Comment by mahboi
4 days ago
TOTP was kinda like this too. The standard was fine, but actual implementations like Google Authenticator disallowed copying keys to another device, saying this is WAI and you're supposed to set up a separate TOTP per device. Absolutely user-hostile and took several years to fix.
Passkeys did better day 1 because they synced, probably just cause password managers are better now than back in the TOTP days. But for some reason the standard has a way for them to force you to use like a WEF-approved KYC passkey store.
I for the life of me cannot understand how these three things coexist about passkeys:
1. They should be locked down to a single device.
2. They should not be allowed to be copied from device to device.
3. Syncing between devices is perfectly acceptable.
From what I understand, these three aren't always true. Some can be copied/synced, others cannot. And even for copyable ones, there may be rules about where you can copy them to, plus Apple Keychain for a while had no way to export the passkeys at all.