Comment by lukeschlather
7 days ago
I'm not sure I see the difference between a complex pairing dance and needing to install the iCloud Passwords app on Windows (I've used iTunes for Windows.) Writing down a password is much more reliable than expecting any of that to work.
I'm just trying to point out that you seem to be fighting strawmen and yelling about last decade's apps and technology as if that was the current state.
Writing down a password is simpler, but it is also stopped being reliable for the vast majority of users because it stopped being adequate security for the average user. Passwords are too easily stolen. Passwords are too easily reused because human memory is quite fallible. Passwords are too easily caught by a man-in-the-middle attack or a social engineering attack. Passwords are too easily leaked in a database breach. Even when properly hashed and salted, password hashes still are weak to rainbow tables and other such attacks.
Passkeys trade off a bit of supposed simplicity (if you ignore modern advice like use different passwords for everything and always use a password manager because you will never remember all your passwords, it's not humanly possible if they are also all secure enough passwords). But the tech is already at a very usable level of simplicity for average users. It's just like learning a password manager. For some average users it is even easier than learning a password manager the standards and standardized user flows have simplified a lot of the hard edges of the password manager, including the above mentioned "use a QR code to provide temporary access on some other device to your Passkey without syncing your full Password Manager".
Most people don't use password managers. I am not even sure that password managers really qualify as a reasonable amount of complexity for the average person. There's a cost/benefit and I think passwords + SMS 2-step-auth is a reasonable balance between usability and security for most people.
Obviously, I use a password manager and I use MFA where possible, but even that I find to be a little questionable from an availability standpoint because I have a hard time ensuring that I have multiple MFA devices located in different buildings, so a fire or a flood or something could totally lock me out of all my accounts, some of them possibly permanently, which is the thing that scares me more than getting hacked.
Passkeys (combined with full-disk-encryption by default) scare me because they make the assumption that most people would prefer to lose access to their photo library than risk someone breaking in and getting them, and I actually think most people would prefer the converse. If a burglar breaks into my house they can steal my TV, I can live without it, but please don't steal my photo albums (problem is they're the same thing.)