Syncable passkeys do make it easier to handle new devices, but break one of the key values of passkeys - device atteststion. Syncable passkeys are effectively just long passwords as they aren’t tied to a device, meaning anyone who gets ahold of the passkey can access your accounts.
At least with syncable passkeys you can’t have a website leak your passkey (as they asymmetric keys), but with password+MFA a leaked password doesn’t give direct access to your accounts.
Too many services don’t allow multiple passkeys per account. If they are supposed to be device level attestation, you need to be able to enroll one per device. I know that there are some frameworks to connect an enrolled device to attest, but that a) plain doesn’t work well for some configs, and b) is annoying. I understand having a hardware security key for some stuff, but I feel like having that be a random ass phone for most people isn’t really that desirable.
I feel like syncable passkeys are a band aid on top of most services having no idea how to implement passkeys well.
That’s good to know, I’ve honestly been avoiding them as I find the rollout and concept from to be questionable at best.
Given those issues I’ll be curious to see if passkeys keep up their momentum. It sounds a lot like a solution that solves some problems while creating other problems.
Syncable passkeys do make it easier to handle new devices, but break one of the key values of passkeys - device atteststion. Syncable passkeys are effectively just long passwords as they aren’t tied to a device, meaning anyone who gets ahold of the passkey can access your accounts.
At least with syncable passkeys you can’t have a website leak your passkey (as they asymmetric keys), but with password+MFA a leaked password doesn’t give direct access to your accounts.
Too many services don’t allow multiple passkeys per account. If they are supposed to be device level attestation, you need to be able to enroll one per device. I know that there are some frameworks to connect an enrolled device to attest, but that a) plain doesn’t work well for some configs, and b) is annoying. I understand having a hardware security key for some stuff, but I feel like having that be a random ass phone for most people isn’t really that desirable.
I feel like syncable passkeys are a band aid on top of most services having no idea how to implement passkeys well.
That’s good to know, I’ve honestly been avoiding them as I find the rollout and concept from to be questionable at best.
Given those issues I’ll be curious to see if passkeys keep up their momentum. It sounds a lot like a solution that solves some problems while creating other problems.