Comment by littlecranky67
4 days ago
Passkeys are the wet dream of the IP industry. They don't want you account secured from hackers, they want you to be unable to pass your password along to friends and family, so they use it to watch your netflix or play your licensed video games.
I use GeforceNow, and everytime I start a new session to play Battlefield 6, EA makes me enter my password and sends me an OTP via email before I can play the game (due to GeforceNow, they don't save it for future sessions). It is horrible UX, and I would want turn that off. You know what, the whole world can use my account to play BF6, I don't care. THEY care so I don't share my GeforceNow+BF6 credentials with other people. An attested passkey, bound to a fixed device cannot be passed on. Add 24h cooldown on passkey changes, and you effectively stop account sharing.
Might be hard for them to get away with only allowing 1 passkey per account since someone may have a phone + laptop or something, but even if the limit is 3, now they can limit usage to 3 people.
They could have just implemented their own worse, non-standardized solution to be anti-user. Good actors can use cool tech for good purposes, bad actors can use cool tech for bad purposes.
But users would reject the UX. The whole point of passkeys is, you will be familiar with the process.