Post

@rmondello this is my main criticism of passkeys: used with this model, you don't own them, and instead of websites leaking millions of passwords, we now need to worry about vault providers leaking millions of passkeys.

@rmondello No true disagreement - resilience to physical loss was the big thing missing from physical security keys.

I admit I'm biased but we may have to haggle a little about how much effort is "a lot", vs how a bit of effort could have a big payoff.

Don't get me wrong -- the effort really starts to ramp up when trying to use physical keys for everything, with all of the crazy overhead and tracking required to manage which keys were used with which sites, etc. Passkeys are the big win at volume.

But it can be quite manageable to selectively using N physical keys to protect just one or two critical credentials -- like email / identity. And people can handle the mental model analogy of spare house / car keys (with a "much harder to call a locksmith" rider).

So a sweet spot for a non-trivial number of users might be "three physical keys for your Apple/Google account, and passkeys for everything else".