Comment by cowlevel
5 days ago
What if the website loses its domain? There are plenty of examples of dickish domain registries and registrars, domain holders getting phished, etc. How do you reset it to the new domain?
5 days ago
What if the website loses its domain? There are plenty of examples of dickish domain registries and registrars, domain holders getting phished, etc. How do you reset it to the new domain?
If you lose your domain, you have bigger problems than just passkeys. If you just used passwords, users would still have to somehow locate your new site and trust it with the password previously associated with your old site. Password managers won't input passwords from one domain onto a new domain.
As someone else said, you'd have to do an email blast and hope users trust the email blast as authentic to trust your new domain, and just someone phishing.
Loss of a domain is so catastrophic for trust that passkeys don't make it much worse.
Allow email resets in the case of a lost domain. You could disable them in normal operation but in this case, any users with passkeys from the old domain can enroll a new one via email.
Does the passkey still serve a purpose in this scenario? Why not log them in by email and set a very long lived cookie so they don't have to log in often?
In my example reset by email has only been activated as a disaster recovery scenario where the site has lost it's domain. Under normal circumstances you would not enable it.