Comment by tadfisher
5 days ago
This isn't a standards problem, this is an "Apple, Google, and Microsoft made using your own software difficult" problem. They have an interest in making their authenticators the default, and the settings UX on all three platforms makes it unclear that their authenticator is active as well as your own "third-party" authenticator choice.
It’s difficult to disentangle one from another, when the companies with the vested financial interest in locking you in are the board members of the consortium creating the standard.
The standard doesn't dictate the UX of settings screens. That's entirely on the platforms which own the screens and I would hope that is kept out of already-huge standards like WebAuthn.
The difference between the standard and the implementation is useful for implementors, but makes no difference to users.
From a user's perspective, if the implementation sucks, the standard sucks.
Exactly. I'm disinclined to cut Apple, Google, and MS the benefit of doubt for steering a standards committee to spec + real world usage that privileges themselves.
It's not though. Passkeys are meant to allow you to have multiple. They also don't need to replace passwords. Take my bank setup. I have a password, a windows passkey and an android passkey. I saved the time needed to setup the passkeys, the very first time I used them. The passkeys are easier to use, than my password, and more secure.
you can see in both the lastpassword and the bitwarden tutorials that the default iOS password manager can be toggled on or off, just like the other options.