Spotlight7573

Typically in most situations where a PIN is used on a modern device, it is not just the number you enter but some kind of hardware backing that is limited to the local device and also does things like rate limiting attempts.

you can’t just share passkey between your devices like you can with a password

You would just sign into your password manager or browser on both devices and have access to them?

Additionally, whatever app or service you're storing them in can provide sharing features, like how Apple allows you to share them with groups or via AirDrop.

there’s very little to no documentation about what you do if you lose access to the passkeys too.

If you lose your password, there are recovery options available on almost all accounts. Nothing about passkeys means the normal account recovery processes no longer apply.

So one password to access them all basically?

That's essentially how all password managers work currently though?

When most sites refer to passkeys, they're typically talking about the software-backed kind that are stored in password managers or browsers. There are still device-bound passkeys though. Also since they're just FIDO/WebAuthn credentials under the hood, you can still use hardware-backed systems to store them if you really want.

While you're right that device bound and non-exportable would be best from a security standpoint, there needs to be sufficient adoption of the tech by sites for it to be usable at all and sufficient adoption requires users to have options that have less friction/cost associated with them, like browser and password-manager based ones.

Looking at it through the lens of replacing passwords instead of building the absolutely highest-security system helps explain why they're not limited to device-bound anymore.

What separate auth operation is needed besides authenticating with the local device to unlock a passkey?

More usable for the average user and more supported by actual sites and services, so yes.

The passkey stored locally in some kind of hardware backed store on your device or in your password manager is the first factor: something you have.

The PIN/password or fingerprint/face to unlock the device and access the stored passkey is the second factor: something you know or something you are, respectively.

Two factors gets you to 2FA.

And the fewer times that people are entering their password or email/SMS-based 2FA codes because they're using passkeys, the less of an opportunity there is to be phished, even if the older authentication methods are still usable on the account.

You do realize that your biometric authentication techniques don't actually send your biometrics (e.g. fingerprint/face) to the website you're using and that you are actually just registering your device and storing a private key? Your biometrics are used to authenticate with your local device and unlock a locally-stored private key.

That private key is essentially what passkeys are doing, storing a private key either in a password manager or locally on device backed by some security hardware (e.g. TPM, secure enclave, hardware-backed keystore).

There was the one case with the scammers in the UK using a homemade cell tower to essentially send out phishing texts directly to cell phones in an area, completely bypassing the phone company. It seems like this scare texts scenario would fit that kind of tech even better, as you only need to send out a message once to a large amount of people and you don't need to collect information in response like in a phishing scenario.

Sadly I've run into the same type of problem with a newer TLD as well. My solution was to get a domain in the older TLD space (e.g. .com, .net, .org). I doubt this will be the last site you run into that doesn't support a newer TLD and the low likelihood that you're going to be able to convince someone to fix the issue at every one of those outdated sites means that you'll eventually need a backup domain for something.

I feel like it's less a conspiracy and more that some people will accept nothing less than no ads or tracking whatsoever, even if it makes no economic sense with regards to how sites support themselves.