r/Passkeys • u/HiOscillation • 17h ago
Passkeys vs. Normal People: Lessons learned so far.
I worked in tech for 30 years, and I am now semi-retired. I still consult a little, and I am very much the "go-to" person in my family and community when it comes to technology issues. My views on Passkeys are I love the concept but I despise the shoddy, ill-crafted way many services have rolled them out.
In terms of helping others, for me, Passkeys have absolutely replaced the "I have a problem with my printer" calls of the past. Grrrrrr.
My observation: Passkeys are excellent if you have an IT department managing your hardware and access control systems. They remove the shared secret from the server, make phishing fail, and give users nothing to type or give away. For everyone else (normal, everyday people), passkeys are opaque when they work and insanely bad when they break.
1. Designed for the IT department, Not end users.
Passkeys descend from FIDO security keys and hardware attestation, first deployed inside enterprises where keys are issued, inventoried, and replaced by a help desk. That model treats hardware as an asset: backed up, redundant, and re-provisioned through a defined process.
Attestation has a website trust a chip’s/ device's manufacturer. It trusts the device precisely because the person holding it is not fully trusted. Good.
When the model moved to consumers, nothing replaced the IT department. The individual inherited IT jobs by default: account provisioning, backup, and recovery. Bad.
2. Normal people own an appliance, not a device fleet
Normal people don’t manage hardware. They use it until it breaks or gets "too old", then replace it. For the one in ten US households with only a phone, that phone is the whole fleet, and losing it means loss of:
1. The credential itself (if device-bound).
2. The second factor (authenticator app or push approval).
3. The recovery channel (the SMS number and email inbox access lived on their phone).
Drop your work phone in a river. An IT department will have MDM, backup codes and controlled the identity systems before the you ever got the device - replacing the device is just another Tuesday to-do. Appliance users have none of this. They don’t back up, and they are notoriously bad at keeping recovery information. Blaming the “stupid” user for not doing IT work is a common stance among passkey advocates.
3. Syncing solved device loss by handing over custody
Hardware-bound credentials proved unworkable for the mass market. The answer, announced by Apple, Google, and Microsoft in 2022, was the synced passkey. It keeps the core security properties but moves the keys from the device into the user’s platform account - usually Google or Apple, in some cases, third-party password managers.
That solved device loss for most people by making Apple or Google (or 3rd party password managers) the custodian. In Security.org’s latest annual survey, only about 36 percent of US adults use any password manager, and Google and Apple account for more than 55 percent of them. That leaves roughly one in seven adults on an independent manager. Another third save passwords in the browser, which means Chrome or Safari. We can ignore Firefox as statistical noise (too bad, I like Firefox).
So a technology pitched as putting credentials in the user’s hands has deepened dependence on the platforms people were already locked into, or forced them into yet another platform (attack surface) for their 3rd party credential manager. And the phone-only user still faces a recovery process that assumes an available second device or a remembered password and/or access to the same phone number. Cold-starting an existing account can even be impossible.
4. UX guidance, but no service design at all.
The FIDO Alliance publishes passkey design guidelines, with UX principles, patterns, and a Figma kit, and some sites partly follow them. But this is interface design for adoption: how one website should prompt and persuade people to create a passkey. It is not service design.
1. Wrong unit of design. Guidance covers one website at a time, but the failure that matters (a lost phone) hits every account someone has at once. Nobody owns that cross-service / cross-vendor journey, so nobody designs it. You can withdraw cash at nearly any ATM in basically the same way, anywhere in the world only because of the enormous cross-system design and standardization work behind it. Same applies to a not-at-all simple "tap to pay" transaction - these have extremely advanced service design principles behind their deployment. Passkeys have no equivalent of a unified service design.
2. The critical elements are out of reach. OS dialogs, sync, and platform account recovery belong to Apple and Google. A site can follow every UX pattern and still have no say how it works when the phone is gone, or why there must never be five passkeys all named “Apple iPhone.”
3. Neglects patterns for real life. The common situations in the next section have no working answers, just "oh well, sucks to you be you"
5. Are these “edge cases” or just "not my reality, not my problem"?
To consumers, passkeys are invisible until the smallest thing goes wrong. Then they are incomprehensible. These situations are routinely treated as edge cases:
Single-device users. About 1 in 10 US households has only a phone. For tech people, having no “other device” is hard to imagine.
https://www.benton.org/headlines/united-states%E2%80%99-computer-ownership-gap-persists
Shared phones. 13% of middle schoolers surveyed share a smartphone or often use someone else’s. I could not find good data on older people, but my anecdotal data shows far more "phone sharing" than I expected. I was at a party yesterday - a bunch of 20 to 30 somethings mostly, and this conversation happened right in front of me:
Person A: "My phone is dead"
Person B: "Log into Insta on my phone and check your messages!"
Lost, stolen, or broken phones. In one year, 31% of smartphone owners damaged their phone, 8% lost it, and 5% had it stolen. Without sync - or pre-deployment IT-style device & account preparation - the passkeys go with it.
Caregivers. 63 million Americans, one in four adults, are family caregivers handling banking, bills, and appointments for someone else. Two brothers managing Dad’s accounts need passkeys on Dad’s phone, each brother’s phone, and a laptop or two. Many sites cap passkeys at five, so the family hits the limit fast.
Small organizations. Nonprofits and small teams share logins because one account must serve several people. A bank passkey enrolled on the treasurer’s personal phone belongs, in practice, to the treasurer, and the next officer can’t get in.
https://www.usenix.org/conference/soups2024/presentation/moh
6. Conclusion: stop calling them passkeys. Bury the tech.
Passkeys could replace the password in the mass market, but only with a drastic rethink of how normal people meet them.
Start by burying the name. People hear “passkey” and think “type of password,” which is why “How do I back up my passkeys?” gets asked here constantly. Describe what the person is actually doing instead:
“Unlock this website with your phone.”
“Unlock this website with your device.”
“Register your device to unlock this site.”
Then make registration one short flow with recovery built in:
1. Register your device. Tap here.
2. Get your backup code. Don’t save this code on your device! Write it down and keep it safe.
3. Type in your backup code. (The screen clears first, so the code has to have been written down.)
4. Finish registration. Tap here.
And close with plain instructions:
This device can now unlock [Service]. To add another device, use that device to visit [Service]. If you lose your device, go to [service].com/recovery to register a new one.
Yes, a backup code is a phishable secret. But it is used once, only for recovery, and it beats the SMS codes and help-desk calls people fall back on today. Retyping it proves the person actually kept it.
This isn't close to a full solution.
Caregivers, shared phones, and small organizations need several people to act on the same account, and I don’t have a good flow for that right now.
That’s a systems architecture issue more than a passkey issue: only a few services have a working users-and-groups model, and one person, one account is the norm. But passkeys make it worse. A password could be shared, which is how families and small organizations have quietly coped with this default architecture.
A passkey can only be shared inside one platform’s family group, so a mixed iPhone and Android family is out of luck. Even in an all-Apple family, sharing means finding a feature most people don’t know exists, getting everyone’s phone and settings right, and ending up with a bank that thinks three people are one. The workaround is gone (as designed), but the need isn’t. Thank goodness, legally, I am my father with full PoA to use his logins (this still violates the banking site T&C's) but holy cow does the system get confused when I try to log into MY accounts at the same bank. And as far as the fire company where I'm treasurer and share online banking duties with 2 other people using their own devices...our solution there is avoid passkeys like you would an Ebola outbreak.
None of this needs new cryptography. It needs someone to design the service around regular people who have never worked in tech at all.
