Comment by lukeschlather
8 days ago
That's fine if you've got a couple of supported devices. The hardware support is however very bad. If my hardware is unsupported (and most hardware in the world is unsupported) that's not very helpful.
8 days ago
That's fine if you've got a couple of supported devices. The hardware support is however very bad. If my hardware is unsupported (and most hardware in the world is unsupported) that's not very helpful.
This "use a passcode from another device such as my phone" tech mentioned above is just Bluetooth LTE. Every phone and most laptops and desktops in the last decade or so has Bluetooth LTE support. Hardware support is very good.
Passkeys are built on Webauthn (and ultimately sort of synonymous with it) and that has always been the web standard for all physical key support such as Yubikey and is basically the same as it has been for decades when dealing with Passkeys only with updated UX on top. Hardware support here is pretty good, too.
Since you made this mistake a few times:
Its Bluetooth LE, not LTE!
LTE is 4g, LE is a Bluetooth spec (literally means Low Energy).
Bluetooth is very hard to use. This just isn't about hardware support, it's about "how long does it actually take the average person to do a Bluetooth-mediated workflow, how consistent is it between devices, if someone is trying it with a new device, what is the learning curve?" If someone can't figure out how it's supposed to work between their iPhone and their Windows laptop, there might theoretically be support. Practically speaking it's broken most of the time.
The deeper problem is that the default behavior is storing a passkey directly on a specific device and hardware-locking it to that device. That's great if you're an enterprise or whatever and you've got SSO set up well. For the average person, "I lose my iPhone and it effectively resets all my passwords" is a hopelessly unusable workflow.
I store passkeys in a 3rd party password manager which has an app on my phone, so I'm only relying on Apple to handle the bluetooth mediation and they do that very well.
I maybe lucky, but outside of headphones bluetooth has never failed to work for me.
Now with a 3rd party password manager, I can install it on any device and all my passwords work there too. However, with Apple, it stores it on keychain so if you have an internet connection, your passwords are backed up.
If you don't have an internet connection, you're not the average person.
That is a hopelessly unusable workflow which is why the default behavior on iOS is storing Passkeys in iCloud Passwords and having cloud sync between devices and cloud backup/restore.
On Windows you can use Apple's iCloud Passwords app for Passkeys now directly, in supported browsers because for whatever reason Apple's engineers didn't want to build a Windows plugin for it (yet?) or you can use the Bluetooth option. Windows 11 makes it very easy to use the Bluetooth option and for better/worse some of the requirements that made Windows 11 stop supporting older hardware were also those making sure that Bluetooth LTE is reliable especially for Passkeys.
In the Bluetooth flow the "only" user facing mediation step is the QR code. Some of Microsoft, Apple, and Google's finest all worked together to make sure that UX is about as simple as it can be with just about no learning curve. If someone is used to pulling up a QR code in the camera app and clicking the default app it wants to pop up, "it just works".
If you hear Bluetooth and think of complex pairing dances, that is nothing like how Passkey signings over Bluetooth work. The devices don't need to be "joined" or "paired", they just need clear enough radios for a quick couple of messages, which a QR code kicks off.
3 replies →