Comment by lukeschlather
7 days ago
Bluetooth is very hard to use. This just isn't about hardware support, it's about "how long does it actually take the average person to do a Bluetooth-mediated workflow, how consistent is it between devices, if someone is trying it with a new device, what is the learning curve?" If someone can't figure out how it's supposed to work between their iPhone and their Windows laptop, there might theoretically be support. Practically speaking it's broken most of the time.
The deeper problem is that the default behavior is storing a passkey directly on a specific device and hardware-locking it to that device. That's great if you're an enterprise or whatever and you've got SSO set up well. For the average person, "I lose my iPhone and it effectively resets all my passwords" is a hopelessly unusable workflow.
I store passkeys in a 3rd party password manager which has an app on my phone, so I'm only relying on Apple to handle the bluetooth mediation and they do that very well.
I maybe lucky, but outside of headphones bluetooth has never failed to work for me.
Now with a 3rd party password manager, I can install it on any device and all my passwords work there too. However, with Apple, it stores it on keychain so if you have an internet connection, your passwords are backed up.
If you don't have an internet connection, you're not the average person.
That is a hopelessly unusable workflow which is why the default behavior on iOS is storing Passkeys in iCloud Passwords and having cloud sync between devices and cloud backup/restore.
On Windows you can use Apple's iCloud Passwords app for Passkeys now directly, in supported browsers because for whatever reason Apple's engineers didn't want to build a Windows plugin for it (yet?) or you can use the Bluetooth option. Windows 11 makes it very easy to use the Bluetooth option and for better/worse some of the requirements that made Windows 11 stop supporting older hardware were also those making sure that Bluetooth LTE is reliable especially for Passkeys.
In the Bluetooth flow the "only" user facing mediation step is the QR code. Some of Microsoft, Apple, and Google's finest all worked together to make sure that UX is about as simple as it can be with just about no learning curve. If someone is used to pulling up a QR code in the camera app and clicking the default app it wants to pop up, "it just works".
If you hear Bluetooth and think of complex pairing dances, that is nothing like how Passkey signings over Bluetooth work. The devices don't need to be "joined" or "paired", they just need clear enough radios for a quick couple of messages, which a QR code kicks off.
I'm not sure I see the difference between a complex pairing dance and needing to install the iCloud Passwords app on Windows (I've used iTunes for Windows.) Writing down a password is much more reliable than expecting any of that to work.
I'm just trying to point out that you seem to be fighting strawmen and yelling about last decade's apps and technology as if that was the current state.
Writing down a password is simpler, but it is also stopped being reliable for the vast majority of users because it stopped being adequate security for the average user. Passwords are too easily stolen. Passwords are too easily reused because human memory is quite fallible. Passwords are too easily caught by a man-in-the-middle attack or a social engineering attack. Passwords are too easily leaked in a database breach. Even when properly hashed and salted, password hashes still are weak to rainbow tables and other such attacks.
Passkeys trade off a bit of supposed simplicity (if you ignore modern advice like use different passwords for everything and always use a password manager because you will never remember all your passwords, it's not humanly possible if they are also all secure enough passwords). But the tech is already at a very usable level of simplicity for average users. It's just like learning a password manager. For some average users it is even easier than learning a password manager the standards and standardized user flows have simplified a lot of the hard edges of the password manager, including the above mentioned "use a QR code to provide temporary access on some other device to your Passkey without syncing your full Password Manager".
1 reply →