[jmsgwd]

> Because by default, they do, and you have to explicitly install software to let it be moved

Apple's native passkey implementation doesn't require doesn't require you to install extra software, and the passkeys sync by default. I thought Google's and Microsoft's were similar - but I haven't tried them.

> And even if you do, it’s discouraged

Really? Where is it discouraged? I thought synced passkeys are intended as the solution for consumers.

> the spec is allowed to deny you access

Yeah but I thought that's for enterprise use cases, not consumer. E.g. employers that want to enforce device type restrictions on their employees.

[spencerflem]

It does if you want to share accounts between my iOS phone and Linux desktop. And it still puts you entirely at the whims of Apple, etc. if you’re allowed to log in to unrelated accounts.

& I think it is mostly being used for enterprises for now ,but much like TPM and remote attestation running on “my” computer, I don’t like that it’s an option