[preisschild]

> This is much, much simpler than you think it is. Passkeys are just passwords that require a password manager.

This is not true. There are device bound passkeys where the private key is stored in a HSM (TPM2.0, Android SE, or apple SE) instead of a hosted service (iCloud, Bitwarden.com). You can just add multiple Passkeys to a single site to have another backup device should your other one be unavailable.

[EvanAnderson]

Speaking about hardware tokens:

If I have to go get the backup out of "secure" storage each time I want to add a new Passkey it's not really a backup.

The design should have allowed, even if it was just within only the purview of a single manufacturer, a method for the device to export an encrypted dump that could be reloaded onto a factory-new device. Heck, make it a value-added service that the manufacturer has to initiate and tie it to some real-world identity verification.

The idea of having to put backup devices in-hand regularly is a bad design.

Phone apps. get around this idiocy by backing-up the encrypted Passkeys to a hosted service.

[pseudalopex]

> If I have to go get the backup out of "secure" storage each time I want to add a new Passkey it's not really a backup.

Yes.

> even if it was just within only the purview of a single manufacturer

> Heck, make it a value-added service that the manufacturer has to initiate and tie it to some real-world identity verification.

No.

[pseudalopex]

Just have the 2nd device when you create any account. But have it away from the 1st device always. Just update 10s or 100s of accounts for every new device. Just never use sites which allows 1 Passkey.