[fbnlsr]

The problem with passkey is that it's obscure for the common folk.

I'm a developer, yet for some odd reason I'm having a hard time understanding passkeys. Are they synced between devices? Do I need to set up a passkey per device? What happens if I have a single passkey on my phone and it gets lost? Do I lose access to that service?

So many questions that need a clear and concise answer.

[qingcharles]

The support is a little buggy on Windows too.

One issue I found recently was changing my GPU clearly changed the definition of my "device" in Windows and invalidated all my passkeys. But the passkeys are still there, the sites I access still try to request them, but Windows can't provide them, so it basically just errors out. Not found out how to clear this all out yet.

[hn_acc1]

30+ years of software dev, but I rarely had to worry about security. I've grown up with passwords (from 1980s BBS logins on up), but just like you, I still don't fully "grok" passkeys, in the sense of how I understand passwords, their threat model, how they can be cracked, etc.

I think I understand it's a bit like a "my public SSH key + website's public SSH key merged together", so that each website can verify the passkey we created together using their private key. The basic mechanism is more or less straightforward.

What I do not understand well is the "how to store and manage 100s of passkeys", and how to migrate my family (including my parents in their 80s, who are far away and I am the main tech guy when the closer "basic tech literate" family members who live closer can't figure things out) to them. We use Linux and Windows boxes at home, and Android phones (for now).

I can easily log into any accounts from any of these, even from my work laptop if needed, some requiring SMS 2FA (let's leave that for another discussion). If I created a passkey on a linux desktop and stored it in a yubikey, can I re-use it on someone else's windows laptop? Would I need the bluetooth version of the Yubi to sync with my phone? Or would I have to create a unique passkey from each device to each website, using my existing password?

Basically: I don't have "one phone" and "one computer", both running the same OS. What are some usage models, including some that don't require yubikeys, because no way could I get my parents in their 80s to understand those.

[vbezhenar]

Most implementations sync passkeys to the respective clouds.

[crazygringo]

How do I log into that cloud account? Since I can't do it recursively with a passkey stored in it, can I?

And what if that cloud account decides to cut off my access?

[prmoustache]

Anything that depends on a cloud service where your account can be destroyed any time without any recourse because support is managed by bots is a no go.

[hulitu]

> Most implementations sync passkeys to the respective clouds.

So, in the end, the old Microsoft mantra: "Your security is very important for us". Besides Microsoft, NSA, CIA, the five eyes and friends, no one has access to your passkey, this means is secure.

[criddell]

Is there a fallback for when the respective cloud services are unavailable?

[ghusto]

Do the keys need passwords to work, or is the key itself sufficient? i.e. Is it like an SSH key without or with a password?