[vel0city]

The first time I log in to a service on a new device it'll prompt me to sign a challenge with a previous passkey. If I've got my yubikey handy I'll just plug it in and sign it and add a new passkey to my new device. If I only have my phone the site will flash up a QR code I scan with my phone which signs and posts back the proof to a callback URL for the site. I only need to do this once per device if I add a passkey to the device.

[threecheese]

Is the fact that you need access to an already- enrolled device to create additional passkeys part of the threat model that passkeys resolves, or just an annoying detail? And is this for every site, or just once per device? I can just look it up, this thread has been great to improve my mental model enough to start considering trusting it.

[vel0city]

Its per-site. So the first time I log into GitHub on a new device, I need to do the handshake with another device. The first time I sign into Coinbase, I need to do the handshake with the other device.

So this typically means when I get a new device I'll have my Yubikey in a bag or something with me for a while and pull it out from time to time. Eventually practically every site I use gets enrolled on the new device and I never actually need to reach for the Yubikey or my phone or whatever.

I don't really make any concerted effort to go through each and every account when I get a new device, it'll pretty much just happen eventually. When I do sign up for a new account that supports passkeys I do try and make an effort make a passkey on at least two devices though, often at least whatever device I'm using to initially register and my yubikey. Then I'll make a point to log in sometime in the next few weeks on another computer and create a passkey there. Eventually I'll probably end up logging in and making passkeys on most of my devices.

Needing to auth with an existing passkey is a major part of the model. If you could just log in and create a new passkey with just a regular password, what's the point?