Comment by WorldMaker
7 days ago
That is a hopelessly unusable workflow which is why the default behavior on iOS is storing Passkeys in iCloud Passwords and having cloud sync between devices and cloud backup/restore.
On Windows you can use Apple's iCloud Passwords app for Passkeys now directly, in supported browsers because for whatever reason Apple's engineers didn't want to build a Windows plugin for it (yet?) or you can use the Bluetooth option. Windows 11 makes it very easy to use the Bluetooth option and for better/worse some of the requirements that made Windows 11 stop supporting older hardware were also those making sure that Bluetooth LTE is reliable especially for Passkeys.
In the Bluetooth flow the "only" user facing mediation step is the QR code. Some of Microsoft, Apple, and Google's finest all worked together to make sure that UX is about as simple as it can be with just about no learning curve. If someone is used to pulling up a QR code in the camera app and clicking the default app it wants to pop up, "it just works".
If you hear Bluetooth and think of complex pairing dances, that is nothing like how Passkey signings over Bluetooth work. The devices don't need to be "joined" or "paired", they just need clear enough radios for a quick couple of messages, which a QR code kicks off.
I'm not sure I see the difference between a complex pairing dance and needing to install the iCloud Passwords app on Windows (I've used iTunes for Windows.) Writing down a password is much more reliable than expecting any of that to work.
I'm just trying to point out that you seem to be fighting strawmen and yelling about last decade's apps and technology as if that was the current state.
Writing down a password is simpler, but it is also stopped being reliable for the vast majority of users because it stopped being adequate security for the average user. Passwords are too easily stolen. Passwords are too easily reused because human memory is quite fallible. Passwords are too easily caught by a man-in-the-middle attack or a social engineering attack. Passwords are too easily leaked in a database breach. Even when properly hashed and salted, password hashes still are weak to rainbow tables and other such attacks.
Passkeys trade off a bit of supposed simplicity (if you ignore modern advice like use different passwords for everything and always use a password manager because you will never remember all your passwords, it's not humanly possible if they are also all secure enough passwords). But the tech is already at a very usable level of simplicity for average users. It's just like learning a password manager. For some average users it is even easier than learning a password manager the standards and standardized user flows have simplified a lot of the hard edges of the password manager, including the above mentioned "use a QR code to provide temporary access on some other device to your Passkey without syncing your full Password Manager".
Most people don't use password managers. I am not even sure that password managers really qualify as a reasonable amount of complexity for the average person. There's a cost/benefit and I think passwords + SMS 2-step-auth is a reasonable balance between usability and security for most people.
Obviously, I use a password manager and I use MFA where possible, but even that I find to be a little questionable from an availability standpoint because I have a hard time ensuring that I have multiple MFA devices located in different buildings, so a fire or a flood or something could totally lock me out of all my accounts, some of them possibly permanently, which is the thing that scares me more than getting hacked.
Passkeys (combined with full-disk-encryption by default) scare me because they make the assumption that most people would prefer to lose access to their photo library than risk someone breaking in and getting them, and I actually think most people would prefer the converse. If a burglar breaks into my house they can steal my TV, I can live without it, but please don't steal my photo albums (problem is they're the same thing.)