Yep, Passkeys Still Have Problems

The author still has one last misconception about passkeys, namely that if you lose a passkey, you have "no recourse."

People wrongly think passkeys are like Bitcoin wallets, where losing them means there's absolutely nothing you can do, your account is simply lost forever.

Losing a passkey is exactly like losing your password, which is to say, that for 99% of services, you can reset your password/passkey really easily. There's a prominent "Reset Password" button right on the login form. It sends you an email or an SMS, you click it, and it lets you reset right then and there. You can reset your passkey in exactly the same way.

It is not that easy to reset if you lose your password to your Apple, Google, Facebook, etc. They all have a bunch of factors that they use to authenticate you if you reset your password, and they don't even document which ones they use.

So, if you care about those accounts, you've got to make sure you have backup access. They all let you generate and print "backup codes" (emergency passwords) and store them in a fireproof safe or a literal bank vault. Do that!

As everybody knows, you can't store all of your passwords in a password manager. You need something outside of the password manager to login to the manager itself. That's why 1Password/LastPass is called that; you still need one last password that you keep and manage yourself.

That's true of passkeys, too. You can login to Google with passkey, but if Google is your password manager that stores your passkey, you need something else outside of Google's password manager to login to Google. Whether it's a password, a backup code, a YubiKey, whatever, you need one more thing to login to Google, ideally more than one, so you can back it up and keep it safe.

2 things about passkeys I wish would be fixed.

1. Passkey prompts asking if I want to use a phone or security key when I only have one (or neither!) registered. The UI for this gets in the way and should only ever present itself if I happen to have both kinds of devices registered.

2. Passkeys should have had the portability and flexibility that ssh keys have from the start. Making it so your grandparents can use public key cryptography and gain a significant advantage in securing their accounts in a user friendly manner should have been the priority. Seems like vendor lock-in was the goal from the start.

I'm a bit of a curmudgeon about this.

Until service providers are no longer allowed to:

  1) force the type of passkey stores used (e.g. hardware vs software) when I am providing the passkey store
  2) force me to MFA (e.g. forcing touch ID, entering pin or unlock password, etc) when attempting to use a passkey

I'll continue to stick to plain old boring password + TOTP. I fully understand the security trade-offs like phishing resistance but password + TOTP is secure enough for me.

The "Vendors Can Lock You Out" part is what makes passkeys entirely a non-starter for me. Especially the additional risk when someone passes away and the heirs are trying to get access to the deceased's accounts. Vendors are well known for saying "we had an agreement with Samantha, and with her death, that agreement has terminated, and no one can be given access that was not pre-designated."

Vendor lock-in a serious concern. Just reading through this KeePass issue again and seeing how much pressure the industry is trying to exert to prevent the users from being able to export their own private keys should be concerning. I come back to this discussion every time I see someone arguing in favor of passkey adoption.

>The unfortunate piece is that your product choices can have both positive and negative impacts on the ecosystem as a whole. I've already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers

https://github.com/keepassxreboot/keepassxc/issues/10407

Passkey just suck, end of story. The UX for them is so bad. I have no idea how many active pass keys I have. I just have to trust the provider knows what they're doing. Sometimes my authenticator app seems to forget my pass keys which is even more annoying.

Stop the insanity.

Password + TOTP have served me well so far. To port from device to device I just need to log into my Bitwarden account. It is unclear to me what device loss would do to a passkey and the passkey never communicates that information to me. If I set up a passkey on my iPhone, the site prompts me on my Linux desktop. I understand it's fine for people who use single platforms for everything. But as far as I can tell there is no advantage over Password + TOTP. I really hope Passkeys don't become mandatory. I only use them for sites I don't care about or when I've accidentally said yes to setting one up.

Passkeys are fantastic for the vast majority of the population. They solve oodles of problems. No more teaching ${FAMILY_MEMBER} about good passwords, password re-use, trying to explain how to use a password manager, etc. Instead: create passkey, done. Then it's seamless login whether they're on their computer, phone or tablet.

As a tech-savvy user fully aware of the underlying machinations involved with passkeys, I greatly prefer their simple, fast login experience over: username submit password submit TOTP submit, and especially over the much-worse "we've emailed you a code" login slog.

So in other words, Passkeys are over engineered and simply too complicated for most users.

Succumbing to lock-in can smooth some (but not all) rough edges and creates it's own restrictions and risks.

TOTP for the win --- it's the simpler practical alternative.

Everyone pretends that you're force to only have 1 passkey. I use 3 "passkey managers": Passwords.app, Bitwarden, YubiKey hardware key. I usually add all 3 or just two (skipping YubiKey).

On Apple devices I get neat experience out of the box, on Linux (+Firefox) I forced to use Bitwarden because Mozilla is being Mozilla.

Never had any issues ever with passkeys.

I feel like a boomer.

I dont want to use google/apple/microsoft for any credential manager because: google is evil; apple has locked me out of my apple id (and lost things like the recordings of conversations with my father during his hospice); microsoft keeps getting worse and more annoying to use.

So ok, I need some credential manager. I used keepass previously... but how do I vet other credential managers? I dont want an online backup. I want my credentials to only be on my computers. So now I gotta learn about which apps are ok, don't have cloud synching, can export files, and be compatible with MacOS.

And I have to learn what is FIDO? Like FICO? why do I need to synch with FIDO? what is it? will it give my credential store to others?

How is this easier or more convenient than a user/pass with 2fa?

I feel like I am going to accidentally leak my credentials and have no way of knowing

It's not really passkeys that are the problem, it's trusting your passkey to a third-party. But this is still a minor part of the market today, a much bigger problem to warn people about is the "log in with your google/facebook/etc account". Where you're handing everything over to a third-party as well, because it's so easy and convenient.

Passkeys, stored in Bitwarden, give a lot of the same convenience, but without the vendor lock-in. We shouldn't be scaring people away from passkeys, when commonly used alternatives are much worse.

Passkeys need a marketing campaign and UX overhaul.

I’m a technical guy, but I really don’t understand what the fuck is going on when I use a passkey. All I know is one day it appeared as an option and it let me login to things. I don’t really understand where it lives, what device it’s tied to, how scanning a QR code on Google Chrome on my phone magically logs me in, etc etc.

The user was not educated on this. Hacker News is the top 1% of computer power users. You gotta understand to someone’s grandma or mom or brother who works in real estate none of this makes any sense nor will they educate themselves on what it is.

I update a spreadsheet with all my accounts and money and their values so I know my net worth and its changes, and oh boy every month getting these numbers is such a chore.

Since it's been a few days, sometimes I am logged out of either bank/traders and also the password manager.

So it's open the bank site, click on login/password, password manager browser extension asks to login. Type password manager password. It asks for 2FA. Unlock phone with face. Find app, open app, unlock app with face. Approve password manager login. Click on bank login/password again. I am in! No, bank wants to 2FA with mobile. Unlock phone with face. Open bank mobile app, unlock with face. Get code or approve login. Back to computer, type code or click approve.

Repeat that 12 times for all the accounts, and by the end of it I have neck pain with all the "pick up phone to face unlock" motions.

I am a bit paranoid so I turn on 2FA and passkeys and whatnot, but all of this makes me want to use `123password` everywhere and never change it.

Totally agree with this. Passkeys are a solution but not the sole solution. There is absolutely a misconception for seeing them as newest and therefore the best choice.

Passkey is a great avenue for hackers because they represent an optional authentication mechanism that users overloook.

Really great article.

I also think there's still an enormous ignorance from passkey devs that lots of people want to occasionally log into personal services from locked down corporate machines, and the flow to deal this is at best terrible but more often non-existent, and developers with typically enhanced privileges just aren't able to conceive how difficult this is.

The biggest problem I have with passkeys is being tied to a single device you still need a flow to reset/get in _without_ the passkey. As you're only as secure as your weakest link passkeys don't add any security.

That said, if you have a mac with a fingerprint scanner they sure are very convenient option.

And don't get me started on terrible vendors like Rippling that only support a single passkey! Madness.

starting to really hate these, regret ever using one

I don't care what you other people in auth do, I work in auth too, please stop making signing into anything 5 steps.

1. First I get redirected to a special sign-in page.

2. Then I sign-in with my email only.

3. Then it finally asks me for a password, even for services that would never reasonably use SSO or have another post-email receive process.

4. Then I get redirected again to enter 2fa.

5. Then these websites ask if I want to create a passkey. No, I never want to create a passkey, and you keep asking me anyway.

6. Then, and only then, do I get to finally go back to using the service I wanted, and by then, you've lost whatever my `?originalUrl=` was, and I have to find it again.

No, don't send me a magic link. Because then I have to go do 4 more steps with Gmail or another mailbox provider and now signing in has become 10 or more steps.

No, don't tell me getting rid of passwords will help most of the population, and then force all of us to do the above, and blatantly lie to us that it's better.

Stop it. Get some help.

Passkeys are a completely seamless experience on Apple platforms in my experience so far.

Please don't use fixed-width fonts to write text. Please use fixed-width fonts to write code.

The author still has one last misconception about passkeys, namely that if you lose a passkey, you have "no recourse."

People wrongly think passkeys are like Bitcoin wallets, where losing them means there's absolutely nothing you can do, your account is simply lost forever.

Pre-passkeys, was this lockout issue a true issue with apple and google accounts? Or have passkeys added a general lockout issue that didn't exist before? Also passkeys in their current implementation are not possible to back up or export yourself, unlike passwords in the past.

Security engineers are prioritizing preventing key copying over lockout issues, unilaterally, on literally billions of people. It improves their metrics internally, at the cost of an externality on the entire world. This kind of stuff invites odious regulation as more and more stories of lockout with no recourse surface.

And unlike passwords, there is no good provider migration story. There is a roach motel issue. Yes it is being 'worked on', but passkeys and such have been out for many years, the willful denial whenever you ask people running these standards about these issues is incredibly irritating. The fact they tend to avoid questions about this like politicians decreases trust in the motives of such standards.

Apple and Google often store your other 99% of passwords and passkeys, so losing this is actually more important than losing the 99%. I take your point but saying 99% have reset services when the critical 1% may never be recoverable without posting to HN is an important point.

Also, just so I'm clear, there's no requirement to share passkeys. Or even have passkeys enabled on all devices, right?

If I log in to a site from my machine, and set up a passkey, but then log into that site from another machine, it'll just see no passkey present and ask for my password, yes?

A passkey is a local password on a device that could be shared through all the password manager gymnastics, but its not required as I understand it.

> unlike passwords, there is no good provider migration story

I'm curious what the "good provider migration story" you're referring to here for passwords is?

Password managers by-and-large haven't agreed on a standardised interchange format for import/export - a few of them have some compatibility helpers for importing from specific popular competitors but they're all in different formats, no consistent formats.

The above goes for passkeys as it does passwords - import/export will include your passkeys - so I don't see much difference in the provider migration story.

On the other hand, the FIDO Credential Exchange Format does solve the above problem (if/when providers choose to adopt it), so passkeys are at least further along the path of creating a "good provider migration story" than passwords ever were.

And what about password sharing? I want to share everything with my partner,in case something happens to me.

Passwords right now are outright better.

And by the way, door keys could be copied.

No, passkeys haven't added a new general lockout issue, because Apple, Google, etc. don't allow you to create an account where you can only login via passkey with no external authentication factor. They require you have something outside the Google account, whether that's a password, a hardware key, etc.

People keep falsely imagining that Google is setting people up with passkey-only accounts, with no way to backup their login credentials. Gosh, wouldn't that be terrible?

That would be like 1Password letting you create a passkey-only account with no password, storing the only passkey in 1Password. The whole idea makes no sense. 1Password doesn't do that, and neither does Apple, Google, Microsoft, etc. (We can all imagine them doing something that stupid, but, it turns out, they don't.)

Pre-passkeys, the most common lost-credential scenario was creating a fresh Gmail address on a new device (an Android phone) with a password and forgetting both your Google password and your password for your cellular-phone carrier (AT&T, T-Mobile, etc). Your Google password would be stored locally on your phone and in Google's cloud, but when you lose your phone and forget your passwords, no backups remain.

At that point, you're pretty much screwed. Google can't email you a reset-password link, because Gmail is your email. Google can't send you a 2FA SMS until you get a new phone with the same number, but you can't convince AT&T to do that, because they want to send a reset-password link to your email, which you don't have, or SMS to your phone, which you don't have.

(The cellular carriers don't even allow you to show government ID at a physical store. They don't allow you to take over a phone number that way, because people could then threaten/bribe a T-Mobile store representative to falsely claim that you presented valid government ID, taking over other people's accounts. If you walk into a store, they'll just put you on the phone with customer service, where they'll insist that you provide your AT&T password, or reset your password via email or SMS. If you've lost your email and your phone and all your passwords, you're completely out of luck.)

If Google allowed you to create a passkey-only account, with no SMS 2FA and no way to backup your passkey, that would be even worse.

But, luckily for all of us, they don't even allow that, and they're certainly not pushing it unilaterally on billions of people.

Yes. People have complained about the difficulty of Google or Facebook account recovery and how they need to make it easier and more accurate for ages. You could search hn for "password reset" or "lost password" and you'll find tons.

starting to really hate these, regret ever using one

Passkey is a great avenue for hackers because they represent an optional authentication mechanism that users overloook.

Stop the insanity.

Totally agree with this. Passkeys are a solution but not the sole solution. There is absolutely a misconception for seeing them as newest and therefore the best choice.

That said, if you have a mac with a fingerprint scanner they sure are very convenient option.

And don't get me started on terrible vendors like Rippling that only support a single passkey! Madness.

I dropped my phone and it literally fell apart. As a result I have been locked out of my AWS account. The get a phone call verification just does not work. Only saving grace is that it was an account I used to test things.

I keep hearing it repeated, but where does this "tied to a single device" idea come from?

The default, built-for-the-masses implementation of passkeys is called "synced passkeys". They are designed to sync between all your enrolled devices, ideally using end-to-end encryption.

You authenticate with whatever device you happen to be using at the time - phone, tablet, laptop, desktop - doesn't matter. If you lose one, you replace that device and re-enroll - then all your passkeys magically re-appear on the new device.

If you're cross-platform, modern password managers work across ecosystems - for example, 1Password syncs passkeys between Mac, Windows, iOS, Android, and Linux. If you're all-in on Apple, their native passkey implementation syncs passkeys between all your Apple devices. I thought Google and Microsoft do something similar now.

It's a real mystery why people believe passkeys have to be stored on your phone only.

That linked story is pretty horrifying too: https://hey.paris/posts/appleid/

If he can't get his account back in any reasonable amount of time what chance do I have?

(I see I missed a big HN discussion on this: https://news.ycombinator.com/item?id=46252114 - 1038 comments)

Some password managers provide an offline root of trust which family members can use in this scenario. For example, 1Password tells users to print off an "Emergency Kit" which is a physical piece of paper with secret recovery codes printed on it, which they store in one or more safe places. [1]

If someone passes away, their family members can use the Emergency Kit to gain access to and use all their credentials - including their passkeys.

(The Emergency Kit is also intended to allow your to recover your passkeys and other credentials in the event you forget your master passphrase or lose all your devices.)

[1] https://support.1password.com/emergency-kit/

> "we had an agreement with Samantha, and with her death, that agreement has terminated, and no one can be given access that was not pre-designated."

It would be nice if you could use some legal apparatus to ratchet these agreements into a trust. Corps would hate it though, so it will probably be illegal to do.

I hate passkeys because when I've encountered them it's always an interstitial between what I just signed in to and where I'm trying to go, it's always a "register a passkey now" with an obfuscated dark pattern bypass, and it's always on a corporate account that I don't need a fucking passkey for.

I don't want a passkey on my logins but there is no way to disable this prompt on the 3 websites that constantly annoy me for them.

Drives me batty. The company I work for is already paying you for the service I'm using. We use SSO for EVERYTHING, I've already 2FA Authenticated the login, and even if I set up a passkey I will still have to 2FA the login.

I don't use these sites in any personal capacity, and I would never use a site that harasses me in any way if I was not absolutely required to in order to earn a paycheck.

You're not going to get any money out of me, why are you torturing me?

Passkeys need a marketing campaign and UX overhaul.

Really great article.

Passkeys, stored in Bitwarden, give a lot of the same convenience, but without the vendor lock-in. We shouldn't be scaring people away from passkeys, when commonly used alternatives are much worse.

https://github.com/keepassxreboot/keepassxc/issues/10407

I'm a bit of a curmudgeon about this.

Until service providers are no longer allowed to:

  1) force the type of passkey stores used (e.g. hardware vs software) when I am providing the passkey store
  2) force me to MFA (e.g. forcing touch ID, entering pin or unlock password, etc) when attempting to use a passkey

I'll continue to stick to plain old boring password + TOTP. I fully understand the security trade-offs like phishing resistance but password + TOTP is secure enough for me.

I update a spreadsheet with all my accounts and money and their values so I know my net worth and its changes, and oh boy every month getting these numbers is such a chore.

Since it's been a few days, sometimes I am logged out of either bank/traders and also the password manager.

Repeat that 12 times for all the accounts, and by the end of it I have neck pain with all the "pick up phone to face unlock" motions.

I am a bit paranoid so I turn on 2FA and passkeys and whatnot, but all of this makes me want to use `123password` everywhere and never change it.

2 things about passkeys I wish would be fixed.

Passkeys are a completely seamless experience on Apple platforms in my experience so far.

I feel like a boomer.

And I have to learn what is FIDO? Like FICO? why do I need to synch with FIDO? what is it? will it give my credential store to others?

How is this easier or more convenient than a user/pass with 2fa?

I feel like I am going to accidentally leak my credentials and have no way of knowing

Everyone pretends that you're force to only have 1 passkey. I use 3 "passkey managers": Passwords.app, Bitwarden, YubiKey hardware key. I usually add all 3 or just two (skipping YubiKey).

On Apple devices I get neat experience out of the box, on Linux (+Firefox) I forced to use Bitwarden because Mozilla is being Mozilla.

Never had any issues ever with passkeys.

So in other words, Passkeys are over engineered and simply too complicated for most users.

Succumbing to lock-in can smooth some (but not all) rough edges and creates it's own restrictions and risks.

TOTP for the win --- it's the simpler practical alternative.

when you create or use a passkey, the UI on all platforms tells you where it is going to be saved or where it is coming from.

This is one of the core use cases for why FIDO Cross-Device Authentication was created. To be able to use a passkey to sign in on a shared device, a device you don't control, or a device where you just need temporary access to something.

> log into personal services from locked down corporate machines

This is usually a bad idea, and is sometimes expressly forbidden.

But. more generally, there must be a flow for accessing your account when the passkey is not available, and possibly cannot be recovered.

As someone who has enhanced privileges, I'm having problems thinking of what all the the issues here are.

Corporate installs disable all USB functionality, and remove the ability to sync profiles? Something like that?

It's the fact that there's no physical artifact that's the problem - there's no file.

You can't back up your passkeys and wind up with something you put in a safe on a USB key or something and vendors have been aggressively trying to make that harder.

Hi! I'm the commenter on that post that keeps being brought up!

I don't think requiring an encrypted backup (with a key or secret that YOU control) by default is "preventing users from being able to export their own private keys".

Many/all? also need to have some form of manual input as a backup, so you're not forced to sync all your passwords to e.g. a library's computer just to log in, if your house burns down or something.

Which probably looks a lot like a password.

For me everything goes in Keepass. And the only thing I want in life is the ability to change a password from Keepass in a standardized way.

Instead we've got Passkeys and the general promise by omission that I will be banned from using Keepass to store and backup my passwords as I see fit on my own devices.

People want me to trust the corporate overlords who at every turn have practiced lock in and rent seeking tactics.

Device loss:

If you had multiple devices set up on the site (each site must have done this individually), you just use a different device.

If you had synced your passkeys somewhere (note that the spec allows sites to block this, though I'm not aware of any actually doing so), you sync them to the new thing and log in normally.

If you did none of those, it's gone forever. Do the account recovery process, if one exists.

So it degrades to equal or worse than passwords in all cases (which cannot block backups or syncing, and you can enter them individually by hand so you're not exposing all your passwords to the device, and you can communicate them over the phone or in writing), for device loss purposes.

Restoring access in this scenario is imo one of their worst qualities.

On Mac with the security key you can just press the button on the security key before choosing a path. It only looks like a required extra step but in practice it is optional.

>The UI for this gets in the way and should only ever present itself if I happen to have both kinds of devices registered.

I disagree. It is very annoying when some service fails to show an option on the grounds that I can't use it. It makes it difficult to resolve problems. If the option is just missing, I have no way to tell whether the company doesn't provide the option, whether the company made some sort of mistake (they can't provide an email option because they lost my email), whether I made a mistake, or whether the company just has a bad UI that tries to hide the option. And don't forget the situation where I tried to google online for some help in using the UI, I found a 6 month old Reddit post showing the option, and I can't figure out if the company changed the UI in the past six months.

They should show it greyed out with a note "no key of this type registered".

Passkeys seem to be the best solution for users whose technical chops cannot be trusted, and who are also gullible enough to be a scam / social engineering target. Which, to my mind, describes a large enough chunk of audience of most popular services.

A tech-savvy relative of such a user should help them generate rescue codes, write them on a piece of paper, and store them along with all other important documents. Ideally the paper should also read: "Call me before using any of these codes! <phone number>."

> Seems like vendor lock-in was the goal from the start.

Exactly. The passkey vendors state that the goal was to make phishing not just difficult but impossible. This means plaintext access to your credentials is forbidden forever, regardless of your level of expertise, and regardless of the complexity of the process to export/import them. The purpose of the so-called "secure credential exchange" is once again to prevent you from directly accessing your credentials. You can go from one passkey vendor to another, but you're always locked in to one passkey vendor or another.

Any credential system that makes it impossible to write something down on a piece of paper, take it to a new computer, and login to a website is just a gateway to vendor lock-in. You can manually manage your own ssh keys but for some reason not your passkeys.

As an Apple Mac user, what annoys me the most is that the use of passkeys in Safari requires iCloud Keychain, which of course requires iCloud and an Apple Account. [EDIT: Obviously I'm talking about built-in support. I'm well aware of third-party software, so everyone can stop replying to this now, please!] You can't do local-only passkeys, not even if you take responsibility for backing up your own Mac.

The passkey vendors took some good theoretical ideas, such as site-specific credentials and public-key cryptography, and totally mangled the implementation, making it hostile to everyone except themselves.

Not that seamless if you do not want to be locked into a single platform, though. This is what the article mostly talks about.

In your case it's literally the same "complexity" as user/pass with 2FA. You need something to manage the passkeys, just like you need something to manage your second factor. Everything else you list as a worry is already in play.

FIDO is a standards body which produces specifications used by these systems.

Yep. I use Apple’s direct support which works out of the box. I also create a second passkey in 1Password. And for truly important accounts (1Password itself, Apple, Google), I have a third copy on a YubiKey stored in a safe deposit box.

3 technological devices which I can't validate by checking if the physical piece of paper is still legible in a safe.

TOTP is really annoying IMO but at least you control it so you can make it one-factor again if it's foisted on you. I made a Chrome extension to do that:

https://chromewebstore.google.com/detail/lazyotp/eoihmklnjkn...

It's now late into 2025, and just over a year since I wrote my last post on Passkeys. The prevailing dialogue that I see from thought leaders is "addressing common misconceptions" around Passkeys, the implication being that "you just don't understand it correctly" if you have doubts. Clearly I don't understand Passkeys in that case.

And yet, I am here to once again say - yep, it's 2025 and Passkeys still have all the issues I've mentioned before, and a few new ones I've learnt! Let's round up the year together then.

Too Lazy - Didn't Read

Passkeys have flaws - learn about them and use them on your terms. Don't write them off wholesale based on this blog. I, the author of this blog, use Passkeys!!!
DO engage with and learn about Credential Managers (aka Password Managers). This is where the Passkey is stored.
DO use a Credential Manager you control and can backup. I recommend Bitwarden or Vaultwarden which allow backups to be taken easily.
AVOID using a platform (Apple, Google) Credential Manager as your only Passkey repository - these can't easily backed up and you CAN be locked out permanently.
- IF you use a platform Passkey manager, frequently sync it with FIDO Credential Exchange to an external Credential Manager you can backup/control.
- OR use both the platform Passkey manager AND a Credential Manager you control in parallel.
For high value accounts such as email which are on the account recovery path
- DO use Yubikeys for your email account as the Passkey store.
- DO keep strong machine generated passwords + TOTP in your Credential Managers as alternatives to Passkeys for your email accounts.
DO a thought experiment - if I lost access to my Credential Manager what is the recovery path? Ensure you can rebuild from disaster.

So what has changed?

The major change in the last 12 months has been the introduction of the FIDO Credential Exchange Specification.

Most people within the tech community who have dismissed my claim that "Passkeys are a form of vendor lockin" are now pointing at this specification as proof that this claim is now wrong.

"See! Look! You can export your credentials to another Passkey provider if you want! We aren't locking you in!!!"

I have to agree - this is great if you want to change which walled-garden you live inside. However it doesn't assist with the day to day usage of Passkeys when you have devices from different vendor ecosystems. Nor does it make it easier for me to use a Passkey provider outside of my vendors platform provider.

Example: Let's say that I have an Windows Desktop and a Macbook Pro - I can sign up a Passkey on the Macbook Pro but I can't then use it on the Windows Desktop. FIDO Credential Exchange lets me copy from Apple's Keychain to whatever provider I use on the Windows machine. But now I have to do that exchange every time I enrol a new Passkey. Similar I would need to do the reverse from Windows to Mac every time that I sign up on the Windows machine.

So day to day, this changes very little - but if I want to go from "all in on Apple" to "all in on Google" then I can do a big-bang migration and jump from once garden to the next. But if you have mixed device ecosystems (like uhhh ... you know. Most of the world does) then very little will change for you with this.

But if I use my own Credential Manager (e.g. Vaultwarden) then I can happily work between multiple ecosystems.

What's the same?

Thought Leadership

Today I saw this excellent quote in the context of why Passkeys are better than Password+TOTP in a Password Manager:

Individuals having to learn to use password management software and be vigilant against phishing is an industry failure, not a personal success.

Even giving as much benefit of the doubt to this statement, and that the "and" might be load bearing we have to ask - Where are passkeys stored?

So we still have to teach individuals about password (credential) managers, and how Passkeys work so that people trust them. That fundamental truth hasn't changed.

But not only this - if a person is choosing a password+TOTP over a Passkey, we have to ask "why is that"? Do we think that it's truly about arrogance? Do we think that this user believes they are more important? Or is there and underlying usability issue at play? Why might we be recommending this to others? Do we really think that Passkeys come without a need of education?

Maybe I'm fundamentally missing the original point of this comment. Maybe I am completely misinterpretting it. But I still think we need to say if a person chooses password and TOTP over a Passkey even once they are informed of the choices, then Passkeys have failed that user. What could we have done better?

Perhaps one could interpret this statement as you don't need to teach users about Passkeys if they are using their ✨ m a g i c a l ✨ platform Passkey manager since it's so much nicer than a password and TOTP. And that leads to ...

It's Still Vendor Lockin

In economics, vendor lock-in, [...] makes a customer dependent on a vendor for products, unable to use another vendor without substantial switching costs.

citation - wikipedia

See, the big issue that the thought leaders seem to get wrong is that they believe that if you can use FIDO Credential Exchange, then you aren't locked in because you can move between Passkey providers.

But if we aren't teaching our users about credential management, didn't we just silently lock them into to our platform Passkey manager?

Not only that, when you try to go against the platform manager, it's the continual friction at each stage of the users experience. It makes the cost to switch high because at each point you encounter friction if you deviate from the vendors intended paths.

For example, consider the Apple Passkey modal:

MacOS 15.7.1 taken on 2025-10-29

The majority of this modal is dedicated to "you should make a Passkey in your Apple Keychain". If you want to use your Android phone or a Security Key, where would I click? Oh yes, Other Options.

Per Apple's Human Interface Guidelines:

Make buttons easy for people to use. It’s essential to include enough space around a button so that people can visually distinguish it from surrounding components and content. Giving a button enough space is also critical for helping people select or activate it, regardless of the method of input they use.

MacOS 15.7.1 taken on 2025-10-29

When you select Other Options this is what you see - see how Touch ID is still the default, despite the fact that I already indicated I don't want to use it by selecting Other Options? At this point I would need to select Security Key and then click again to use my key. Similar for Android Phone.

And guess what - my preferences and choices are never remembered. I guess it's true what they say.

Software engineers don't understand consent, and it shows.

Google Chrome has a similar set of Modals and nudges (though props to Chrome, they at least implicitly activate your security key from the first modal so a power user who knows the trick can use it). So they are just as bad here IMO.

This is what I mean by "vendor lockin". It's not just about where the private keys are stored. It's the continual friction at each step of the interaction when you deviate from the vendors intended path. It's about making it so annoying to use anything else that you settle into one vendors ecosystem. It's about the lack of communication about where Passkeys are stored that tricks users into settling into their vendor ecosystem. That's vendor lock-in.

Cloud Keychains Are Still Blowing Up Data

We still get reports of people losing Passkeys from Apple Keychain. We similarly get reports of Android phones that one day just stop creating new Passkeys, or stop being able to use existing ones. One exceptional story we saw recently was of an Android device that stopped using it's onboard Passkeys and also stopped accepting NFC key. USB CTAP would still function, and all the historical fixes we've seen (such as full device resets) would not work. So now what? I'm not sure of the outcome of this story, but my assumption is there was not a happy ending.

If someone ends up locked out of their accounts because their Passkeys got nuked silently, what are we meant to do to help them?

Vendors Can Lock You Out

Dr Paris Buttfield-Addison was locked out of their Apple account.

I recommend you read the post, but the side effect - every Passkey they had in an Apple keychain is now unrecoverable.

There is just as much evidence about the same practices with Google / Android.

I honestly don't think I have to say much else, this is terrifying that every account you own could be destroyed by a single action where you have no recourse.

Authentication Providers Still Miscommunicate

We still have issues where services that are embracing Passkeys are communicating badly about them. The gold standard of miscommunication came to me a few months ago infact (2025-10-29) when a company emailed me this statement:

Passkeys use your unique features – known as biometrics – like your facial features, your fingerprint or a PIN to let us know that it’s really you. They provide increased security because unlike a password or username, they can’t be shared with anyone, making them phishing resistant.

As someone who is deeply aware of how webauthn works I know that my facial features or fingerprint never really leave my device. However asking my partner (context: my partner is a veternary surgeon, and so I feel justified in claiming that she is a very intelligent and educated woman) to read this, her interpretation was:

So this means a Passkey sends my face or fingerprint over the internet for the service to verify? Is that also why they believe it is phishing resistant because you can't clone my face or my fingerprint?

This is a smart, educated person, with the title of doctor, and even she is concluding that Passkeys are sending biometrics over the internet. What are people in other disciplines going to think? What about people with a cognitive impairment or who not have access to education about Passkeys?

This kind of messaging that leads people to believe we are sending personal physical features over the internet is harmful because most people will not want to send these data to a remote service. This completely undermines the trust in Passkeys because we are establishing to people that they are personally invasive in a way that username and passwords are not!

And guess what - platform Passkey provider modals/dialogs don't do anything to counter this information and often leave users with the same feeling.

Authentication Providers Are Still Playing Silly Games With User Choice

A past complaint was that I had encountered services that only accepted a single Passkey as they assumed you would use a synchronised cloud keychain of some kind. In 2025 I still see a handful of these services, but mostly the large problem sites have now finally allowed you to enrol multiple Passkeys.

But that doesn't stop sites pulling tricks on you.

I've encountered multiple sites that now use authenticatorAttachment options to force you to use a platform bound Passkey. In other words, they force you into Google or Apple. No password manager, no security key, no choices.

I won't claim this one as an attempt at "vendor lockin" by the big players, but it is a reflection of what developers believe a Passkey to be - they believe it means a private key stored in one of those vendors devices, and nothing else. So much of this comes from the confused historical origins of Passkeys and we aren't doing anything to change it.

When I have confronted these sites about the mispractice, they pretty much shrugged and said "well no one else has complained so meh". Guess I won't be enrolling a Passkey with you then.

One other site that pulled this said "instead of selecting continue, select this other option and you get the authenticatorAttachment=cross-platform setting. Except that they could literally do nothing with authenticatorAttachment and leave it up to the platform modals allowing me the choice (and fewer friction burns) of choosing where I want to enrol my Passkey.

Another very naughty website attempts to enroll a Passkey on your device with no prior warning or consent when you login, which is very surprising to anyone and seems very deceptive as a practice. Ironically same vendor doesn't use your passkey when you go to sign in again anyway.

Conclusion

Yep, Passkeys Still Have Problems.

But it's not all doom and gloom.

Most of the issues are around platform Passkey providers like Apple or Google.

The best thing you can do as a user, and for anyone in your life you want to help, is to be educated about Credential Managers. Regardless of Passwords, TOTP, Passkeys or anything else, empowering people to manage and think about their online security via a Credential Manager they feel they control and understand is critical - not an "industry failure".

Using a Credential Manager that you have control over shields you from the account lockout and platform blow-up risks that exist with platform Passkeys. Additionally most Credential Managers will allow you to backup your credentials too. It can be a great idea to do this every few months and put the content onto a USB drive in a safe location.

If you do choose to use a platform Passkey provider, you can "emulate" this backup ability by using the credential export function to another Passkey provider, and then do the backups from there.

You can also use a Yubikey as a Credential Manager if you want - modern keys (firmware version 5.7 and greater) can store up to 150 Passkeys on them, so you could consider skipping software Credential Managers entirely for some accounts.

The most critical accounts you own though need some special care. Email is one of those - email generally is the path by which all other credential resets and account recovery flows occur. This means losing your email access is the most devastating loss as anything else could potentially be recovered.

For email, this is why I recommend using hardware security keys (yubikeys are the gold standard here) if you want Passkeys to protect your email. Always keep a strong password and TOTP as an extra recovery path, but don't use it day to day since it can be phished. Ensure these details are physically secure and backed up - again a USB drive or even a print out on paper in a safe and secure location so that you can "bootstrap your accounts" in the case of a major failure.

If you are an Apple or Google employee - change your dialogs to allow remembering choices the user has previously made on sites, or wholesale allow skipping some parts - for example I want to skip straight to Security Key, and maybe I'll choose to go back for something else. But let me make that choice. Similar, make the choice to use different Passkey providers a first-class citizen in the UI, not just a tiny text afterthought.

If you are a developer deploying Passkeys, then don't use any of the pre-filtering Webauthn options or javascript API's. Just leave it to the users platform modals to let the person choose. If you want people to enroll a passkey on sign in, communicate that before you attempt the enrolment. Remember kids, consent is paramount.

But of course - maybe I just "don't understand Passkeys correctly". I am but an underachiving white man on the internet after all.

EDIT: 2025-12-17 - expanded on the password/totp + password manager argument.

> unlike passwords, there is no good provider migration story

I'm curious what the "good provider migration story" you're referring to here for passwords is?

The above goes for passkeys as it does passwords - import/export will include your passkeys - so I don't see much difference in the provider migration story.

Please don't use fixed-width fonts to write text. Please use fixed-width fonts to write code.

Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting.

(quoting https://news.ycombinator.com/newsguidelines.html)

I think part of the distress experienced by readers is due to mixing the fixed-width font with "text-align: justify". So it's close but not exactly fixed/consistent.

Firefox Reader Mode makes such sites more readable.

For those you add recovery e-mails. You can easily have a Google, Microsoft and Yahoo e-mail so having access to at least one means you can recover the rest. Yes, this increases your attack surface, but the chances remain miniscule.

I don't care what you other people in auth do, I work in auth too, please stop making signing into anything 5 steps.

1. First I get redirected to a special sign-in page.

2. Then I sign-in with my email only.

3. Then it finally asks me for a password, even for services that would never reasonably use SSO or have another post-email receive process.

4. Then I get redirected again to enter 2fa.

5. Then these websites ask if I want to create a passkey. No, I never want to create a passkey, and you keep asking me anyway.

6. Then, and only then, do I get to finally go back to using the service I wanted, and by then, you've lost whatever my `?originalUrl=` was, and I have to find it again.

No, don't send me a magic link. Because then I have to go do 4 more steps with Gmail or another mailbox provider and now signing in has become 10 or more steps.

No, don't tell me getting rid of passwords will help most of the population, and then force all of us to do the above, and blatantly lie to us that it's better.

Stop it. Get some help.

If you created a passkey, it would be one step.

And what about password sharing? I want to share everything with my partner,in case something happens to me.

Passwords right now are outright better.

And by the way, door keys could be copied.

People keep falsely imagining that Google is setting people up with passkey-only accounts, with no way to backup their login credentials. Gosh, wouldn't that be terrible?

If Google allowed you to create a passkey-only account, with no SMS 2FA and no way to backup your passkey, that would be even worse.

But, luckily for all of us, they don't even allow that, and they're certainly not pushing it unilaterally on billions of people.

Also, just so I'm clear, there's no requirement to share passkeys. Or even have passkeys enabled on all devices, right?

If I log in to a site from my machine, and set up a passkey, but then log into that site from another machine, it'll just see no passkey present and ask for my password, yes?

A passkey is a local password on a device that could be shared through all the password manager gymnastics, but its not required as I understand it.

Yes, that's right. It might also make sense to generate multiple passkeys for an account. For example, a separate one for logging in from Apple devices.

It's great until they break their phone, or spill coffee on it, or just lose it, and now they are locked out of EVERYTHING with no good way to get back in.

Passwords on a piece of paper for better or worse do not have that problem.

You omitted my favorite feature: virtually immune to phishing. You can't accidentally submit a passkey to a lookalike domain.

For phishing protection, passkey as a single factor is better than memorized password + TOTP/SMS two factor.

How does the secret jump from the PC to their phone? How do they know each other? ...does the answer involve going all-in on Apple forever?

Huh? I’ve seen zero implementations that work seamlessly across computer, phone, tablet - unless they are all single platform, which I have yet to see anyone actually pull off.