[kalleboo]

> That's not as I understand it. Why would SMS OTP be used? 100% of accounts today will already have a password, that's how you would login if you lose your only passkey device.

I've been using passkeys on yahoo.co.jp for a while now after they prompted me to set it up.

It works fine on my Mac, but for whatever reason it won't see the passkey on my phone - it just pops up a QR code dialog and says to scan it on another device (my only other device is my Mac which won't scan QR codes). iCloud Keychain is syncing fine - regular passwords on other sites work.

Once that fails it drops back to SMS OTP. There is no option to log in with a password.

So as far as I see it, Passkeys are still an experimental technology. Passwords suck so I hope one day they figure out how to get it working.

[vdelitz]

Yes, the implementation is a challenge and the WebAuthn specs are even for experienced devs hard to understand (as it's an entirely new paradigm compared to other authentication methods).

In your case with your phone, I suspect that Yahoo has implemented some kind of device management and works with the WebAuthn request option AllowedCredentials to allow only certain credentials on a device (here probably something was messed up).