4 ms·

> The software industry has zero concept of how much pain and suffering passkeys are going to cause the average person, almost entirely because the average Amer

> The software industry has zero concept of how much pain and suffering passkeys are going to cause the average person, almost entirely because the average American has an iPhone and a Windows laptop and there's literally nothing built-in to iOS or Windows that will sync passkeys between these two devices Then you register multiple passkeys for the website, just like you would register several Yubikeys. It’s a 1-click process, and no HW-token required. Most people will be fine.

spencerflem 2y ago
How do you log in on the other device to set up the second passkey?
- growse 2y ago
  Using the "passkey on other device" flow, which usually involves QR codes.
  - hbn 2y ago
    What if my phone irreparably broke?
    - Mindless2112 2y ago
      Then you use the "lost my passkey" process, which should be the same as the "forgot my password" process. Most services should treat passkeys like unphishable passwords. Passkeys do not (and are not intended to) solve the problem of lost credentials.
      - nottorp 2y ago
        They're intended to aggravate it instead.
        deleted 2y ago
        [deleted]
eikenberry 2y ago
> Then you register multiple passkeys for the website, just like you would register several Yubikeys. So just like Yubikeys, when you lose one of those keys you'll need to go to the 100's of sites where you registered that key and change it. This is not a good plan.
devsda 2y ago
> Most people will be fine this assumes majority of population has the means and discipline to purchase, register and maintain multiple pass keys and/or devices. There's a world outside the developed countries where a typical yubikey can cost 10-20% of a family's monthly income. A family where phones are the only tech devices in the household and the phone is typically in a 100-150 USD price range and costs about half of monthly income. By making passkeys mandatory we are asking them to get multiple of yubikeys/phones per person in the family ?! They cannot afford to and will not maintain multiple passkeys or backups. Orgs will have to build a way to help them recover their accounts easily without further costs or just ignore them as "edge cases".
- josteink 2y ago
  Passkeys are free. You do not need to buy them. They replace passwords, after all.
015a 2y ago
Many services which support passkeys do not support multiple passkeys. The big ones have figured out that we need support for multiple, but sadly just like with Yubikeys not everyone got the message on that. But, its like I said: You have zero concept of the struggle that is already happening and will continue to get worse. That's what I mean when I say that the software industry has zero concept: You think you have the solutions, but you actually haven't even grasped the full scope of the problem.
- rcxdude 2y ago
  This. Almost no-one's even realised that maybe being able to enroll multiple TOTP tokens would be a good idea. I spent some time recently trying to figure out a good, properly secure, robust authentication method would be for various important accounts both personally and at work, and I've more or less concluded that there isn't one, the best compromise that mostly works is TOTP but manually copying the secret across two hardware keys, which is wayyyyy outside the average user's capabilities, and I'm not even sure I'll be able to make it work in practice. passkeys are not serious until they actually address backups in a way that isn't just "we'll copy the secrets around in our cloud services just like passwords lol" (And it's not like there's no solution here: firstly make it mandatory in the spec to allow enrolling multiple keys, then standardise a means to enroll a device from another device, automatically, across all devices that other device is enrolled in, and then also it would probably be a good idea if that also offered a way to revoke the other keys)
- vel0city 2y ago
  The only site that uses passkeys I regularly use that doesn't support multiple is PayPal. Pretty much every other site that at one time only supported one now supports multiple. Which common sites still only allow one, other than PayPal?

spencerflem 2y ago

How do you log in on the other device to set up the second passkey?

growse 2y ago
Using the "passkey on other device" flow, which usually involves QR codes.
- hbn 2y ago
  What if my phone irreparably broke?
  - Mindless2112 2y ago
    Then you use the "lost my passkey" process, which should be the same as the "forgot my password" process. Most services should treat passkeys like unphishable passwords. Passkeys do not (and are not intended to) solve the problem of lost credentials.
    - nottorp 2y ago
      They're intended to aggravate it instead.
      - deleted 2y ago
        [deleted]

eikenberry 2y ago

> Then you register multiple passkeys for the website, just like you would register several Yubikeys. So just like Yubikeys, when you lose one of those keys you'll need to go to the 100's of sites where you registered that key and change it. This is not a good plan.

devsda 2y ago

> Most people will be fine this assumes majority of population has the means and discipline to purchase, register and maintain multiple pass keys and/or devices. There's a world outside the developed countries where a typical yubikey can cost 10-20% of a family's monthly income. A family where phones are the only tech devices in the household and the phone is typically in a 100-150 USD price range and costs about half of monthly income. By making passkeys mandatory we are asking them to get multiple of yubikeys/phones per person in the family ?! They cannot afford to and will not maintain multiple passkeys or backups. Orgs will have to build a way to help them recover their accounts easily without further costs or just ignore them as "edge cases".

josteink 2y ago
Passkeys are free. You do not need to buy them. They replace passwords, after all.

015a 2y ago

Many services which support passkeys do not support multiple passkeys. The big ones have figured out that we need support for multiple, but sadly just like with Yubikeys not everyone got the message on that. But, its like I said: You have zero concept of the struggle that is already happening and will continue to get worse. That's what I mean when I say that the software industry has zero concept: You think you have the solutions, but you actually haven't even grasped the full scope of the problem.

rcxdude 2y ago
This. Almost no-one's even realised that maybe being able to enroll multiple TOTP tokens would be a good idea. I spent some time recently trying to figure out a good, properly secure, robust authentication method would be for various important accounts both personally and at work, and I've more or less concluded that there isn't one, the best compromise that mostly works is TOTP but manually copying the secret across two hardware keys, which is wayyyyy outside the average user's capabilities, and I'm not even sure I'll be able to make it work in practice. passkeys are not serious until they actually address backups in a way that isn't just "we'll copy the secrets around in our cloud services just like passwords lol" (And it's not like there's no solution here: firstly make it mandatory in the spec to allow enrolling multiple keys, then standardise a means to enroll a device from another device, automatically, across all devices that other device is enrolled in, and then also it would probably be a good idea if that also offered a way to revoke the other keys)
vel0city 2y ago
The only site that uses passkeys I regularly use that doesn't support multiple is PayPal. Pretty much every other site that at one time only supported one now supports multiple. Which common sites still only allow one, other than PayPal?