Comment by WorldMaker
5 days ago
Supporting multiple passkeys should be a minimum requirement for every Passkey implementation. It's generally worth naming and shaming the websites that don't implement that correctly. People want backup passkeys. People want both iOS keys and Windows keys for the most convenience.
My general advice for non-technical users that seems to work pretty well is "sign up for new sites with passkeys on your phone" because most non-technical people trust the password manager ecosystem on their phone, have some amount of multi-device sync already established, and the QR code started Bluetooth LE flow on desktop/Windows PCs for sharing passkeys works easiest with phone passkeys.
(I run a tiny site that is Passkey Only for login and it's been interesting providing technical support for it. One of the biggest recurring issues at this point is nothing in the Passkey flows themselves but the fact that the Facebook in app browser does not support Passkeys for a number of presumably security reasons, plus Meta being jerks, and having to remind new users to "Open in External Browser" before signing up/logging in when posting links to the site in Facebook.)
> The idea and protocol are pretty solid, though we're back to a "biometrics as password" problem in many device flows
It's still just biometrics as "device PIN". The crucial difference remains that the biometric data never leaves your device. To support Passkeys the remote website only ever sees your Passkeys' public keys, they never see biometric data, they never have a chance to store biometric data in a database to violate PII/HIPPAA/etc standards when it inevitably leaks to "hackers" (or gets sold to the highest bidder).
> Supporting multiple passkeys should be a minimum requirement for every Passkey implementation.
To go a step further, "multiple minimum" should be like... 5+. Enough to cover several devices (Laptop, Phone, Desktop) then at least one for backup/disaster-recovery purposes, and some wiggle-room for when replacing an old device with a new one.
P.S.: Though to re-echo the cynical refrain from the prior "is a trap" other piece [0], "Yet still Netflix does not want you to share your passkeys." In other words, services like them have a (bad, unreasonable) incentive to try keep that number down.
[0] https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-...
Netflix already tries to crackdown on account reuse by policing the number and type of devices you install it on at the same time. They don't necessarily need to double down on it by policing Passkeys. But also "Netflix is a bad actor" is a threat model that has a market correction: If you can't login to your Netflix account then don't pay for your Netflix subscription.
Netflix is more incentivized to keep people paying subscriptions than they are worried about people sharing passwords or passkeys. No one "needs" Netflix, it's an entertainment service. If they are truly a bad actor with respect to Passkeys then they upset too many consumers and lose a chunk of their audience.