I am going to be giving some public talks about passkeys in the next few months. What questions do you have about passkeys and what topics do you want covered in me exploring passkeys?
Replies:
0
@rmondello Are we anywhere near having a declarative, JavaScript-free way to do passkey auth from HTML? It's lame that in order to use passkeys we need to enable JavaScript on every site and it seems like it wouldn't be that hard for browsers to ship a <webauthn> element...
@roguelazer I don’t think we are.
@rmondello late to this thread, but I’d love to hear approaches for implementing the server side of things. Particularly things like handling account recovery (i.e. if the passkey is lost) in a user-friendly way, with bonus points for not requiring/collecting identifying details like an email address.
@rmondello How to deal with changing platforms / vendor lock in.
@rmondello I think the whole topic of (most) password managers locking the passkeys inside them with no export/import or other way to access them is on many peoples minds (mine included).
(e.g.: How do I create an offline backup? How do I sync them between devices, if I don‘t want to sign up for any cloud service, but also can‘t put them on a USB stick?)
@rmondello when are passkeys going to be PQC ready and how will this work? Will this involve reenrolment at some point in the future for existing passkeys?
I'm not worried, I know we have plenty of time and I have my own ideasiintuition (but I'd love them confirmed or contradicted by someone who actually knows 😊)
@rmondello passkeys and 2FA. do we need an otp token if our device already ask for biometric/password?
@rmondello what is the best way for families to use passkeys for shared accounts? How can "legacy" accounts with passkeys be accessed after the primary user dies?
@rmondello What happens if my iCloud gets full? What happens if Apple blocks access to my account for whatever reason?
@rmondello how secure are they really, and are they worth their inconvenience and ickiness?
@rmondello how can they be exported/backupped in a secure way across devices?
@rmondello my parents are starting to get old and they want to make sure their children and/or people they've granted power of attorney to can access their online accounts in case they're incapacitated or infirm. How can we do this with passkeys?
@rmondello why are all the big companies asking us over and over to create passkeys and they won't take no for an answer?
talk about passkeys on a USB security key (which makes me feel like I am in control) vs passkeys opaquely saved to local disk (which I feel like I dont control). Or even worse, saved somewhere hidden on the cloud
@rmondello Are there best practices for websites/apps implementing passkeys? One of the things I find frustrating is that lots of sites have different processes for logging in (do you put your email address innfirst? Click a button? Enter your password?!)
