience).The device bound model also completely falls apart in the enterprise, fails to address shared devices and shift workers where employees share the same PC under the same OS profile, now you're back to needing good old fashioned SSO w/ physical MFA (Yubikey) to attest who the user is in addition to attesting the device itself.
Before synced passkeys, the actual standard is a unique key pair per device. The key pair on my phone shouldn't be synced to my laptop, my laptop should generate it's own key pair.
by thewebguyd
7/22/2026 at 3:25:09 PM
I would love to see what you’re referencing, can you provide a link or citation to that quote?by gortok
7/22/2026 at 3:40:33 PM
the video requires signing up for Yubikey spam. https://app.livestorm.co/yubico-y/securing-trusted-actions-a...by helix90
7/22/2026 at 4:14:22 PM
That is odd, I regularly use my Yubikey on multiple devices, that was the biggest draw.by astrospective
7/22/2026 at 5:21:40 PM
The Yubikey is the "one device". But most people don't buy Yubikeys so the "one device" is, in practice, a smartphone.by AlexandrB
7/22/2026 at 6:41:20 PM
Even then, unless you use one for work, where work can issue you a new one if you lose it, you're going to need (at least) two Yubikeys if you want to go that route, because not having a backup is a bad idea.by Telaneo
7/22/2026 at 3:24:44 PM
I think the intended workflow is you login with your phone and that device is now the authority that allows other devices to issue their own passkeys.In my opinion it's a bad plan, because it elevates certain devices to privileged status, if you lose your phone you are hosed.
Passkeys should be allowed to be synced between devices and stored on password managers in the cloud. I am making my own password manager for my personal use, but have not delved into passkeys.
by throwawayffffas
7/22/2026 at 6:08:59 PM
> Passkeys should be allowed to be synced between devices and stored on password managers in the cloud. I am making my own password manager for my personal use, but have not delved into passkeys.
by qlte
7/22/2026 at 6:28:15 PM
Yeah that's all hackery I think, if you read at the specs there is always a device involved, bitwarden and company just pretend to be a device or have an extension that just ignores the spec.by throwawayffffas
7/22/2026 at 7:17:38 PM
I get your problem, i don't really accept it as valid. Passkeys were always supposed to be fungible. You have one in your iPhone, a different one on your desktop. A third in your significant other's phone. All stored in the hardware tpm equivalent.You can have 7 passkeys. You can have 14.
The real failure of passkeys (emphasis on the s!) is that people think they must only have one.
by halJordan
7/22/2026 at 7:44:52 PM
I don't think that would work either.Let's say I have a new account and a single Passkey in the TPM of PC1. I want to log in from PC2, too. How can I do that? (I know there is some trickery with Bluetooth, but I haven't seen anything supporting it, and desktop PCs usually doesn't have Bluetooth connectivity.)
AFAIK some browsers can do some magic to use a Passkey from your smartphone on a PC, but you need to log in to the same browser-sync account from both device (which brings back us to the same issue).
Also the whole thing becomes a mess when you change devices. You need to log into all the services you have ever used to delete the Passkeys from devices you no longer have, and you need to add a new passkey from a new device you bought to all the services you use.
by raron
7/22/2026 at 9:09:11 PM
Can these services not use the same fallback mechanism that already exists for non-passkey logins? i.e. an email with a 1-time code or similar. Yes that somewhat defeats the purpose of passkeys but that option is going to exist for a long time regardless of passkey adoption.If you don't want to downgrade security, how about requiring confirmation from another session that is already logged in using a passkey? e.g. You try to log in on PC2. A prompt appears with something like "confirm this login from [PC1, etc.]". You log in on PC1 using your passkey. The service recognizes that the login id definitely you, or at least someone in possession of your physical device and login method for that device. Therefore, it then allows PC2 to register a new passkey. Kinda similar to how google confirms new logins by sending a notification to your phone.
by TheBicPen
7/22/2026 at 10:49:50 PM
That could work, but then the service needs to implement complex non standardized authentication mechanism outside of Passkeys. You will have 14 different services with 15 different options. I don't think that's really user-friendly.Also it could be vulnerable to MFA fatigue attack, if people would constantly get new "confirm this login" popups, they would press anything to make it go away.
So you would need something that is explicitly initialized from a trusted session, then you need something to connect the trusted session to the new login. If you want that to be user friendly you need some short codes and can't rely on QR code / Bluetooth, or two-way interaction. And that brings up the phishing / MitM attacks again.
by raron
7/22/2026 at 8:04:44 PM
You generate another passkey is your answer. How do you do that? The exact same way you do today. Why would you need to delete invalid passkeys? You wouldn't.by halJordan
7/22/2026 at 8:54:15 PM
> You generate another passkey is your answer. How do you do that? The exact same way you do today.How can I do that, if Passkeys are the only option to log in?
If I can just use a password to log into a website without Passkeys, then Passkey is useless and doesn't add any security benefit.
> Why would you need to delete invalid passkeys? You wouldn't.
I sell my old (and no longer updated) phone or PC and don't want someone to get access to my account by getting access to the secret keys.
An non-revocable authentication mechanism is just stupid.
by raron
7/22/2026 at 9:38:22 PM
> How can I do that, if Passkeys are the only option to log in?It is not feasible to remove password login or some other recovery login method.
> If I can just use a password to log into a website without Passkeys, then Passkey is useless and doesn't add any security benefit.
It isn’t useless, point is you don’t get to type in your password on a device that has passkey generated already, or get phished on a fake web address for example.
> I sell my old (and no longer updated) phone or PC and don't want someone to get access to my account by getting access to the secret keys.
Passkeys are meant to be protected by either PIN or biometrics, however they are also meant to be revocable on the web, at least they are for services i’ve been using with passkeys.
by winstonwinston
7/22/2026 at 10:37:49 PM
> It is not feasible to remove password login or some other recovery login method.Then passkeys doesn't provide any real value if you have other less secure recovery option.
Let's say I have a bank account, going to the branch and doing an in person ID check is a valid recovery option, but nobody would want to do that just to log in from a new device.
> It isn’t useless, point is you don’t get to type in your password on a device that has passkey generated already, or get phished on a fake web address for example.
That's solved by letting the browser to remember the passwords.
> Passkeys are meant to be protected by either PIN or biometrics, however they are also meant to be revocable on the web, at least they are for services i’ve been using with passkeys.
PIN and biometrics doesn't have any inherent security. They rely on some hardware (or software separated from main system) feature, and even those can have vulnerabilities.
by raron
7/22/2026 at 11:59:43 PM
Using strong password as you suggested is a solved problem for your use case, but that is not universal. Passkeys provide universal security for all.Also PIN or biometrics verification to access passkey from device bound TPM or security enclave solved the problem you implied might happen, such as losing your device. How do you protect your password manager, if any?
> even those can have vulnerabilities.
We shouldn’t just give up because everything is inherently insecure.
by winstonwinston
7/23/2026 at 5:29:52 AM
> We shouldn’t just give up because everything is inherently insecure.True, but no sane way to mass revoke Passkeys from stolen / lost device is just bad design.
by raron
7/22/2026 at 7:35:12 PM
> [...] people think they must only have one.That's the real failure? I think the real failure is that people must have _more than one_. I thought so hard to add all my credentials to 1Password. Now people tell me I should use a Yubikey (or better two or three of them). What do you think, I'm going to register a couple of hundred accounts times three for something I already have (my password manager)?
The real advante in passkeys is in allowing me to log in into a service on a foreign device without typing [my password], which is (honestly) something now sane person should ever do.
by chrisandchris
7/22/2026 at 8:06:12 PM
Again, I'm attracting people who fundamentally fail to grok passkeys . That's cool, but doesn't entitle you to anythingby halJordan
7/22/2026 at 7:31:34 PM
Again, is this true for all major sites that support passkeys? And how do you set it up? My passwords are automatically synced between my devices, how to I achieve the same thing if I set up an account with a passkey?by tsimionescu
7/22/2026 at 8:07:34 PM
Why would you take one passkey and move it between devices? Generate a new one. They're fungible. You set it ask to the exact same way you do today. It's not a problem.by halJordan
7/23/2026 at 1:08:25 AM
Again, do all major sites allow you to register 6-10 passkeys? Not asking if they could in principle, but do they in practice do it? And how easy is it to log in with a new device to generate that passkey? Do I have to jump through hoops on my laptop, second phone, secondary browser, and so on?Finally, if it is easy to register a new device, how does the anti-phishing still work? Can't an attacker just convince me to use whatever means I would normally use to register a new device, instead of an existing secure passkey?
by tsimionescu
7/22/2026 at 8:49:08 PM
This assumes all services let you generate new passkeys with no hassle, which is not true.by pibaker
7/22/2026 at 3:45:22 PM
I think the point is that Passkeys are not supposed to be as precious as passwords. You're supposed to have a brand new one for every device/application combination. So they are just login cookies at this point, and haven't even come close to replacing passwords because you need to know your password to get a new passkey every time you log in.Now, is that the official stance? I don't know; but it's _absolutely_ what every current implementation suggests the companies deploying this stuff want.
You can make passkeys better. Like me, you can install a well-funded password manager (well-funded, because it needs the engineering effort behind it to keep up with the ever-changing passkey apis on every platform in the world; screw up and oos, can't log in today!). Then you have one passkey per remote service, and just have to make sure 1password is _always_ installed and perfectly integrated. Easy!
by pkulak
7/22/2026 at 4:31:59 PM
There are a couple of problems I have with that. 1) Many websites limit the number of passkeys I can link to my account. Some only allow 2 or 3. I have more devices than that. 2) If I am supposed to create a new passkey for every device, how do I login in the first place? Most websites currently fallback to password login which defeats the security benefit of using passkeys in the first place.I currently only use passkeys for a few websites that have awkward password login workflows or do not autofill properly from my password manager. I just have a single passkey for each that is synced via Bitwarden. Currently, I see passkeys as using an electronic biometric lock on the front door while passwords are still regular locks on the backdoor. The biometric lock on the front door does not do much for security when the backdoor still exists and I have come across very few websites that support only allowing passkeys. And those that do still run into problem 2 listed above.
by MattTheRealOne
7/22/2026 at 6:31:22 PM
Yeah, I agree. My policy is much the same as yours: set a passkey only when a site makes logging in with a password such a PITA that the PITA of a passkey becomes the easier option. Google comes to mind. They seem to actively not want anyone to log in. At some point sites will start to 2FA you even with a passkey, but we don't seem to be there yet.by pkulak
7/22/2026 at 6:36:42 PM
I find it abjectly terrifying. Like if I log into your site with a Passkey what happens if my device breaks? What if some big tech company decides to nuke my account for no good reason?by PaulHoule
7/22/2026 at 3:24:31 PM
> If I accidentally set up a passkey on my phone (let’s say I use Safari one day instead of my go-to, Brave), can I still log in without that passkey on other devices?N=1 and I'm sure I'm holding it wrong, but I can only log in to ADP to request PTO from my personal laptop because I set up an iCloud passkey, work laptop does not allow access to iCloud keychain, and you can't request PTO from mobile.
by 1-more
7/22/2026 at 5:29:20 PM
Although that's more a failure of your workplace's security policy than of the Passkey itself. It makes sense that the passkey doesn't work if you can't access the place the passkey is stored.by nozzlegear
7/22/2026 at 8:32:38 PM
yeah but my problem is that I can't fall back to logging in to ADP with a password. Maybe there's some way to fix this? IDK.by 1-more
7/22/2026 at 5:27:56 PM
It makes sense for a work device that is off network/domain, but then it is your primary/only means of interfacing with services. Then you can consolidate under a Windows Hello passkey or something else.The second you have a second device to log in from they are useless. The second you want or need to share a credential (smart or not) they are more work than a password.
The passkey trend seems lead by platforms that want to make it easier to get or stay logged in, Netflix type companies that want to prevent account sharing, and those that value convenience (if one device) over security.
by selicos
7/22/2026 at 3:14:50 PM
You can store your passkeys in Bitwarden or Keepass vault. Then you can use them through Bitwarden or Keepass apps on any other device. Been using passkeys like this for several years, and it works pretty seamlessly. With Keepass vault, I even have an offline copy as backup.by microflash
7/22/2026 at 3:28:26 PM
If you store the key in Bitwarden or Keepass, what makes it different from a password?by RHSeeger
7/22/2026 at 3:36:29 PM
The difference is you can't just copy and paste the private key into a phishing website. The login process validates your private key and logs you in.Also since the service does not store your private key, it is more resistant to data-breaches as that is one less potential breach source.
by kodt
7/23/2026 at 8:02:30 PM
But most password programs do this too, if you install the plugin (which you pretty much need if you want those same programs to do the passkey thing, anyways)by RHSeeger
7/22/2026 at 3:38:27 PM
They are bigger. Not as easy to guess. More like pretty impossible. It's like not letting the user choose the password. That way they can't have a bad password.by BadBadJellyBean
7/23/2026 at 8:04:44 PM
It is relatively easy to pick a password length/composition that's pretty much impossible to guess, too. So the benefit you're list is for the company (that has to deal with people picking bad passwords), not the person using their site.Heck, the company could easily say that your password needs to be 128 characters long and use multiple types of characters - and tell you to use a password manager (that both generates and fills in that information for yet).
by RHSeeger
7/22/2026 at 4:51:06 PM
But these same services are the reason why my passwords are as short as they are. They made me use 'short passwords' by putting upper limits on them.by Aerroon
7/22/2026 at 4:33:57 PM
Main difference is that my banking website doesn't make me use SMS 2FA if I use a passkey to log in.by Marsymars
7/22/2026 at 3:21:29 PM
If you save it via Passwords app, it'll be iOS / macOS mainly, but you can unlock with any Apple device that supports Passkey / Passwords app (so likely modern + reasonably updated) the easiest. If you want it to work "everywhere" then you CAN use your iOS / MacOS Passkey, it will show you a QR code, some places poorly support this, I believe both devices need bluetooth, and then it will authenticate it.Linux is the only oddball here, I had issues getting this flow to work.
If the UX for Passkey improves, I will go all-in on it, I'm at the point I'd love to just completely block passwords from accessing my account, unless I explicitly enable it temporarily by logging on via passkey, I wish some sites would let me lock my account to this level, it would be better. Passwords feel like they just wind up all over the web.
Weirdly enough you can store multiple passkeys for a given domain, which can get confusing in some cases if they dont have normal names tied to them.
Edit: Originally I thought Passwords from Apple was iOS / macOS only, but its not! So I have been editing my original message, sorry for the confusion, I had forgotten that I can login on Windows with my Passkeys from Apple's ecosystem.
As another poster noted, you can transfer them out of Apple's ecosystem too!
by giancarlostoro
7/22/2026 at 3:23:31 PM
> Linux is the only oddball here, I had issues getting this flow to work.Take a guess why.
Passkeys are just a trick for vendor lock-in disguised as a security practice.
by reddalo
7/22/2026 at 3:25:12 PM
They are, however, completely unphishable, which is a big plus IMHOby frizlab
7/22/2026 at 3:24:28 PM
Firefox just didn't support it cleanly, I think Chrome did, I don't remember. Apparently it's just due to Linux not having a native passkey implementation. Dang.Edit:
Apparently BitWarden should work, but my particular passkey was not on there.
by giancarlostoro
7/22/2026 at 5:00:23 PM
> Apparently it's just due to Linux not having a native passkey implementation.Excuse me? The infrastructure for "an apps is trying to login with a private/public key pair, and right now it needs the private key to encrypt some part of the transaction" has existed on Linux since it began.
The problem, as best as I can understand it, is that some/all browsers are not treating passkeys as an extension of the key system that began with ssh(1), even though technically speaking, they are.
by PaulDavisThe1st
7/22/2026 at 9:08:31 PM
I use Bitwarden on Linux. There is no option to do anything with a passkey I have stored there except delete it.by ghostly_s
7/22/2026 at 3:27:35 PM
Unpopular opinion but correct the whole thing has been designed to lock you to devices they make and have themselves be the arbiter of your authentication.If that wasn't the intent they could have make the thing work like ssh keys, encrypted at rest, you can take them wherever you want.
by throwawayffffas
7/22/2026 at 8:28:24 PM
I don't think that's the unpopular opinion, I think that's the standard opinion, outside of the corporate security cloister.by kbelder
7/22/2026 at 4:50:09 PM
It is not Apple's job to implement Passkey into Linux, that is up to the Linux community to build up and figure out, and then for Firefox to implement it on Linux. On the other hand, Chrome just works with it, so maybe Firefox either implements it for Linux in-house, or figures out an existing initiative they could invest resources towards and help to prop up so they can integrate against it on Linux.by giancarlostoro
7/22/2026 at 4:57:09 PM
My issue is not the lack of Linux support, my issue is the dependence on hardware components, that are distributed by a small group of incumbents, that is pretty much baked into the spec.What they want is to lock your identity to your android and/or iphone devices.
by throwawayffffas
7/22/2026 at 3:25:46 PM
What are you talking about? I can literally export all that data to another OS or password manager. Takes a whopping single click.by moi2388
7/22/2026 at 3:37:49 PM
Only to other proprietary systems within the FIDO Alliance that you don't own or control.Additionally passkeys allow services to detect and ban specific password managers, so have fun when the only approved managers that works consistently across all services are Google/Apple/Microsoft. There is already a list of "bad" clients here https://passkeys.dev/docs/reference/known-issues/
by debazel
7/22/2026 at 7:48:16 PM
Again, what are you taking about? There are open source implementations available. I can write my own. They do work. This list just shows some which do not actually implement the spec correctly.Also moving the goalpost. The post I replied to said I couldn’t export it. I absolutely can, and have, with a single click. To another provider. It’s really not a big deal.
by moi2388
7/22/2026 at 10:26:57 PM
> This list just shows some which do not actually implement the spec correctly.KeepassXC was threatened to be blocked.[1]
[1] https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
by pseudalopex
7/23/2026 at 9:02:35 AM
Because they were exporting secrets in plain text. And they didn’t threaten, they said relying partners (so the site itself, for example GitHub) might block them.This is not some conspiracy, and again has nothing to do with the fact that I can export my key passes
I don’t get the activism here
by moi2388
7/22/2026 at 3:29:13 PM
I didn't realize this was supported, I'm kind of favoring Apple's Passwords app since you can lockdown your account and they are very on top of someone accessing anything of yours. Any time I power on an iPad I havent used for months they tell me a new device can read my texts type of thing, which is a nice paper trail.by giancarlostoro
7/22/2026 at 3:37:00 PM
I wouldn't favor an application that is locked to a big player account (Microsoft, Apple, Google) where a ToS violation for something unrelated may lock you out of all services, passwords/keys included.by 0x1d7
7/22/2026 at 7:49:17 PM
Yes me too. And it works great. I do make a backup of it to another provider once in a while though, just in case.by moi2388
7/22/2026 at 4:30:19 PM
Also note this from the spec:> A Public Key Credential Source’s generating authenticator determines at creation time whether the public key credential source is allowed to be backed up. Backup eligibility is signaled in authenticator data’s flags along with the current backup state. Backup eligibility is a credential property and is permanent for a given public key credential source. A backup eligible public key credential source is referred to as a multi-device credential whereas one that is not backup eligible is referred to as a single-device credential. See also § 6.1.3 Credential Backup State.
by throw0101d
7/22/2026 at 3:35:36 PM
Windows also has the Apple Password app.https://support.apple.com/guide/icloud-windows/set-up-icloud...
by 0x1d7
7/22/2026 at 5:38:33 PM
I use bitwarden[0]. It covers all cases and devices in question.As a bonus, I self host using the open source vaultwarden[1] server implementation, which is packaged in alpine linux.
[0] https://bitwarden.com/ [1] https://github.com/dani-garcia/vaultwarden
by seemaze
7/22/2026 at 5:10:13 PM
For me, it is "how many passkeys can I have for the same site?", and "how do I revoke them?"Worse, I'm still using LastPass -- but migrating over to Chrome password storage as it syncs between phone and laptop. LastPass doesn't give you the option to not use it for passkeys. It might be the thing that causes me to finish the migration away from it.
by pjsg
7/22/2026 at 4:50:18 PM
I can't speak to all of your browser combinations, but most desktop browsers can present a QR code when logging in with a passkey. I keep my passkeys in a password manager synced between my phone and personal computers. On my work computer, where the password manager is not installed, I can still use passkeys by scanning the QR code with my iPhone's camera app.by mdavidn
7/22/2026 at 3:16:52 PM
Answer to almost all of your questions is that it entirely depends on the service what kind of auth implementation they offer. I personally have completely adopted passkeys and use them with every service that allows it.I use ProtonPass and have made it the default password store on every device and browser. This way all passkeys get stored in proton and I can login from any other personal device with proton setup.
by owaislone
7/22/2026 at 3:18:14 PM
> ...it entirely depends on the service what kind of auth implementation they offer.I think that's exactly the problem. These are all answerable questions, but getting those answers is confusing for most people.
by summermusic
7/22/2026 at 3:23:38 PM
Also from experience, most sites will implement it in every wrong way possible.For example, all the major sites that allow the total of 1 active TotP authenticator app - trying to add one forces to delete the other. Which is fine while you have only one phone and aren't in the process of switching to another one.
by TeMPOraL
7/22/2026 at 5:39:10 PM
With foresight you can get around this since you can reuse the TOTP seed values.The annoying thing is so many services don't even support TOTP. They either want their own proprietary app, still insist on SMS, some of them even try to get you to use voice prints!
by deltoidmaximus
7/22/2026 at 3:24:38 PM
> These are all answerable questions, but getting those answers is confusing for most people.It's the same answer when someone asks 'how am I supposed to have a different password for every site' and 'how am I supposed to remember a password of X+ characters.' Use a password manager. Pretty sure every major one supports passkeys by now.
by mhurron
7/22/2026 at 3:40:12 PM
So passkeys achieve nothing if you can already use strong, secure, random passwords stored in a password manager?by cpburns2009
7/22/2026 at 3:47:47 PM
Write it down on a sheet of paper and put the paper in a safe place. As a bonus, I can have multiple copies in multiple places. It is simple, easy, and I have been doing it all my life. I see no reason why it has to be more complicated than that.by fhdkweig
7/22/2026 at 3:26:56 PM
Password managers are themselves cross-device footguns and I could easily write the same headline for them myself. I've been working in tech for 20 years now, and I don't use them.ETA: Well I do use auto-fill in browsers/mobile, but funny thing about this, I have three running on my phone[0], they all activate at the same time, and they contain mostly non-overlapping set of credentials, and I got tired of trying to sync them together, so I just look up passwords manually one by one in each and use clipboard to transfer the credential once I find it.
And I had to stop using passkeys because they interact with this split-brain system in unpredictable ways.
--
[0] - Specifically: Google Password Manager / Google Autofill / whatever they call it, Samsung Pass / Samsung Wallet (they're sort of but not the same?), and auto-fill built into Firefox.
by TeMPOraL
7/22/2026 at 5:27:09 PM
Password managers for passkeys have a huge problem when dealing with any kind of remote support or working on someone else's hardware - you can't just copy/paste or type in the passkey so you're forced to install the password manager on a family member's/stranger's/employer's PC or do what? I'm not even sure. At least SSH keys have forwarding when you ssh to a remote machine, how do you "forward" a passkey?by AlexandrB
7/22/2026 at 5:34:50 PM
With Apple's Passwords app, you can create "groups" for passwords and passkeys and share them with people. Once shared, the passkey/password automatically fills as if it was that person's own.I have a "Family" group in my Passwords app where I share passwords and passkeys with family members for exactly this purpose.
by nozzlegear
7/22/2026 at 5:32:03 PM
Don't think it's any more confusing than e.g. logging in with an email address and password, or logging in with email + code, etc. A website's auth is usually a black box that they don't explain, and the only reason people find passkeys confusing is because they've been conditioned to enter passwords instead.by nozzlegear
7/22/2026 at 5:31:51 PM
Totally in the same boat, passkeys seem to massively increase the risk that I will lose access to my data.by rpdillon
7/22/2026 at 6:53:59 PM
I've taken up the strategy of telling any less-technical person who asks me about passkeys that they are the mark of the beast, intrinsically evil, and should be avoided at all costs, and I encourage all y'all to do the same.Maybe, at some distant point in the past, there was a plan for a whole system of intercommunicating implementations of passkeys. That is no longer the case. The moment that they decided to include the information necessary to only allow the use of certain passkey vaults in the protocol, and then use that capability to threaten to lock out certain vaults that dared to let users actually be in control of THEIR OWN DAMN CREDENTIALS, it invalidated the entire project in my eyes. Passkeys cannot be trusted, they are designed to let entrenched powers hold your authentication hostage, and should under no circumstances be allowed to take root in the computing ecosystem.
by OkayPhysicist
7/22/2026 at 8:54:48 PM
>...they are the mark of the beast, intrinsically evil, and should be avoided at all costsThat's basically my recommendations to people.
1. Avoid using them if possible.
2. If you have to use them, make sure you have a password login to fall back on.
3. If the site forces you to use them, make sure you don't use it for any thing you rely on.
by kbelder
7/22/2026 at 5:00:34 PM
(small parenthesis, please consider to _not_ use lastpass given they have had so many security incidents https://en.wikipedia.org/wiki/LastPass#Security_incidents )by shinryuu
7/22/2026 at 3:29:23 PM
I use ProtonPass and afaiu it just syncs the passkeys private part everywhere you need it. So it “just works”. This is better than just old fashioned credentials because the passkey only “triggers” on the correct domain, so they can’t be phished by other domains… Right?by teekert
7/22/2026 at 6:53:01 PM
>If I accidentally set up a passkey on my phone (let’s say I use Safari one day instead of my go-to, Brave), can I still log in without that passkey on other devices?Yes, but you can also add the passkey to your password manager so it's available on all your devices.
>Can I add another passkey on another device?
Yes.
>How many passkeys can I set up for a particular site/app?
I haven't really seen a specified limit on any sites, but also if you're using a password manager it's only 1 passkey for all your devices anyways.
> For now, I’m going to stick with LastPass and use Passwords; because no matter whether I lose my device or not or whether I’m on my own devices or not, I can be sure I’ll be able to get into a site/app.
Your passkeys would be in LastPass as well like your passwords, so arguably the same result regardless of which you use.
>Edit: One final consideration, my spouse and I share user/name passwords for some things (notably Pandora and our Amazon Prime account) since they don’t handle things like family logins well; how do both my wife and I use amazon or Pandora with passkeys? Do we each set up passkeys? How do I get her Pass if that’s not an option?
If it was me I'd add a second passkey to my password manager for your wife under a new entry, and share that entry to her lastpass account.
Or if she's not on lastpass, you could just copy the data from the passkey over to whatever she does use.
by Saris
7/22/2026 at 5:52:12 PM
> Edit: One final consideration, my spouse and I share user/name passwords for some things (notably Pandora and our Amazon Prime account) since they don’t handle things like family logins well; how do both my wife and I use amazon or Pandora with passkeys? Do we each set up passkeys? How do I get her Pass if that’s not an option?Lets say it is a android phone. Open amazon app. login in the usual user/password + 2FA (like with QRcode or phone). create passkey. done. This passkey would have been now synced to your google account.
Take next spouse phone. Open amazon website or app. try login it will try for passkey but cannot find it. so
- login in the usual user/password + 2FA (like with QRcode or phone). create passkey. done - Now this passkey would have synced to spouse google account.
In future, assuming you have apple or windows laptop. assume you have signed into Google (chrome). Now go to amazon. It will ask - shall I sign in with passkey. Yes, give your macos fingerprint or windows hello or password of that laptop. login Done magically. You dont even need to remember username or password.
Assuming you both have iPhones. You can sync the passkey to icloud account. And for every new iDevice it will be available.
The main bottleneck of passkey would be that all 3rd party sites will have another non-passkey way as backup to login. I have never seen a website that would say - remove all other methods and keep only passkey.
In a way passkey is 99% convenience. If a hacker would some how get your sms and password they can by-pass.
by ilchalpenl
7/22/2026 at 7:20:53 PM
Thanks. One glaring issue I see is that right now police can’t ask you for your password in the USA (a violation of the right against self-incrimination). They can however get a search warrant for your device and your biometrics, and wouldn’t need your password if they can gain access through your pass key.by gortok
7/22/2026 at 8:23:48 PM
If you have it enabled, and you're in custody or at a border or similar, and have biometric auth enabled on your phone/computer, they can hold it up to your face or force you to put your finger on it to unlock it. Search warrant be damned.by srparish
7/23/2026 at 6:36:44 AM
According to Google,> Approximately 90% people never go out of their country...
I am sure > 90% will happily love to have the convenience.
Yes, people like you can setup bitwarden etc. Nothing wrong. Passkey works for majority of people.
BTW, passkey can also be used without biometrics. It needs only the authentication of the device.
by ilchalpenl
7/23/2026 at 7:14:56 AM
> I see is that right now police can’t ask you for your password in the USA (a violation of the right against self-incrimination).Hope they don't see your HN post. It is visible even without login.
by ilchalpenl
7/23/2026 at 6:18:47 AM
> wouldn’t need your password if tOnce you talk about privacy/security then - I am not even sure you should do it here in HN - a bastion for encouraging Silicon valley practices.
In principle, you can remove biometrics and still use passkey (by using phone password only).
If you see my text, I wrote clearly - passkeys are great convenience + security - For the majority. People don't need to waste time in searching login names.
TBH, I was in a few Free Software Foundation Europe and linux conferences in the last year - in my view - at least half of them were using - passkey with iPhone or Android (including Playservices). So people have accepted the reality.
by ilchalpenl
7/22/2026 at 5:39:54 PM
The thing I find burdensome is managing all the keys in a secure way. I think I would want a hardware token to store the keys on, have separate keys for every site, need to back up my keys onto a second token in case the first one is lost, etc. It gets burdensome. At least with passwords you can store them in various ways that are not hardware or software dependent.by giantg2
7/23/2026 at 2:33:48 AM
One time, before passkeys, I tried SMS 2FA since everyone was saying 2FA was the future, if you didn't have it you'd be hacked, so I set it up. Next day, phone is bootlooping. Had the recovery codes of course. This sort of thing happened to me three times before I said never again 2FA. It seems to be a device to lock you out of your accounts.You know how many of my passworded accounts got hacked in my lifetime? Zero.
by inigyou
7/23/2026 at 7:56:49 AM
At least with an SMS 2FA, you can get the SIM card out and put it in another device. If you happen lose the SIM card, your phone operator will probably get you another with the same number once you identify yourself. With authenticator apps or yubikeys, if you lose them (or get a bootloop, or wipe your phone forgetting to back up everything first), there's no path of recovery at all.by spaqin
7/23/2026 at 10:42:43 AM
Not if it's a prepaid eSIMby inigyou
7/23/2026 at 4:41:04 AM
I didn't know the answer to any of these either and don't have a hardware key (I thought this was required for a long time) but one day I just clicked add a passkey on a site and the Bitwarden extension picked up the flow and everything was ridiculously easy. Now I also do get how it works, having used it on a few sites. Highly recommend.by dizhn
7/22/2026 at 8:35:05 PM
Notwithstanding the danger of having everything on a single platform, the Apple passkey works great. Sign into one and you’re signed in everywhere and you can share passwords with others.by clickety_clack
7/22/2026 at 3:48:17 PM
Copying / syncing passkeys between password managers is still work in progress, but you can usually work around it by making multiple keys. For important websites, I recommend saving additional passkeys to Keychain, etc, as backup, assuming the website allows that. (It should, but some websites might not have a good implementation.)Also, nothing says you have to delete passwords (or alternate means of logging in) if you already have them set up. Having multiple ways in will help prevent lockout.
by skybrian
7/22/2026 at 6:20:02 PM
Unfortunately probably implementation specific, but you don't always need to have multiple passkeys. There is cross device passkey login. I had this occur in the last couple weeks. Evidently I had created a passkey on my phone. Logging into that site on my PC, it identified that I had a passkey and allowed me to authenticate using my phone.by zdp7
7/23/2026 at 10:16:52 AM
Everything you ask is nothing to do with PassKeys, but to do with whatever platform you use authentication flow...by marysol5
7/22/2026 at 5:25:31 PM
I’ve just been operating under the assumption passkeys are gonna lock me out unrecoverably in some way at some point, and have been avoiding them for anything important while allowing them for low-value accounts so they’ll stop nagging me.I hate that I can’t just put a value in a plain text file somewhere (encrypted, let’s say, to preempt the inevitable and low-value response) and rely on that to work when I need it on any device and interface that can accept keyboard input.
by readread
7/22/2026 at 5:47:01 PM
I avoid using them altogether for the same reason. I won't use them for low value accounts because it signals that I think they might be acceptable to eventually require for high value ones. And of course low value accounts have no value so I don't even care about phishing on most of those.by deltoidmaximus
7/22/2026 at 6:14:55 PM
Haha, this thread has prompted me to follow some of the discussion about stupid bullshit like requiring "user is present" attestation and banning passkey programs (LOL wut?) if they lie about it, or resistance to allowing exports and portability.I'm now on team "I am outright anti-passkeys and hope they fail and everyone pushing them cries a whole lot about it and never gets over it".
by readread
7/22/2026 at 7:50:45 PM
Same. I'm a tech professional, and I don't set up passkeys for similar reasons. I log in to online services from a lot of different devices and browsers. I use a password manager but the keys to the kingdom (my email password) exists only in my head.by SoftTalker
7/22/2026 at 9:17:33 PM
Wife and I use bitwarden. For shared accounts we put them in a shared folder, and the passkey is attached in there, in bitwarden, meaning it survives device resets.by OptionOfT
7/22/2026 at 8:10:14 PM
I don't know the exact tech behind it, but for a phone passkey I get a QR code on my laptop screen to scan with my phone, I accept it, and it logs me in.by jmalicki
7/22/2026 at 3:40:48 PM
I recognize the point of your post is more about the lack of clarity and details around passkeys. That's real, and I don't really have an answer for that - other than, I think maybe the quest for making them simple and "just work" has maybe made them nebulous enough that we've wound up in the current situation where a lot of even technically savvy people don't really understand them. But I feel like answering your questions might sort of help explain why that's the case, so I'm going to take a stab at it:> If I accidentally set up a passkey on my phone (let’s say I use Safari one day instead of my go-to, Brave), can I still log in without that passkey on other devices?
Assuming you have LastPass set up to be an iOS password manager, and it fully supports iOS' passkey implementation: when you create a passkey in Safari, it will ask you if you want to store it in LastPass or in the iOS Passwords app (previously known as iCloud Keychain). If you say LastPass, then it's up to them, but I assume it'll sync to all your devices - it's how 1Password works. If you were to accidentally say Apple Passwords, it'll sync to all your Apple devices automatically, and you can either use Apple's password browser extension on Windows, or you can use the "another device flow" I'm about to detail.
> Is there a way to ensure that passkey can be used on other devices?
As mentioned above, passkeys are intended to sync via your password manager of choice as the primary use case. If for any reason you don't have that passkey synced to that device, _and that passkey is on a mobile device with a camera_, most browsers will give you the option to scan a QR code with your phone. This kicks off a flow that will authenticate you via your phone's biometrics or passkey, then use Bluetooth to first ensure device proximity and then handle the authentication exchange. In the case of iOS, this includes any passkey-supporting password manager, so the passkey itself can be in 1Password; it doesn't have to be in the iOS password system for this to work.
When I first read the above, my hackles were raised given how well Bluetooth operates at times; but every time I've used it so far, it's been fast and flawless. Still, I can see a lot of scenarios where this might not work - e.g., the first one I thought of was a public computer at a library where Bluetooth might be locked down; corporate computers or remote servers could also be troublesome. As far as I know, passkeys don't yet have answers to those scenarios; other than to just use your password + 2FA as you would without a passkey.
As far as I know, both of the above apply to every passkey-consuming site.
> Can I add another passkey on another device? How many passkeys can I set up for a particular site/app?
This touches on your last paragraph, where it indeed could change based on the website. In my experience, every website where passkeys are fully supported - e.g., not ones that are using passkeys as a substitute for FIDO/U2F keys - has let me add multiple passkeys and have not _appeared_ to have a limit. I typically will create a passkey in both 1Password and Apple Passwords just to have a backup, and I can't recall any cases where that's been a problem. Still, I can't say for sure that isn't a problem on any website.
I went all in on trying passkeys when they started to be an option, and I don't have any notable regrets. For me, passkeys have generally worked well when the site is designed to use them well; and at no point have they been a _major_ hindrance. That isn't to say there are _no_ annoyances, though:
- Most websites that support passkeys tend to use them as a replacement for both the password _and_ 2FA, which makes them more convenient. However, a few - Amazon being the most notable I can recall - only use them as a second factor, which just makes them feel a little useless.
- A passkey can _also_ be used as the proof of identity, meaning you can log in in one fell swoop and don't need to enter a username or email address, which is IMO the best showcase for passkeys. Like above, this makes websites that ask you to enter an email address before letting you use a passkey also feel annoying.
- Most web browsers I've used support the QR + Bluetooth flow I mentioned above (otherwise known as Hybrid Transport or caBLE) without issue; Linux has been the odd duck out. Firefox doesn't seem to support it at all on Linux, and Chrome-based browsers do but sometimes are missing what they need and in that case don't show it as an option. Since I sync just about every passkey with 1Password this typically isn't a problem; the exception is the passkey for Apple Accounts, which Apple creates automatically, and (AFAIK) doesn't allow you to enroll your own. Apple Accounts are the only service I've found that does this, though.
- Some websites seem to only offer passkeys as an option if you're on a mobile device, or at least did so at the time of enrolling. eBay and PayPal I think are the two that jump out at me as having done this. Why they did it this way instead of simply detecting if the browser supported passkeys, I have no idea.
All of the above issues have gone down over time, so it's generally been a net decrease in friction over time. And, at least as far as I can recall, passwords themselves continue to be an option in every instance I've enrolled a passkey. So if you like your passwords, generally speaking, you can keep them :P
by rufo
7/22/2026 at 4:09:19 PM
> passkeys are intended to sync via your password manager of choice as the primary use case.The sync was actually a compromise to the standard. The idea was unique, device-bound credentials. One person, one device. The private key/passkey on your phone should not be the same one on your laptop, or your tablet, etc. Each device was supposed to have it' own unique credential.
Allowing sync is a security downgrade to the standard, in terms of threat-model guarantees. Pure WebAuthn credentials should be sealed in hardware (TPM or Secure Enclave or equivalent) and be mathematically non-exportable which guarantees zero remote blast radius, an attacker must physically posses the device.
Allowing sync and storing passkeys in a password manager reintroduces cloud account compromise risk and recovery flow hijacks. You lose non-repudiation.
Still more secure than passphrase + TOTP, but doesn't eliminate account takeover attacks against your cloud credential vault, which purely hardware based, per-device credentials do.
by thewebguyd
7/22/2026 at 4:54:30 PM
I don't get it. How does every device combo having a unique key pair help with security? They can all log in, right? So all you need is to compromise their session and you're in, whether they share the same passkey or not.And if you're compromised in such a way that an attacker could steal your password then wouldn't they be able to just hijack your session instead?
by Aerroon
7/22/2026 at 6:16:38 PM
Passkeys protect against credential theft, not session hijacking, two different parts of the stack. Passkey's only concern is initial authentication, it was never meant to provide any sort of protection against session theft. RFC 9449 Proof of Possession is how you prevent session hijacking, or session binding with a client-side TLS certificate.Device-bound passkeys take care of non-repudiation. With synced keys (e.g., 1password), an account compromise of your vault hands the attacker all your credentials, the private keys are in the vault.
Device-bound keeps the private key sealed in the TPM (or secure enclave), the key cannot be exported, so it cannot be extracted remotely. Even malware on the machine, can hijack your session, but it cannot exfiltrate your private key, TPM won't release it to the service without user verification via biometrics, yubikey, or a PIN. There's also an attestation chain that breaks with synced passkeys. The attacker has no way to get your private key, so the only way to compromise the account is, yes, session hijacking, or physical access to the device with the user present to pass the biometrics check.
by thewebguyd
7/22/2026 at 10:20:50 PM
Ooh, thanks for the insight, I didn’t realize that - though that makes sense given how they work. My initial reaction is, I like the idea of the pure hardware-locked passkey as you describe it, but I feel like the syncing is a reasonable-ish nod towards making them more usable in the real world since it does let you have more flexibility.I haven’t ever looked at the APIs for passkeys; is there any semblance of those types of keys being an option, or did opening the door to syncing basically let anything happen with the APIs and lose those guarantees?
by rufo
7/22/2026 at 5:49:44 PM
> Still, I can see a lot of scenarios where this might not work - e.g., the first one I thought of was a public computer at a library where Bluetooth might be locked down; corporate computers or remote servers could also be troublesome.None of my desktop computers support Bluetooth. Neither do my wife’s.
by NetMageSCW
7/22/2026 at 10:29:15 PM
Yes, I mean, that’s also a possibility - or someone didn’t know they needed to screw on the antenna, or it’s otherwise borked. Every PC motherboard (sample size of four, three for me and one for a nephew) I’ve bought in the last five years has had on-board WiFi and Bluetooth though, so I’m curious to know, was that a deliberate choice?(In thinking about it, it’s possible that the motherboards I bought did have non-wireless alternatives that weren’t stocked at my local Micro Center - lot of digging required to figure that out, though :) )
by rufo
7/22/2026 at 9:49:09 PM
> and I use LastPassOh! No. Please switch to something else. Last pass has had so many breaches, at this point it’s just not worth it.
by tecoholic
7/22/2026 at 8:21:09 PM
Not sure about lastpass, but you can save passkeys to 1password. Works just fine.by sharts
7/22/2026 at 9:31:51 PM
I store my passkeys in Bitwarden. Can you not do the same in LastPass?by beAbU
7/22/2026 at 3:12:22 PM
Why not use passkeys in LastPass? Then the passkey travels with you to your devices/apps.by darknavi
7/22/2026 at 5:30:06 PM
I’m 90% certain most of the push for passkeys is to prevent paid account sharing.by bombcar
7/22/2026 at 7:39:50 PM
I save all my passkeys in Bitwarden and they sync across devices.by NautilusWave
7/22/2026 at 5:52:12 PM
oh good I thought it was just me who didn't understand themby radial_symmetry
7/22/2026 at 3:07:06 PM
I'm using bitwarden, but it's possible to use passkeys from multiple devices and if it's not available for whatever reason, you can just login with username/password/token/biological probe/whatever you used before. As an example: GitLab gives you both options right from the start, so you can use whatever you fancy in that particular moment.by wadim
7/22/2026 at 3:09:14 PM
Did [someone from the Working Group] ever back down from their implied threat to blacklist Bitwarden for allowing for the sharing/export of passkeys?That really rubbed me the wrong way, and smacked very heavily of "the big players (MSFT, AAPL, GOOG) can do this - you can't".
by FireBeyond
7/22/2026 at 3:12:51 PM
I know KeePassXC faced the same threat. I don't know whatever became of it.by cpburns2009
7/22/2026 at 4:49:25 PM
You can add as many passkeys as you want and you can still have password logins too.by hoppp
7/22/2026 at 5:45:58 PM
I have come across many websites that limit how many passkeys I can add. Some have only allowed one or two.by MattTheRealOne
7/22/2026 at 6:44:21 PM
Yeah, it's bad implementation on the websites but the protocol doesn't have a limit.by hoppp
7/22/2026 at 10:32:03 PM
1 of gortok's points was I don’t know whether each website/app that has set up Passkeys has decided the answers to those questions in the same way as the others.by pseudalopex
7/22/2026 at 3:17:23 PM
Passkeys basically MITM the 2FA process so that they can track and deplatform you with a single click across all your accounts.The biometric verification also allows to confirm that a certain person is holding the device, and they can easily be matched to existing passport/travel databases.
Great system if the good guys have it, a bit problematic if it's abused by nepo kids to hide their crimes.
by bflesch
7/22/2026 at 3:26:50 PM
> Passkeys basically MITM the 2FA process so that they can track and deplatform you with a single click across all your accounts.I use passkeys with a physical authenticator. How do "they" track and deplatform me with a single click? Can you explain?
by vel0city
7/22/2026 at 6:06:50 PM
The service can use the use the attestation feature to block passkey providers that are deemed undesirable for whatever reason. Hard not to see eventually only major providers being accepted, even things like Microsoft services requiring Microsoft Passkeys using the Microsoft Passkey App which you're now required to have on your phone. Or worse you now need Symantec Passkeys to login to Symantec services (using that example since I believe Symantec had a ToTP App you needed to reverse engineer to extract the ToTP seed from if you wanted to use a different Authenticator)by deltoidmaximus
7/22/2026 at 6:16:10 PM
If a service wanted to do that they could already do that, you even point to an example with a platform requiring their specific app to use the account. I've had banks which required me to have their own time-based code physical security tokens to log in, isn't that in the end the same?This thing you're talking about isn't inherently a thing about passkeys. If a service wants to remove your ability to log in to their service they can do it in a million different ways.
Also, the above poster said:
> deplatform you with a single click across all your accounts
"They" could do it across all your accounts with a single click. If service A decides to require attestation, how is that now affecting all my accounts?
by vel0city
7/22/2026 at 8:52:12 PM
Unfortunately the US has willfully destroyed a significant amount of goodwill with citizens of their NATO allies. Due to aggressive rhetoric we are forced to look at the risks differently now.Further centralization on US services for something that already works fine (like 2FA) is unnecessary risk.
by bflesch
7/22/2026 at 9:12:19 PM
I agree the US has torched a lot of international goodwill.Once again how does this relate to passkeys? You don't have to use US companies to use passkeys. There are European providers of authenticators. What country is Yubico based out of again? Just picking one example, there are others.
by vel0city
7/22/2026 at 3:11:10 PM
It’s really not that hard.Most of your devices are in the Apple ecosystem and when you are prompted to create a passphrase it will ask you to put it in your iCloud Keychain. Boom, now it is available across all of those
This is how it will work for most people who don’t care about security and just casually use their devices. My boomer mom does this. It’s better than the notebook full of handwritten passwords she was using.
You have chosen lastpass and a multi-ecosystem environment with windows and multiple browsers on each. You have chosen complexity and this is not a limitation of passsphrases as they have been designed for a more common use case.
I use Linux and apple. I have chosen protonpass for my vault. I just tell my OS to save the passkey there and everything works pretty well. If not, my password is right there as fallback. It’s really not that hard.
by mingus88
7/22/2026 at 3:13:31 PM
Proton Pass is on the official Passkey client naughty list[1]. I hope the services you log in to don't choose to ban it because of those big, scary X's.by coldpie
7/22/2026 at 3:18:29 PM
The fact that services can ban passkey providers is a major red flag in the protocol and the real issue that nobody talks aboutwell, people are talking about it but it's not making a difference https://lucumr.pocoo.org/2025/9/2/passkeys/
by corndoge
7/22/2026 at 3:40:19 PM
This is why I am so concerned about passkeys. They could be a good improvement, but in practice I already see how it's going to result in Google/Apple/Microsoft/whoever seizing even more control.The document there is laughable too, because KeepassXC is listed as "not performing User Verification" when it demands manual authorization per request. But this isn't good enough for the passkey people. Ultimately, I see any FOSS option being effectively banned from most services and all important ones. It's a parallel to how you must now be on Cloudflare's nice list or be banned from the majority of the internet.
by duskdozer
7/22/2026 at 4:17:40 PM
Yeah they're really trying to solve problems that should be solved at a technical level with soft solutions in porcelain. See also this issue asking keepassxc to disable plaintext exports, which is completely technically feasibleby corndoge
7/22/2026 at 5:22:53 PM
The author of this ticket seems to come across as an arrogant know-it-all that thinks "the threats i thought of (or personally face) are the only threats that are significant, fuck anyone in a different situation."I proudly print my entire KDBX file including passkey private keys and I encourage my elderly parents to do so too.
Lightning strikes (and assisting people with cleanup and repair from them) have taught me that there are definitely a class of threats that will leave me with paper but possibly no technology until I can go buy a cheap laptop to restart my digital life, SO BEING ABLE TO BACK EVERYTHING UP IS ABSOLUTELY ESSENTIAL.
His website says he's in Boston, so I seriously doubt he's ever seen what lightning can do or dealt with a hurricane or tornado.
In general, if you're in the FIDO Alliance and had anything to do with the kind of micromanagement that passkeys can allow, FUCK YOU. Go get a job at Walmart as a greeter. We'll all be better off.
by mlfreeman
7/23/2026 at 8:54:37 AM
>I proudly print my entire KDBX file including passkey private keys and I encourage my elderly parents to do so too.Do you mean you print the raw values to paper or some encoding that would let you reconstitute the file (some giant QR code or something?)?
by duskdozer
7/23/2026 at 12:08:23 PM
I print a nice HTML document - each entry has each field/value in a HTML table and each group gets its own header.On macOS I use Strongbox's Print Database capability. On Windows, I'm testing a KeePass plugin I created that does the same thing and more (not quite ready for public release).
If I'm still around and coherent, I can re-type it into a KDBX-supporting app by hand (or maybe if I'm lucky only enough entries to get to a backup in cloud storage).
If the worst happens and I'm no longer capable of using a computer, it's an obviously-important document for whoever is cleaning up after me (I bet most people would understand the importance of a document with a bunch of usernames and passwords). They won't have to somehow break into my computer first to be able to figure out what online/digital matters of mine need to be dealt with.
EDIT: My current printout is 46 pages long.
by mlfreeman
7/23/2026 at 4:07:16 PM
>EDIT: My current printout is 46 pages long.Wow. Roughly how many entries do you have and how do you handle updates? I'm often being asked to change passwords and of course create new login entries.
by duskdozer
7/23/2026 at 8:58:43 AM
See this comment as well:>I've already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers, the need for functional and security certification, and the lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations).
https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
They 100% will lock it down to "secure" options you cannot control. I suppose if there's any hope, it would maybe be the official keepass submitting to their demands, while keeping them easy to bypass with a recompile.
by duskdozer
7/22/2026 at 6:59:50 PM
That issue was exactly why I took up my "Never use, under any circumstances" stance on passkeys. It is an indictment of the entire passkey project. I now routinely tell the less technical folks in my life, when asked about those weird passkey options, that they are the mark of the beast, and should be avoided at all costs.by OkayPhysicist
7/22/2026 at 3:22:50 PM
(I might be wrong, please correct me if I am) What I'm gathering from this page is that the Passkey spec can specify whether the app handling the passkey should prompt the user for biometric scan, PIN code, etc. but some apps simply ignore that flag. This makes sense though. I've already logged into my password manager and it hasn't timed out yet, so why would my password manager prompt me again? I'm glad that they don't prompt me again when I'm already logged in. I don't see this as a problem.by summermusic
7/22/2026 at 3:32:20 PM
Your understanding is correct and I agree with you. The Passkey spec authors, however, think services should be allowed to ban your client for behaving this way:> [When UV is required, KeePassXC must request user verification or not handle the request]
> This implementation is not spec compliant and has the potential to be blocked by relying parties.
by coldpie
7/22/2026 at 7:05:07 PM
> > This implementation is not spec compliant and has the potential to be blocked by relying parties.The only conclusion I can come to when it comes to this and the earlier kerfuffle regarding being able to export the plain text of passkeys is 'the spec is bad and you should feel bad'.
by Telaneo
7/22/2026 at 8:10:25 PM
Yeah, it sucks. It could've been a cool technology but they're so locked in to "my way or nothing" and won't consider other usecases or security trade-offs other than the ones they decided on. It's just a complete non-starter with that attitude.by coldpie
7/22/2026 at 3:42:30 PM
Right, not only are you authorized, but you are also prompted to manually complete the request, which will fail if you do not accept. However, this isn't considered sufficient by the passkey people, who do in fact want you to retype your password at each prompt.by duskdozer
7/23/2026 at 12:07:32 AM
If they do, oh well.Passkeys are a convenience and as I stated above I always have a password as a fallback
by mingus88
7/22/2026 at 3:13:16 PM
What if I lose all my apple devices? House break-in and they steal my mac and my phone?You're basically fucked even if you buy a new one because you need one of the other two to log in.
by juancn
7/22/2026 at 3:31:05 PM
Then you'll login to your Apple iCloud account using your password.Passkeys are just passwords that require a password manager; you can't login to a password manager without something outside the password manager, usually a password. (That's why they call it "LassPass" and "1Password"; there's one last password you'll still have to maintain.)
No password manager tries to get you to login with a passkey without setting a password, for precisely that reason. Apple, Google, and Microsoft do invite you to login to their password managers via passkey, because it's convenient and unphishable, but they always also allow you to login via password (or "backup codes", which are just backup passwords).
by dfabulich
7/22/2026 at 3:16:19 PM
No technology in the world can protect you against every threat model and unlikely scenario.What if the robber hits you in the head and you get brain damage and forget your password?
by gretch
7/22/2026 at 3:38:40 PM
That's the point: passkeys, and even 2FA, address rare and unlikely threat scenarios, while defeating most common use cases (delegation by sharing credentials), and making people vulnerable to most common threats (like, losing or breaking your phone).by TeMPOraL
7/22/2026 at 3:24:24 PM
That is not a rare threat model. Many people use iPhones and Windows computers. Fortunately, Apple has released iCloud Passwords which lets you access passwords and passkeys from a Windows computer.by pavon
7/22/2026 at 8:31:30 PM
Did not know that - how well does it work?by Melatonic
7/22/2026 at 5:13:23 PM
A password has the best recovery process. Period. Write it down somewhere. It's up to me, no third party.I had more trouble with a failed 2FA than with a password.
by juancn
7/22/2026 at 3:22:30 PM
Master password to password vault stored on metal, buried in my backyard and I tell a family member where it is in case I ever get brain damageby deejaaymac
7/22/2026 at 4:17:39 PM
Family member gossips "that crazy [deejaaymac] always burying secrets in the backyard..."Or straight up betrays you (you slighted them at some family event)
by gretch
7/22/2026 at 7:08:17 PM
If you marry someone you don’t trust, you’re going to have a lot more problems than password compromise.by iamnothere
7/22/2026 at 3:19:26 PM
these questions all have easy answers that could be quite easily discovered by simply trying to use passkeys, instead of trying to find reasons not to use them.by notatoad
7/22/2026 at 3:28:11 PM
You shouldn't be forced to discover what capabilities exist by brute force. Just freaking explain it.by cpburns2009
7/22/2026 at 3:42:02 PM
But since there's a potential nonzero risk of permanent account loss, I don't want to experiment, and since I can still log in with email/password I'm going to keep doing that.by pjc50