> Also, does this mean if you lose your phone you can’t log into anything? How do you recover from that? If your passkey is tied to the phone (which will be tr

> Also, does this mean if you lose your phone you can’t log into anything? How do you recover from that? If your passkey is tied to the phone (which will be true for most people), losing your phone will be an interesting experience. Assuming you remember your Google account password, you will have to buy a new phone. In many cases you’ll need a new SIM or eSIM as well, eg if you have SMS based 2FA enabled. If you use Google Authenticator, your phone’s gone, so you better have a fallback — either SMS or fallback 2FA codes. If you need a SIM, and used Passkeys to login to your telco’s online account … um, tough. You’d better call customer support. Essentially, passkeys tied to one device is a house of cards. When things go wrong (eg you lose your phone or your dog chews your Yubikey) it’s not pretty. But of course security pros know this, they have backups and spend time securing and testing the backups. Most ordinary users won’t, of course. More interesting is the underlying assumption that your Google account works. If your stolen phone was used to do something shady or simply something Google’s account protection systems don’t like, your account may be locked out. At which point things get even more interesting. That said — cross platform Passkeys should exist soon. 1Password is implementing Passkey support[1], hopefully KeePassXC will do it too, then users of those apps will be okay. But I’ve no idea how easy it’ll be to move keys around. The spec really needs to support interop better, with formal import/export support. You shouldn’t be able to say you support PassKeys if you don’t support import/export. But of course even then, most users won’t export or back up their keys ¯\_(ツ)_/¯ [1] https://www.future.1password.com/passkeys/ https://www.future.1password.com/passkeys/