@rmondello @monkeydom Although I agree with the benefits, I think consent should carry more weight.

I fully trust passkeys now that I understand them. But if an unfamiliar technology “upgraded” me automatically, without asking, I'd be concerned and upset, especially for something as sensitive as authentication.

@rmondello having to constantly advocate for passkeys in such a passkey-hostile environment must be _exhausting_. I hope you keep doing so, your posts are always appreciated 🙂

@rmondello Some people: “Oh, no! Apple is doing something they believe is good for me without asking me first!”

Yeah, it’s called “the Apple experience”, they’ve been doing it since 1984. Weird you’re surprised they are doing it now also. 🤷‍♂️

@rmondello 2/2
Honestly just forcing the “upgrade” by default feels like the desperate move of product management convinced they know better than their users, forcing a tech on people after failing to convince users to go for it.

Rethink the experience instead. “Passkey” means too many things now.

Could they be actually be explained? Could the different kinds have different names to help understanding?

@rmondello with login/password, I know exactly what’s going to happens, and… it works in two seconds. With “passkeys” I have no idea what will happen as that term now encompasses a zillion different things.
The whole things is deeply confusing, and I’m very into design/tech.
Changing people’s auth behind their back is NOT respectful or helpful.

I also do tech support for relatives and it’s hard enough without the added complexity of multiple login methods per site, all varying between sites.

@rmondello I don’t know about some people, but I for one never consented to be forced to make, store, & manage hundreds of unique passwords just to go about daily life, nor to all the times they’ve been leaked by the same companies that required them in the first place. Nor did I consent to all the time spent waiting for codes to be emailed, which is a more inconvenient thing companies enable without asking all the time. So no matter how bad passkeys are on that front, it’s still an improvement

@rmondello I feel sorry for people who get pushed into an OS-dependent password manager like this. Just another walled garden lock-in method posing as user friendliness.

@rmondello do not underestimate how many people already mistrust their computers, and how bad an idea it is to take irreversible actions on the user's behalf without their consent

@rmondello what does this flow look like in practice? My partner and I have a few shared accounts and already we've had cases where passkeys were accidentally added which has been frustrating. Is there a confirmation prompt first?

@rmondello
There is still a problem with passkeys that has not been solved (to my knowledge), and it concerns me a lot. More and more people have exactly one personal device: a smartphone. No laptop, no tablet. If alternate forms of authentication are removed and the user’s device breaks, the passkeys are gone, and they’re locked out of accounts permanently.
(1) Is there a solution for this?
(2) Will every company that migrates to passkeys require multiple authentication methods to be set up at the time of account creation, so there is never a moment when the loss of a device equals account lockout?