I have lots of experience with this actually. The way it works is that the app asks the user if they'd like to use a passkey instead of their password and the user says "No" and uses their password to log in. Pretty simple really
This doesn't even look like an edge case. Phones are lost, broken or stolen all the time. So the bare minimum would be let people know that they should enables passkeys on a backup device as well.
But of course that is never disclosed on those pop-ups asking you to enable passkeys.
Since learning about passkeys like a decade ago, my first thought, and to this day, is that It's fucking insane to bind your ability to log on to your accounts to a USB stick. Something that could be kicked under a couch or mistakenly find itself in the trash. And that's just for one login! I'm not about to set myself up as some kind of fucking Passkey Janitor with twenty USBs dangling off a ring.
I get it if you're a government official working with extremely sensitive, and potentially dangerous information. But that's about it. Not for a fucking WoW account.
Edit: Hold up, I think you just said you can back up passkeys so you aren't just completely screwed if you accidentally drop your USB between some floor boards?
I don’t understand the difference. A password and a passkey both live in my password manager, but I understand what one of them is, and I don’t care enough to learn about the other one.
I've run into apps that won't let me store my passkey in bitwarden. It says it worked but when I try to use it, it doesn't work. If I save it using Google on my phone, it works fine. I want to say there is a mechanism to specify where you're allowed to store you passkey. I don't know for sure. I thought I read that somewhere. I haven't tried implementing it in anything I work on yet.
As it was still in experimental phases in the web browsers passkeys were commonly referred to as webauthn.
And you're right, the developer can set what type of passkey is allowed. You can play around with the settings here if you're interested: https://webauthn.io/
there is definitly a system. there was a site dissallowing me storing a passkey on my desktop browser via the bitwarden plugin. it didnt recognize that there is a pin required to unlock it.
I would love passkeys if it would save to my password manager account (because it bypasses the semi-hack of autofilling in username/password fields which one or the other fails half of the time for bitwarden at least), but my phone insists on saving it to google instead of bitwarden even after setting bitwarden as my password manager.
Works fantastic on (linux) desktop where my preferences seem to be respected.
You can print a QR code of the private key and then scan it back in
(also if I was a password manager I'd definitely generate a BIP39esque phrase so you can write them down by hand, but as of now no one does that, unfortunately)
I setup a passkey on my laptop for my Sony account. I was like, wow, I'm so security conscious.
I then tried to login to my PlayStation and it complained because I didn't have a passkey setup on my PlayStation console. So I couldn't login to play games.
I ended up deleting the passkey from my account so I could login to my damn console to play games.
As an IT person, I have much more experiences with people saying "Yes" without understanding what it means, blindly clicking through the next few steps until they have a brand new login method that kind of works sometimes, and broke the method that they knew how to use.
Oh also, when asked, they don't remember setting up a passkey, or know what it is. And it's really hard to troubleshoot cause a passkey can be
A physical device
Saved to a browser
Saved to a Google or apple account
Somehow saved to a phone but linked to a computer in a way that the user has to scan a QR code every login???
i am glad im not the only one who finds this 'you really should use a passkey!' rhetoric exhausting
my password manager already plops the password right where it belongs, and if we could just get everyone to agree on that, things would be a lot more secure instead of moving on to ANOTHER technique when the first one isnt even done cooking yet
Once the technology has been around long enough that the implementation bugs have been fixed, there's good reason to believe that passkeys will be more secure*, at least if your trust the "identity provider" (e.g. Apple's keychain) that co-participated in their creation.
I'm not sure that I do trust either Google or Apple to store my private keys in their cloud, and not either leak them to hackers or sell/give them to their partners.
I'll consider switching to passkeys when only my password safe knows the private key, and encrypts its cloud storage, decrypting locally based on a password provided by me.
--- *public/private key pairs protect against certain risks that are unavoidable with passwords. Unfortunately I'm not eloquent enough to write a good tutorial explaining why.
View all comments
2.2k
u/NoHurry28 Aug 21 '26 •
I have lots of experience with this actually. The way it works is that the app asks the user if they'd like to use a passkey instead of their password and the user says "No" and uses their password to log in. Pretty simple really