3 ms·

My method for judging the quality of software: Read the latest release notes, negate every statement, and think to yourself: "They were fine with it being like

My method for judging the quality of software: Read the latest release notes, negate every statement, and think to yourself: "They were fine with it being like this until now." Passkeys have been advertised as a superior replacement to passwords, but really fundamental issues remain unaddressed. I have one (1) Windows PC and one (1) iDevice. Can I get these to sync? Will both be able to log me in to a Google Account? Or do I need an Android phone for that? Can I use an iDevice to authenticate with an Azure AD app? Can I recover the passkeys on a lost iDevice without having to pay Apple for a new device to restore the backup? Etc... I guarantee many more release notes that could be summarised as: "Now supports a common scenario!"

rickdeckard 3y ago
> I have one (1) Windows PC and one (1) iDevice. Can I get these to sync? "Why? Where's the profit for us in that case?"
echeese 3y ago
> I have one (1) Windows PC and one (1) iDevice. Can I get these to sync? Or do I need an Android phone for that? Yes. In Chromium-based browsers, at least. Your browser will display a QR code which you scan with your phone. Your phone will display a list of accounts you can sign in with, you select one, authenticate, and you're logged in. Firefox support isn't here yet.
- jiggawatts 3y ago
  That's not what I mean by "sync". If I don't have the phone with me, I can't authenticate. Also, I use Firefox exclusively. This is precisely what I mean: common scenarios are not yet supported.
  - sbuk 3y ago
    You’re somewhat missing the point of what passkeys are. Instead of the something you know part, i.e. a password, the authentication is done by something you have. Your common use case is only common to single factor password authentication. It’s not a situation that is allowed for in passkey’s security model.
- danShumway 3y ago
  Passkey proponents have played really fast and loose with the word "sync" in my experience. No reasonable outside observer would call this syncing, it's cross-device sign-in. It's like saying you can sync your OTP-provider to your desktop computer because when you go to log into a website you manually copy the code into a form. That's not how most people understand the word "sync." What people are excited about here (assuming the details are good) is actual sync -- the ability to take your iCloud passkeys and literally move them to a new device outside of Apple's ecosystem as a mass operation rather than site-by-site. And that's really good and I'm excited about it and I hope that it addresses all of my issues. But its frustrating to see people still misrepresenting what's capable with the ecosystem today even under a positive announcement that signals that the actual concerns are getting addressed. It's so weird, I don't know of any other open standard I've seen where the proponents are so creative about acting like the ecosystem already supports things that aren't supported yet, and it's a huge reason why I remain skeptical of the passkey ecosystem -- because there are good-faith actors telling me to trust them but they're surrounded by people who are straight-up giving incorrect answers to basic questions like "is sync supported." I don't get it. If the limitations are going to be addressed, what is the value in pretending that they don't exist? How does the ecosystem benefit from that? All it does is decrease trust, to the point where I feel like I need to double-check every assurance I get from FIDO advocates to make sure that they're not redefining words.
  - echeese 3y ago
    my mistake
arnarbi 3y ago
> Will both be able to log me in to a Google Account? Or do I need an Android phone for that? Yes and no, respectively.
9dev 3y ago
Easy. Think of passkeys as per-device credentials. You can have (1) windows PC credential and (1) iDevice credential, and register both with Google and Azure.

rickdeckard 3y ago

> I have one (1) Windows PC and one (1) iDevice. Can I get these to sync? "Why? Where's the profit for us in that case?"

echeese 3y ago

> I have one (1) Windows PC and one (1) iDevice. Can I get these to sync? Or do I need an Android phone for that? Yes. In Chromium-based browsers, at least. Your browser will display a QR code which you scan with your phone. Your phone will display a list of accounts you can sign in with, you select one, authenticate, and you're logged in. Firefox support isn't here yet.

jiggawatts 3y ago
That's not what I mean by "sync". If I don't have the phone with me, I can't authenticate. Also, I use Firefox exclusively. This is precisely what I mean: common scenarios are not yet supported.
- sbuk 3y ago
  You’re somewhat missing the point of what passkeys are. Instead of the something you know part, i.e. a password, the authentication is done by something you have. Your common use case is only common to single factor password authentication. It’s not a situation that is allowed for in passkey’s security model.
danShumway 3y ago
Passkey proponents have played really fast and loose with the word "sync" in my experience. No reasonable outside observer would call this syncing, it's cross-device sign-in. It's like saying you can sync your OTP-provider to your desktop computer because when you go to log into a website you manually copy the code into a form. That's not how most people understand the word "sync." What people are excited about here (assuming the details are good) is actual sync -- the ability to take your iCloud passkeys and literally move them to a new device outside of Apple's ecosystem as a mass operation rather than site-by-site. And that's really good and I'm excited about it and I hope that it addresses all of my issues. But its frustrating to see people still misrepresenting what's capable with the ecosystem today even under a positive announcement that signals that the actual concerns are getting addressed. It's so weird, I don't know of any other open standard I've seen where the proponents are so creative about acting like the ecosystem already supports things that aren't supported yet, and it's a huge reason why I remain skeptical of the passkey ecosystem -- because there are good-faith actors telling me to trust them but they're surrounded by people who are straight-up giving incorrect answers to basic questions like "is sync supported." I don't get it. If the limitations are going to be addressed, what is the value in pretending that they don't exist? How does the ecosystem benefit from that? All it does is decrease trust, to the point where I feel like I need to double-check every assurance I get from FIDO advocates to make sure that they're not redefining words.
- echeese 3y ago
  my mistake

arnarbi 3y ago

> Will both be able to log me in to a Google Account? Or do I need an Android phone for that? Yes and no, respectively.

9dev 3y ago

Easy. Think of passkeys as per-device credentials. You can have (1) windows PC credential and (1) iDevice credential, and register both with Google and Azure.