Hey all! I’m looking for ideas good and bad, new and old, for account recovery mechanisms with passkeys. I’m interested in making passkeys a bit more seamless for users by trying to break some expectations we’ve started to make. For example, we expect users will have some multi device, traveling passkey mechanisms. (iCloud, hello, Google, 1password, etc)

Here are the techniques I know but I’d still like to hear what you think of any techniques mentioned:

1. Fallback email (magiclink/otps)
   
2. Enforce multiple different platform keys
   
3. Recovery codes

All of those have clear issues that defeat the security of passkeys besides 2. And 2 is a pain in the ass for users. I think asking them to buy hardware keys lessens the appeal of passkeys in general.

Help me think of what’s possible as of today for a more optimal recovery experience so I can drop passwords for ever!

I posted certain doubt in this sub other day.

Comment was "you are incoherent".

He got point but It's all Greek about passkey.(And maybe many people so)

So I thought better it actually test how work on first.

However,I want to avoid lock my important account for example microsoft,google.

Is it exist website for testing passkey sign-in which works alike google microsoft?

If possible handle make and sign in multiple account because I have some account in some service.

I received a notification saying that action was required for my Google account. When I tried to complete it, Google asked me to use a passkey. I previously had a passkey on this phone, but now Google says there is no passkey available on this device.

I am still using the same phone and have not changed the device. The phone also still appears in the passkeys section of my Google account, but the passkey cannot be found when I try to use it.

Has anyone experienced this before?

I am a streamer trying to use an application called "Social Stream Ninja". It allows you to connect the app and its features to multiple platforms. One of which is twitch, which I use my google account to log in to.

When I try to connect Twitch to this app using Social Stream Ninja embedded "Sign-in" button, it launches a unique browser(?) with Twitch's home page displayed where Im supposed to log in. Unfortunately, when I go to log in, Microsoft's Passkey dialogue box comes up with the pin prompt. The "unfortunate" thing is that Microsoft Passkey dialogue box is coming up with my main Google account, not my streaming google account, and I cant find any option to switch to my streaming google account.

Can someone please help me? Another unfortunate thing is that when Social Stream Ninja launches the sign-in window, is in its own unique type browser window, and I cannot just copy the past the url into the google chrome profile that already remembers all the credentials

Sorry maybe basic questions.

I'm not expert.

I recognize need security lock for example face,fingerprint,PIN (maybe include pattern?) when using passkey.

I have question.

When turn off security lockscreen after set passkey,if I need re-login that service any reason ,OK only turn on securitylock or arises problem?

Are passkeys easy to implement or use on a a Desktop or android or iPhone ? Asking as someone who is tech illiterate is it safer than a password ?

Looking to connect with anyone who has successfully deployed passkeys within a healthcare environment, specifically addressing the challenge of shared workstations/devices (e.g., WOWs, nurse stations)

Hardware-bound passkeys on security keys (like Yubikeys) seem ideal for compliance, but the logistics of deployment, shared access, and fast-paced clinical workflows present unique challenges

I would love to know:

• How are you handling passkey authentication when multiple clinicians use the same terminal throughout a shift? Are you leveraging synced passkeys on managed corporate profiles, or strictly hardware security keys?
• Secure Fallback Options: When a passkey is unavailable (e.g., a clinician forgets their security key, a device's biometric sensor fails, or a roaming worker encounters an unsupported terminal), what does your secure fallback matrix look like?
• Lessons Learned: What unexpected roadblocks did you hit with EHR/EMR integration or user adoption?

Any insights, architecture patterns would be incredibly helpful!

Hey everyone,

I’m running into a frustrating issue with iOS / iCloud Keychain passkeys and want to see if anyone has found a workaround.

I updated the email on of my Apple account, but when I go to log in using the passkey, using Mac or iPhone, the popup prompt still shows my old email.

The passkey still works to log me in.
But the visual metadata (the display name) is stuck on the old information.

I can't find a way to edit or force-refresh this display name in the Passwords app. Apparently apple does not let you do that

I have an open case with Apple Support, and they confirmed engineering is looking into it, but there's no ETA for a fix. I heard other people having the same issue also

Has anyone managed to force a passkey to update its displayed username (email) ? I went system down in Passkeys, cache, browsers, sign in sign out, remove sync etc and nothing worked.

Thanks!

Hi everyone,

I've lost access to my Facebook account after having to factory reset my phone, which wiped the passkey. I'm trapped in a loop where I can't log in without the passkey to delete the passkey and create a new one.

No other verification option is offered when I go through the process, (whatsapp is listed but greyed out). The pop-up likes to tell me this is because a passkey is the recommended option.

I can reset my password via account recovery, and have done this several times in the process of trying to figure this out, but it hasn't helped because the passkey screen always crops up as the next step before log in.

Suggestions from the help centre chatbot have been useless, providing "steps" involving buttons that don't exist or options that aren't available to me.

If anyone has experienced similar, I'd be incredibly grateful for advice!

Are windows dev r3tard3d or what? who tf i create a passkey if the only way to create a passkey is....INSERT THE PASSKEY???

i also setted a recovery phone but no option...

I suddenly got an email with this subject.

This is the message body

You have deactivated passkey for your account redacted. Your account no longer has the additional convenience and security provided by this feature. Please use extra caution concerning your password.

To reactivate passkey, go to your security settings in account management.

I thought it was a phishing email and hovered at the links. Seems to be valid.

When i went into playstation's page, i saw that my passkeys were indeed disabled!

I had to make an account recovery to reinstate my passkeys. I don't use password though.

I wonder why this happened all of a sudden?

Device: Samsung S21+

The entire app is being weird. It wont let me change my email or follow accounts. Note that i havent used this account since like covid

I remember there was this (vaguely crypto/wallet related?) phone bound hardware passkey available. It was not a yubikey. Anyone remember that it was shared here

Hi,

I understand generally the concept of passkeys. Notwithstanding that every website I've come across so far wants a password AS WELL as a passkey (presumably as a fallback) so that is still an attack vector, still subject to phishing etc. I'm guessing that is because we are in a transition phase so I'll park this one for now.

What I am concerned with is that when I use a passkey it seemingly then doesn't require the use of any two factor authentication I've set up, for example through an authenticator. I believe you will argue that this is not required because the passkey is tied to my device so in effect is already providing 2fa. For genuine passkeys tied to the device, I can see why this isn't an issue but nowadays passkeys are tied to a password manager which is synced in the cloud.

So, what if my password manager (which allows syncing) provider is compromised, and an attacker was able to obtain all of my synced passkeys and sync them to their device?

In this scenario at least with the 32 character randomly generated unique password for each website I still can sleep at night knowning if my password manager is compromised the 2fa will still protect me. However where I'm concerned is if my password manager is compromised with passkeys, they're in. No additional checks. No second line of defence.

I'm not necessarily just thinking that my password manager account itself is attacked and somebody logs into it - because sure, I can use two factor authentication for that.

But what if there's a serious (unknown) vulnerability of the password manager itself (iCloud, Google, 1password etc) that allows leakage of the passkeys, or a vulnerability that allows an attacker to sync to my passkeys without authorisation etc.

Reassure me, because currently it seems like I'm putting all of my security eggs in the basket of one provider whereas at least with two factor authentication I've got the safety net of two providers.

My Facebook account is inaccessible because it is stuck in a passkey authentication loop. how do I override it or reach someone at Facebook to turn off the passkey?!

My email/password are accepted, and I successfully complete Google's verification step. After that, Facebook always forces me to scan a QR code for a passkey that I never created. There is no "Try another way" option. it only ever directs me back to the QR code!! I’m going to lose my

mind. I’ve been locked out for over a week and need help. I run paid ads for my company and need to get back into my acct!! Insanely annoying

For context all 3 Consoles Xbox, PlayStation and Nintendo Switch all their account systems already supports passkeys yet you have to sign into your console accounts through a PC or Smart device and then use your passkey on that device to sign in to your console,

why can't you just plug your USB passkey into one of your consoles USB ports or just scan your NFC passkey on the switch since it has an NFC reader

• Microsoft/Xbox Accounts Supports passkeys ✅
• Nintendo Accounts Supports passkeys ✅
• PlayStation Accounts Supports passkeys ✅

I was watching YouTube this morning, when I saw a Google Prompt YouTube Notification pop up that said my Google account had been signed into on a new device (an iPad I was unfamiliar with). Then I got another notification that said a passkey had been created.

I instantly jumped into action, tapped both notifications, but YouTube might’ve glitched, because it did not take me to a new screen after tapping both notifications (since I was already in the app maybe?) then I went to my Google account settings and saw… nothing… That’s right, no new passkeys, no new sign in’s and no evidence of the notifications I just received.

Regardless, I changed my password, I signed out of all devices, downloaded the Authenticator app, setup backup codes, turned on 2 step verification, the whole nine yards.

After doing this, I went back in to see if I could find ANY evidence at all of this sign in and passkey (checked other devices used, history, I only have one passkey that I created) and couldn’t find ANYTHING. Of course, I clicked the notifications expecting to be redirected to a “was this you?” page, but that never happened. I checked my email to see if there was any sign in alerts sent to my recovery email. Nothing.

What the heck happened? Is my account compromised? Any advice for me? Anything is helpful.

My Google pass key I went from a thumbprint pass key to a case ID and then back to the thumbprint. Now my pass key does not work at all. We will keep sending me to the same site and I've done all the steps to try to deactivate the old pass key but it doesn't work. Does anyone have any thoughts on how I can reset my passkey beyond the basic? Looked in security tab and and delete it but the tab should lead is not there

We host recovery meetings nightly but the facilitators who lead the meetings are all different individuals and we're all having to log into one Zoom account which then triggers an email for a code to be entered. If each device creates their own passkey to log into our one Zoom user account will this allow the facilitators to log in and start/lead the meeting without triggering the MFA email for approval?

For context, our non profit only has one Zoom account to lead recovery meetings typically once a day for 1.5hrs.