4 ms·
Many passkey-supporting sites only support a single passkey per account.
by rlpb 2y ago
Many passkey-supporting sites only support a single passkey per account.
- growse 2y agoWhich?
- _Algernon_ 2y agoPaypal is one I've encountered.
- lxgr 2y agoPaypal, as far as I can tell, doesn't even (intentionally) support passkeys. They refer to all WebAuthN credentials as "security keys" and remind me to "plug it in and touch it now" etc. I'm honestly already glad that they didn't make their annoying browser fingerprinting rigorous enough to also block authentications and aren't requiring attestation.
- xjlin0 2y agoEven google account's MFA allows back up codes, at least in the Enterprise accounts.
- deleted 2y ago[deleted]
- kbolino 2y agoThis feels like the biggest misstep that may impede the success of passkeys to me. It's not that surprising, though, since it's pretty rare to find genuine support for multiple authentication factors of the same type already. You can usually only register one number for SMS, and/or one TOTP authenticator, etc. It seems like a lot of sites never really understood (or cared about) the benefits of MFA to the user and so can't be bothered to really understand passkeys either.
- skybrian 2y agoYes, this definitely needs to be fixed! Besides passkeys, some websites have alternative backup authentication, though, such as backup codes. However you do it, there should be an independent way to log in.
- vel0city 2y agoI keep hearing this but then the only example I'm given is PayPal and that AWS used to be this way. What big sites do you experience only allow a single passkey?
- stouset 2y agoI use a passkey on every site that supports it (say two dozen at this point). I have never encountered this.
- UltraSane 2y agoWhich is a serious flaw in the standard.