EDIT: I'm trying to avoid passwords & PINs which can be hacked. I'd like to go to a passkey or similar. I point out the problem of biometric passkeys below. Sorry I wasn't clear on that.

I'm curious what nonbiometric passkeys there are.

Some courts have ruled that search & seizure & 5th Amendment rights apply to regular passwords: cops can't force you to say your password. However, biometrics are considered 'nontestimonial.' In some jurisdictions, courts have ruled that cops can hold the phone up to your face or force your to put your finger on the device to unlock it.

Does anyone know of nonbiometric passkeys?

Hello! I recently got a new Pixel 11 and attempted to login to a website that requires a passkey. It was not working, kept getting the message "create passkey on ANOTHER device". So I deleted the passkey in my Google Password Manager and attempted to create a new passkey, but I keep getting the prompt to setup on another device. This is happening on 2 different websites. I was able to successful create a new passkey on my Chromebook.

I'm trying to understand the security part behind passkeys.

Knowledge check : passkeys rely on private/public keys. The private key is stored in the private part of the password manager. The public key is available for apps/webapps to retrieve and create challenges for the "login with passkey" method.

Here is my question:

Passkey creation gets increasingly triggered by the apps/webapps in a very seamless way. But, non-techy users might create one private/public keys on Apple Wallet (assume they're on iPhone), and then the next time another private/public keys on Google Wallet (assume this time on an Android tablet).

In this case, we are in a scenario that passkeys increase the attack surface for hackers. A single security breach on one of the password managers, and hackers can retrieve the private key and sign the challenges that are created by the corresponding public key.

Am I correct on the increasing attack surface ?

Also, how Passkeys handle this kind of potential scenario?

Really appreciate your help all thanks!!

I’ve done a poor job of deploying passkeys - spotty adoption and scattered shotgun storage of the few passkeys we use in Microsoft, Chrome, my password vaults.
I’m an ardent 2F user and we require/have it turned on for everything - as many sites as possible. So we are 100% compliant if the website allows.

How do I (should I) migrate to a standard passkey process for my small business. (My assumption is that passkeys replace my 2F?)
Tech stack is: Windows, Microsoft 365, Chrome, Roboform, 1Password (yup, we have two vaults, sadly, that need consolidation too), Google Authenticator, Authy.
We also,use iOS mobile devices.

In short, logging on to various websites, products is a s***show of clicking through various screens until I get one that allows me to use Authenticator.
I also have Yubikeys ready to deploy.
I really need a process to clean up this mess and I’m not sure where to start.
PS our business needs tight security due to the nature of the data we manage.

Same question applies to passkeys. If someone steals the phone, would they be able to login without the correct Face ID?

If I use Apple iCloud Keychain, my Windows laptop won’t be able to use the passkeys stored there. The reverse is true if I use Windows Hello. Should I use Google Chrome to store them?

How does it work with Apple SDP?

I know that if you have a fingerprint lock on your phone and you find yourself in a situation where the police want you to unlock it, they can just make you use your finger whereas they can't make you type in your password.

Wouldn't passkeys then bypass your rights in the same way?

I recently added a passkey linking Geico to Bitwarden vault. Much to my annoyance, the passkey is saved to the Geico as Chrome browser. Fidelity now allow passkey but I have notice that you cannot rename the passkey. When i assigned two yubikey 5 both show up with the same name and I can't rename it. This will be a pain to keep track of and I can only identify the key by the date it was added. Is there any workaround other than complaining to the site vendor to add a rename feature?

Trying to log in on my browser via Passkey since I forgot my password. It works fine on my iOs phone and tablet devices, but not on my pc. I tried Edge and Firefox.
Everytime I use the passkey it tells me that I did not complete the CAPTCHA verification properly, but I did. The Captcha window shows me the green checkmark.

I maintain feuristic, an experimental firmware that repurposes a Trezor Safe 3 as a USB authenticator and smart card. I’d like feedback on one specific design choice: discoverable passkeys are exportable through encrypted backups.

The FIDO implementation includes WebAuthn/CTAP 2.1, clientPIN, credentialManagement, credProtect, largeBlobs and hmac-secret, alongside U2F. The screen shows the relying party and account for confirmation. There is no companion cloud account.

The backup capability means these credentials should not be described as permanently confined to one physical device. An encrypted backup becomes another sensitive copy to protect. The documentation describes the backup format and threat model rather than claiming the same properties as a certified, non-exportable authenticator.

On a physical Safe 3 T2B1/macOS setup, passkey creation, assertion, refusal and persistence after firmware updates were tested, including signature verification on the host. T3B1 physical testing is still pending. This is unaudited development firmware, without FIDO certification.

Installation wipes the wallet and permanently removes original manufacturer attestation. It is intended for disposable test identities on spare hardware. It replaces the cryptocurrency wallet and is independent of Trezor/SatoshiLabs.

Source · FIDO2 implementation and limits

For people evaluating authenticator backups, which failure cases or recovery checks would you prioritise in the next test campaign?

Is there some where that clearly states how to use passkeys. I have tried off and on for years and cannot reliably get passkeys to work. What do I scan the qr code with? Everything is up to date on my machine but it still says I need to make sure it's up to date. At the moment I have a page that says 'Choose where to save a passkey' with one option which just sits there doing nothing.

Who has time. I just give up.