Too many websites treat passkeys as an alternative login method when instead I want them to be required, and the ONLY WAY to login to my account, if I decide to add one.

Come gestite la sicurezza dei vostri account?

With SSH keys, I can copy the private key to my home PC, home laptop, cell phone, a Linux jumpbox, my work PC, my work laptop, etc. Any of those devices break, I just copy a key from the surviving devices or other dedicated backups. Unlimited devices, unlimited backups. Zero hardware requirements, zero hardware purchases.

Are passkeys this modular and hardware-agnostic? If so, that will be a relief. If not, does anyone know why?

In other words, is it truly my private key? Or is it Google's, Apple's, etc and I am at their mercy, compatibility, and hoping their phones never break, compared to my SSH private key that is only limited by my imagination. I've got multiple devices, like I mentioned, and I've enjoyed having easy access, redundancy, and backups without ever having to buy a vendor-approved hardware key (like Yubikey) nor having to worry about unrelated software, such as needing Windows 11 over Windows 10 for an SSH connection to work.

(Posted to the password subreddit too) I recently had a falling out with my now ex best friend, and she was using my amazon account and set up a passkey for it (despite not asking me first). I changed my password, but does she still have access? If so, how do I remove it, since we blocked each other so I can’t just ask her to remove it from her end

Hello,

I have a local windows account (no sign-in, no Microsoft account)

It's currently secured by a password. Is it possible/ recommended to use a passkey instead ? How to do this ?

Thanks in advance

In my 15 years here, I would say about half the vendors we use only provide us with a single login that has to be shared by all employees in the company. In some cases that is absolute, such as a complete lack of an ability to create more accounts in some portal. In other cases, it isn't practical (passport verification for a revolving door of customer service employees? No thanks).

When vendors only allow one login, we have just used our enterprise password manager to share the credentials and TOTP with specific employees.

It is also trivial to follow the 3-2-1 backup strategy with an enterprise password manager. I can recover from any copy stored anywhere.

Additionally, Amazon US is now forcing passkeys. Luckily, Amazon US does support user accounts. For some employees, setting up Windows Hello pin seems easy enough.

1. How are businesses handling sharing passkeys for vendors that only provide a single login?
2. What happens if a hard drive fails that was using Windows Hello for a passkey?

I understand some of this friction is the fault of a vendor who would force passkey usage while simultaneously not allowing more than one login to access their services, and less the fault of passkeys.

Im trying to log back into my discord account since I had to factory reset my devices. I go onto the app and put in my email and password, I hit next and it tells me they need to verify it's really me. I choose to authenticate with a passkey, I tells me that I should have gotten a notification on both my devices, the one I'm using to login and another one that I had to factory reset, but I don't get the notification on either of them. This has also happened with everything else that needed a passkey, I don't know what to do. Any advice would be appreciated.

Since Microsoft is deprecating the SMS as a MFA method in Feb. 2027 and we also want to go to a more secure method for MFA, we are in the process of transitioning users to use passkeys instead. But when piloting this i havent found a method of adding this without many manual steps.

• User is prompted to register passkey
• Gets a window saying insert security key into USB port even though no security key is registered on that account. According to Microsoft this can happen if bluetooth is not available but in all cases its been enabled for us.
• User clicks cancel, chooses other methods and selects Phone.
• Gets QR Code, scans it with Microsoft Authenticator and then get a timeout issue (This happens on both corporate and private networks. Required endpoints are already open in FW according to MS documentation)

Anyone else in the process of doing the same? The only workaround we have found working is to add the account from MS Authenticator first, then you dont get any timeout issue. But good luck telling all of our users this process.

...and I cant find any "Apple" passkey in the Passwords app 😭

Hi everyone,

I have a Pixel 10 Pro that I've been using for over a year (fully updated to the latest version). When I try to log into my Google account on my PC and scan the passkey QR code with my phone, it displays an error saying there is no passkey on my device.

However, when I check my Google Account settings on the phone, the passkeys for both my Pixel 10 Pro and my old Pixel 4 XL are clearly listed there. Entering the account settings also prompts Face Unlock without any issue. If I scan the PC's QR code with the 4 XL instead, it works flawlessly and logs me right in.

I tried using the 4 XL to remove the 10 Pro from my passkeys, which signed the 10 Pro out of my Google account. To sign back in on the 10 Pro, I had to verify using a security code via the 4 XL. After logging back in, the 10 Pro passkey automatically showed up in my account again. But the problem persists: I still cannot use the 10 Pro to verify logins on any other devices—only the 4 XL works.

Has anyone run into this issue before? Is there any known fix? Thanks in advance!

Passkeys are a trap. Do not use them

I don't agree with the title, but this is an interesting take, exploring many aspects of passkeys.

Hi,

Right now, I create passkey for each device I use. Using Windows Hello or Apple Password.

Is that a good idea vs having my passkey in the cloud with a password manager?

I feel like it's more secure this way, but maybe I'm wrong.

Thank you

Please be gentle. I get the value and need for passkeys however there are situations where passkeys may become an issue for seniors or those not technically adept.

What happens when one person in a couple is the one who handles all the finances and pays all the bills and has access to all accounts or if an older couple has allowed their adult child access to log-in info to pay bills or check things for them?

First question - once you set a passkey, can you still use a log-in and password or will you not get that option?

Second question - can you go back to using a log-in and password or once you set-up a packet that's it?

Third question - if you set-up a passkey on Apple devices. do you have to use face or Touch ID or can you use your passcode (phone) or password (desktop)?

Fourth question - if you use Apple Passwords and set up shared passwords/passkeys, will this eliminate the issue?

Fifth question - how do you manage this for websites where each of you have a different log-in like financial institutions, credit cards, health insurance, etc if you are using one desktop? Would Proton be better?

Sixth question - is Apple passwords a good option or should one use a different PW Manager? What if you use different browsers on same desktop - Chrome, Safari, FF?

Seventh question - is there a "passkeys for dummies" YT or website that might address these issues and walk you through this?

This is a real issue for many people who were once early tech adopters but things change in life and is not about what happens later and legacy contacts.

Thanks.

I encountered this while trying to change my ChatGPT subscription: selecting my existing locally created Xiaomi passkey and completing fingerprint verification did not complete sign-in. Both Chrome and the ChatGPT Android app login flow failed.

Tested environment: Xiaomi 14, Android 16, HyperOS OS3.0.306/307, Chrome 154.0.8037.126, Xiaomi password manager 1.0.18. Rebooting and that OS upgrade did not resolve it.

The Xiaomi FIDO component logged a NullPointerException. Read-only component analysis showed unknown transport strings map to null, followed by a dereference during serialization. Source for this exact Chrome version fills missing/empty transport hints with six types, including smart-card, which the older component mapping does not support.

This is a strongly supported hypothesis, not direct observation of the Android service boundary payload. We have not captured that payload or compared pre/post-update Chrome versions, and cannot establish the first affected version or broader device coverage.

In a controlled diagnostic test, limiting the existing allowCredentials transport hints to internal restored sign-in with the same passkey in both web and app flows. Credential IDs, challenge, rpId, user-verification requirements and server validation were unchanged. This is a temporary workaround for this local authenticator scenario, not a general fix for cross-device or external security keys.

A redacted report was emailed to Xiaomi developer support; acceptance and a fix remain unconfirmed. The full case study is in Chinese: https://mp.weixin.qq.com/s/goNTG9Whq9HKzq2eliZg2g

Has anyone reproduced the same fingerprint-success/login-stall symptom with Xiaomi or another credential provider? Device/OS/Chrome/provider versions and successful counterexamples would help. Please do not share passwords, recovery keys, credential IDs, challenges or full personal logs.

Disclosure: these are my own write-up and visual explainer. The full technical summary is included above; external links are optional. Xiaohongshu visual explainer (Chinese, Anaxagore): https://www.xiaohongshu.com/discovery/item/6acb2fa8000000001803a456?source=webshare&xhsshare=pc_web&xsec_token=YBrURBv9xXsoLvE4DpzSNyWcWNilDQ_OYdg_Y4sI4ryeI=&xsec_source=pc_share

中文摘要

小米14上，ChatGPT网页与App登录都出现“密钥能选、指纹通过，但页面没有下文”。Android16、HyperOS OS3.0.306/307、Chrome154.0.8037.126、小米密码管理器1.0.18；重启及该次系统升级未解决。

日志出现小米FIDO组件空指针。组件只读分析发现未知连接方式会映射成null，后续直接解引用；精确版本Chrome源码在连接提示缺省时补齐六种方式，包含旧映射不支持的smart-card。这是证据支持的根因模型，尚未直接捕获Android服务入口参数，也未做浏览器升级前后对照，不能推定所有国产Android受影响。

受控实验只将现有候选凭据的transports限定为internal，同一份密钥在网页和App都恢复登录；没有改credential IDs、challenge、rpId、身份验证要求或服务端校验。这是本机临时兼容处理，不是跨设备或外置安全密钥的通用修复。已向小米发送脱敏报告，尚未确认受理或修复。

欢迎提供机型、系统/Chrome/密码管理器版本及失败症状，正常对照也有帮助；不要发密码、恢复密钥或完整个人日志。公众号为完整排查记录，小红书为图解，均是我的原创内容，链接见上文。

Update / 更新：The full investigation is now available on my GitHub Pages, with an English summary, evidence references and the scope of the temporary workaround: https://lgystoic.github.io/notes/xiaomi-chatgpt-passkey/

完整排查请优先阅读上述 GitHub Pages 入口；公众号和小红书图解也汇总在页面中。These are my own resources; the technical findings above remain available without following an external link.

Fidelity has finally added passkey support!

I'm thinking, when I create my next website, if I should ditch the whole Sign in with Google stuff and just support passkeys. Not even passwords, a passkey only website