Post by @rmondello@hachyderm.io

RE: https://mastodon.social/@monkeydom/117382425456803989

100% true. “Automatic passkey upgrades” is a feature of WebAuthn that allows for websites and apps to turn around and add a passkey to your saved account in a password manager right after you sign in with your password, assisted by that password manager.

Apple Passwords allows these upgrades by default (and tells users when it happens!) and I strongly believe it’s the right default. Why?

Passkeys make signing into accounts faster than passwords + traditional, phishable 2FA. If the user is already using the Passwords app for their password for an account, they’ve asked for the software to help them have a secure and smooth experience. Once someone has a passkey and starts using it in place of their password, one day, a website can start retiring passwords for users who are comfortable with that, which will finally deliver the phishing-resistance benefits of passkeys to accounts themselves.

Do not underestimate how many people are hurt by phishing every day. You might think that you’re safe, but nobody is truly safe from phishing until phishable sign-in and recovery mechanisms are removed from an account. **This might not be achievable or desirable for some people**, but people who use the computers and the internet should have a path to secure accounts.

I discuss this and more in this talk I gave: https://www.youtube.com/watch?v=yVadD-Lfrfk

2 Boosts

0 Likes

Fabien

@fabienmarry@mastodon.social 8 min. ago

@rmondello with login/password, I know exactly what’s going to happens, and… it works in two seconds. With “passkeys” I have no idea what will happen as that term now encompasses a zillion different things.
The whole things is deeply confusing, and I’m very into design/tech.
Changing people’s auth behind their back is NOT respectful or helpful.

I also do tech support for relatives and it’s hard enough without the added complexity of multiple login methods per site, all varying between sites.

Dale Price

@dale_price@mastodon.online 47 min. ago

@rmondello I don’t know about some people, but I for one never consented to be forced to make, store, & manage hundreds of unique passwords just to go about daily life, nor to all the times they’ve been leaked by the same companies that required them in the first place. Nor did I consent to all the time spent waiting for codes to be emailed, which is a more inconvenient thing companies enable without asking all the time. So no matter how bad passkeys are on that front, it’s still an improvement

768kB 🚴☕🇬🇧🇺🇦🇵🇸

@768kb@mastodon.social 2 hr. ago

@rmondello I feel sorry for people who get pushed into an OS-dependent password manager like this. Just another walled garden lock-in method posing as user friendliness.

Ricky Mondello

@rmondello@hachyderm.io 2 hr. ago

@768kb What’s lock-in about it? I think it’s a pretty good outcome for someone to start using a browser or OS-provided password manager and then transfer their data to another one. As long as they’re getting help creating and using strong, unique passwords for their online accounts, it’s good.

I recently wrote about just how easy it is to switch password managers on Apple’s platforms: https://rmondello.com/2026/09/07/switching-password-managers-2026/

There is no lock-in whatsoever.

Ricky Mondello

Switching Password Managers in 2026

Important Note: Although I work at Apple in the password management and app/website authentication spaces, in this post I am speaking only for myself, personally. There is no “news” in this post or any kind of “inside scoop”. Please do share this post, but if I see “Apple’s Ricky Mondello” anywhere, I’ll be sad. My [...]

⁂

More from

Ricky Mondello

768kB 🚴☕🇬🇧🇺🇦🇵🇸

@768kb@mastodon.social 2 hr. ago

@rmondello lock-in was the wrong word; "Additional friction" that makes leaving the ecosystem progressively more and more painful. I know what it feels like because I've lived through it.

Ricky Mondello

@rmondello@hachyderm.io 1 hr. ago

@768kb Oh yeah, that’s real. It’s critically important that moving platforms is something that **is easy to do and is known to be easy to do**.

At the end of the talk I link to in the post I sent you, I mention that iOS and Android now transfer passwords and passkeys between each other when mitigating, as part of an effort to improve switching platforms. This stuff isn’t even close to perfect yet — far from it — but there are some people, somewhere, that believe in making it work better for regular people.

It’s genuinely tricky when making life better and more comfortable with software features makes them stickier and harder to leave. As an industry and as humanity, we need to both make software better and make it really easy, possible, and advertised that leaving is possible. We see far too much of the former and not enough of the latter.

aburka 🫣

@aburka@hachyderm.io 2 hr. ago

@rmondello do not underestimate how many people already mistrust their computers, and how bad an idea it is to take irreversible actions on the user's behalf without their consent

Ricky Mondello

@rmondello@hachyderm.io 2 hr. ago

@aburka Based on how you’re writing these messages, I’m not sure that we’re going to have a productive conversation, but I’m still going to try because I believe in learning (myself) and clarifying things through conversation with people who are skeptical of what I have to say.

I don’t think that adding a passkey to an online account when a user already has a password for that account saved to a credential management app is an irreversible action. If any real website on the planet doesn’t let someone remove an added passkey, I’ll happily eat my words on this one.

aburka 🫣

@aburka@hachyderm.io 2 hr. ago

@rmondello okay, what am I supposed to do when I go to log in to that website on my phone or a school computer the next day and it's like "where's that passkey, chap?"

Ricky Mondello

@rmondello@hachyderm.io 2 hr. ago

@aburka Use one of the other mechanisms to sign in? It’s not like websites are deleting people’s passwords when they get passkeys today.

And passkeys are usable cross-device. If a Windows PC I don’t own wants to make use of one, I can scan a QR code with my iPhone or Android phone to use a passkey that’s synced to them to sign in.

1+ more replies

aburka 🫣

@aburka@hachyderm.io 2 hr. ago

@rmondello also, if I don't know that it even happened how would I know that I need to remove the passkey, let alone have the foggiest idea how to begin to start thinking about finding a way to do that

2+ more replies

aburka 🫣

@aburka@hachyderm.io 2 hr. ago

@rmondello this post is actually insane

> If the user is already using the Passwords app for their password for an account, they’ve asked for the software to help them have a secure and smooth experience

If I've used an app called PASSWORDS I am asking it to help me use fucking passwords, why would you assume anything else

Ricky Mondello

@rmondello@hachyderm.io 2 hr. ago

@aburka Calling someone’s writing insane is not a great way to act online.

The app is called Passwords, because that’s what people urgently need help with. People who make use of the app learn that it helps them create and use unique, strong passwords, as well as verification codes and passkeys, and manage sharing of those things. The app’s organizational structure is around these different kinds of data and improving the security of online accounts.

I think it’s interesting to say that “because the app is named Passwords, people only expect help with passwords and reject help with their broader online identity”. A big leap, and probably wrong, but interesting!

aburka 🫣

@aburka@hachyderm.io 2 hr. ago

@rmondello I think the key mistake here is assuming that anyone's goal is to use the Passwords app to learn about anything. The goal is always to get into the website, anything else is a distraction. Nobody is going to read a tiny pop-up that says their password was converted into something they've never heard of, and it's not cool to do that without asking

1+ more replies

1.3.6.1.4.1.61513

@xssfox@cloudisland.nz 2 hr. ago

@rmondello what does this flow look like in practice? My partner and I have a few shared accounts and already we've had cases where passkeys were accidentally added which has been frustrating. Is there a confirmation prompt first?

Ricky Mondello

@rmondello@hachyderm.io 2 hr. ago

@xssfox So you sign in, assisted by Password AutoFill, with a saved password from a password manager. The website issues a “conditional create” request. If the user for that conditional create request matches the user a password was just filled for, a passkey is created and a notification is posted telling the user.

In Apple Passwords, if the password that was filled was part of a saved item in a shared group, the passkey is attached to that item automatically and shared with the other people in the group.

Are you and your partner using the same credential manager and using a shared folder or group? If you’re not and you’re kind of manually flinging passwords back and forth, you’ll probably want to turn this feature off.

I hope this helps!

1.3.6.1.4.1.61513

@xssfox@cloudisland.nz 2 hr. ago

@rmondello cheers, that does help. We both use different password managers.

🎶He was a Keychain user
She was a Vaultwarden user
Can I make it any more obvious 🎶

Ricky Mondello

@rmondello@hachyderm.io 2 hr. ago

@xssfox

🎶 She signed in to Plunk
He hit Command-A
What more can I say? 🎶

1 more reply

Bob Young

@fifonetworks@infosec.exchange 3 hr. ago

@rmondello
There is still a problem with passkeys that has not been solved (to my knowledge), and it concerns me a lot. More and more people have exactly one personal device: a smartphone. No laptop, no tablet. If alternate forms of authentication are removed and the user’s device breaks, the passkeys are gone, and they’re locked out of accounts permanently.
(1) Is there a solution for this?
(2) Will every company that migrates to passkeys require multiple authentication methods to be set up at the time of account creation, so there is never a moment when the loss of a device equals account lockout?

Ricky Mondello

@rmondello@hachyderm.io 3 hr. ago

@fifonetworks Great question, Bob!

I can’t speak for all credential management software, but I can tell you that Apple’s iCloud Keychain is designed to be recoverable in the event of total device loss. You can read up on escrow for iCloud Keychain and the security behind it here: https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/web

Apple Support

Escrow security for iCloud Keychain

iCloud provides a secure infrastructure for keychain escrow to help ensure that only authorized users and devices can perform a recovery.

Bob Young

@fifonetworks@infosec.exchange 2 hr. ago

@rmondello
We're back where we started, though. In the article, it says, "To recover a keychain, users need to authenticate with their Apple Account and password and respond to an SMS sent to their registered phone number. " The accounts are still accessible via SMS authentication. And the password is still essential to the recovery process.

Ricky Mondello

@rmondello@hachyderm.io 2 hr. ago

@fifonetworks We’re not quite back to where we started, because fewer passwords on accounts is good, positive thing. Every password on an account is an opportunity for phishing and password reuse.

And not all accounts with passwords are protected equally. For example, Google and Apple accounts have account security mitigations on top of passwords that may temporarily reject or outright reject a sign-in with a valid password if it’s coming from a device type or part of the world not usually used by someone.

Don’t assume that the project of having fewer passwords means that there’s no point until a physical person has no passwords in their life.

1+ more replies

Andrew Laurence

@atlauren@mastodon.social 3 hr. ago

@rmondello I’ve been slowly choosing passkeys when offered. Slowly. Mainly because the offer some as an interruption when I’m trying to accomplish a task. So the default answer is “not now, get out of the way”. Sigh.

Ricky Mondello

@rmondello@hachyderm.io 3 hr. ago

@atlauren That’s part of the point of automatic passkey upgrades: stop asking me to add a passkey when I’ve got something to do! Just do it, no need to ask, and let me get on with my life.

Andrew Laurence

@atlauren@mastodon.social 3 hr. ago

@rmondello Fair. But that makes me twitchy about something happening I didn’t authorize.

This is about vibes. ;)

Ricky Mondello

@rmondello@hachyderm.io 3 hr. ago

@atlauren Totally. Understood that from the beginning.

1 more reply