Passkeys are better, but the rollout is a mess

@lilith Correct. A transition this significant requires consistent terminology and predictable recovery.

Until both exist, organizations should support passkeys without pretending passwords have already become obsolete.

@d34th Exactly. Let people migrate without making them feel punished for not understanding the new system immediately.

I like passkeys, mostly. The setup reminds me of those universal remote controls from the early 2000s. Supposed to simplify everything, but first you needed a booklet with 900 device codes.

Nobody remembers those?

@daem0n no ❤️

Yeah, figured.

Anyway, I keep a hardware key as backup. That part works well, assuming I remember where I put it.

Plot twist: it is plugged into the computer right now 😭

It was.

I’m not proud of that.

The sensible approach is straightforward:

Use passkeys where the provider supports proper recovery. Keep a hardware-backed backup where possible. Do not remove every alternative authentication method until you have tested account recovery yourself.

Most people only discover a broken recovery process after they need it. That is careless.

testing recovery before disaster sounds suspiciously responsible

who let management in here

@gh0st404 Someone has to compensate for the rest of you.

So the consensus is:

The cryptography works.

The interfaces are inconsistent.

Recovery is the final boss.

And deephax needs to point QR codes with more confidence.

That tracks.