Comment by OkayPhysicist
5 days ago
The problem with "sites must allow you to have multiple passkeys" bullshit is that sites aggressively push you towards making that first passkey, but then hide the process for adding additional ones 6 layers deep in settings such that a typical user will never see it.
I literaly just had to unfuck my grandfathers webmail because of this garbage. "oh, I can only log into my email on my ipad now" and I immediately knew the shadowy cabal of evil over at the FIDO Alliance were to blame.
It is up to us technical users to make sure the other 90% of society don't fall for this shit. Tell them it's the mark of the beast, tell them that it's fascists seizing control of your identity, tell them whatever will make them run for the damn hills anytime they see "alternative ways to sign in".
TOTP was kinda like this too. The standard was fine, but actual implementations like Google Authenticator disallowed copying keys to another device, saying this is WAI and you're supposed to set up a separate TOTP per device. Absolutely user-hostile and took several years to fix.
Passkeys did better day 1 because they synced, probably just cause password managers are better now than back in the TOTP days. But for some reason the standard has a way for them to force you to use like a WEF-approved KYC passkey store.
I for the life of me cannot understand how these three things coexist about passkeys:
1. They should be locked down to a single device.
2. They should not be allowed to be copied from device to device.
3. Syncing between devices is perfectly acceptable.
From what I understand, these three aren't always true. Some can be copied/synced, others cannot. And even for copyable ones, there may be rules about where you can copy them to, plus Apple Keychain for a while had no way to export the passkeys at all.