3 ms·

Unfortunately, the design of passkeys push them to password managers instead of physical tokens. Physical passkeys are dangerous because you can lose them. The

Unfortunately, the design of passkeys push them to password managers instead of physical tokens. Physical passkeys are dangerous because you can lose them. The solution would be to add multiple keys, but that is hard to do. It would be nice to be able to add multiple keys at once. Or add a key that isn't present to have off-site backup. The result is that need a password manager to store the passkeys. Then passkeys turn into better, more annoying, non-phishable passwords.

jauntywundrkind 2y ago
The general un-user-manageability of keys makes passkeys such a failure to start. Ideally I'd want to be able to sign up and add three keys right away, backed by different devices stored in different places. At the moment though I'd need to relay around one key & go through each websites custom flow to add the next key. This isn't going to work. This isn't viable. It's not enough. If users could manage/export their own keys maybe they can send newly provisioned keys to off-site backups. But we still have to go navigate and provision extra keys on your website. There needs to be a way to present/enroll multiple keys all at once. And ideally standard endpoints for further management of passkeys on sites. We are already seeing some very minimal client/website management-ish coordinations forming. WebAuthn is adding signals, so the client will know it can de-list some Passkeys that go inactive. https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAB0jio%3DK91NiFqx%3DO1uCtCHRKdfuqc%3Dp2HOmEg_eQ7xXFfm9Xg%40mail.gmail.com https://groups.google.com/a/chromium.org/d/msgid/blink-dev/C...