[johngalt]

Think of it like SSH authorized keys but automated for the web. Instead of storing the keys in a file; it stores them in a hardware security module (yubikey, or TPM).

Registration generates an asymmetric key pair between your passkey, and the website. Login is the usual challenge/response process. The biggest step forward is phishing resistance. A fake login page can relay a TOTP code, but not the passkey challenge/response.

[xg15]

Yes, those are the easy parts - but none if that answers GP's questions:

> If my passkey is on my phone what happens if I lose my phone? Do I need a unique passkey per device? How do I rotate them? What if a device gets stolen?

I'd also add: How do I login on a device or browser that I've never logged in before? If I'm on a public computer that I trust enough for quickly logging into my emails but (say, the local library or university PC pool), do I have to install my password manager first and then login with my master password? This seems backwards.

[Gander5739]

Answering respectively: it's lost; no; same way you reset passwords; depends what you mean "what if" - if your passwors manager is already authenticated and doesn't require reauthentication, then yes, it could be used to login.

And to answer your additional question, yes, I suppose you would either need to install your password manager or use whatever alternative 2FA login you have.

[emmaexe]

There isn't one correct answer because all those things are implementation dependent. Passkeys just define how a website, browser and OS communicate logging you in between eachother. If someone in charge of making a website designs a bad login system on top of that you will get a bad experience.

> Do I need a unique passkey per device?

If you store it in the device itself (passkey isn't moveable) and not a password manager (you can move the passkey around) then yes.

> If my passkey is on my phone what happens if I lose my phone?

Delete the passkey using another device. If your phone is the only trusted device/only device that had a passkey, begin account recovery (e.g. via email).

> How do I rotate them? What if a device gets stolen?

You shouldn't need to, if they are properly stored in the device (in hardware) and not a password manager they should not be extractable. But if you lost your device/it got stolen and you have no lockscreen password you would need another device that also has a passkey that you would use to invalidate the other one from the account settings page similarly to how you would change your password (you are logged in with another passkey, that is your "existing password" in the password model and you don't set a new password but instead delete the other passkey and create a new one). If instead you use a password manager and it gets breached, either rush in to create a new passkey (e.g. on device temporarily) and then delete the old one, or if they got ahead of you begin account recovery, similarly to if your password got extracted from your password manager.

> How do I login on a device or browser that I've never logged in before?

Similar to steam and discord's Qr code login system if you've ever used that. Ideally when you visit the website would generate a login session and you could then login from a personal device you have on you by scanning a qr code or manually entering a code (for devices without a camera). Probably also tick a checkbox that you are logging in on a public device and that you only want a short lived session, but such a feature doesn't generally exist in login systems that use passwords either, even though it would be convenient to have.

---

All these answers above depend on the login system being well designed. If the people writing the website don't let you register multiple passkeys or don't make it convenient to register a new one whenever you login on a new device, or don't offer the aforementioned Qr code login system or don't offer good account recovery - you will have a bad experience.

[xg15]

> All these answers above depend on the login system being well designed. If the people writing the website don't let you register multiple passkeys or don't make it convenient to register a new one whenever you login on a new device, or don't offer the aforementioned Qr code login system or don't offer good account recovery - you will have a bad experience.

But this is one of the points being discussed here. All of depends on a large number of choices that each site owner will have to get right. You could always argue "well, it's the site's fault for not doing it better", but the matter is that the site owner has to decide those things at all - and if course they will make their own tradeoffs or simply don't bother with certain features.

So you will always have a wildly inconsistent mix of different functionalities and constraints depending on the preferences of the individual services.

Whereas with passwords, implementers don't have to do any of those choices, the basic implementation already supports all those usage scenarios.

The QR code login flow is one such example. I probably have some bias that I don't like the thought of making my phone the sole authority for all my accounts, but even if you accept that, it's an exotic technically complicated flow for the exclusive usecase of "login on untrusted device". There are probably few sites that weigh that usecase high enough to implement the flow - whereas with passwords, there is nothing you have to implement, because the functionality is just a natural consequence of how passwords work.

[emmaexe]

> Whereas with passwords, implementers don't have to do any of those choices, the basic implementation already supports all those usage scenarios.

Sure, in that sense the usability is better, but now we are dependent on the website makers to make choices on security (offer good 2fa, don't limit passwords to 8 characters and store it on an ancient mainframe, etc.) and even then the usability can take a hit if the website is ignorant of or actively hostile to password managers (breaking autofill and such). Neither system guarantees a good experience.

With my example I tried to paint what a good passkey system would look like for OP, I am aware that leaving the usability part up to the website will result in such a mix.

[coip]

Enrolling with/registering several devices. Webauthn is pretty cool if not a bit complicated.

For example, passkey on iPhone and on the same account register a second key such as a yubikey.

That’s how my github is configd, for example: my phone and MacBook can auth w OS passkeys. If I need to login on another host, like my windows host or in your example at the library, the yubikey is another registered hardware authenticator.

Worth adopting/looking into imo