[cpburns2009]

This is the main reason I've avoided passkeys. I have these exact questions and there's no a clear explanation given for these. I don't want to lose access to important accounts.

[dijit]

Agreed, it's the exact same as me, I haven't seen someone put it into such succint words before, so bravo.

I think the reason is because I've anchored passkeys into my understanding of how 2FA works, and the pain of migrating 2FA from one phone to another.

So, I don't want to bother with it.

[pas]

use an app where you can backup the 2FA DB.

https://f-droid.org/en/packages/org.liberty.android.freeotpp...

[dijit]

oh my god, so not the point.

[pas]

> there's no a clear explanation

there's. it depends on how the site implemented passkeys.

I'm using multiple devices and passkeys via keepassXC. I haven't lost access or even got locked out of any accounts.

but it's like 2FA, and almost all sites have a clean fallback (backup codes) for 2FA.

[thyristan]

> there's. it depends on how the site implemented passkeys.

so. no clear explanation.

[pas]

the same is true of passwords. some sites provide password reset some don't. how is that not clear?

[Telaneo]

> some sites provide password reset some don't

I'm yet to see a site that doesn't provide a password reset (excluding websites without passwords). What inane webdev though that'd be a good idea?

[Melatonic]

How do you sync the KeePassXC file?

[cpburns2009]

I use KeePassXC, just not for passkeys. I used to use Dropbox but now I use Syncthing. I use a strong password and a key file that IS NOT synced.

[jesseendahl]

This is the #1 most common misconception I see about passkeys. They do not make it more likely that you will lose access to your accounts. They actually have nothing to do with account recovery. They are just a stronger primary factor than a password.

Most providers continue to offer email-based recovery in the case that the end-user loses access to their primary factor, regardless of whether the primary factor is a password or a passkey.

And email based account recovery does not make the security advantages of passkeys disappear, which are:

- credential that's guaranteed to be unique

- credential that's guaranteed to be strong

- credential that cannot be phished (due to cryptographic binding to the domain at the time of credential creation)

- changes the incentives for compromising servers (there's nothing worth stealing from the server -- only public keys)

- if/when an app/website transitions to retiring password-based authN, then it will entirely eliminates credential stuffing attacks

And if the account recovery scenario in question is your Gmail or Apple account, then you would need to go through their account recovery flows regardless of whether you were using a password or a passkey:

https://support.google.com/accounts/answer/7682439?hl=en https://support.apple.com/en-us/118574

[brentm]

If you use something like 1Password it's very easy. It stores your Passkey and it syncs cross device. It's another thing but once it's set up it's less of a pain than using authenticator apps or having to find some random iPad that Google popped up an approval prompt on.

[sylens]

This is how I use them but you have to admit that this assumes 3-4 things about a user just to save them the hassle of supplying two factors at login time. It's also unclear to users if passkeys can be migrated from one password manager to another