Post #2798458

@ericholscher@fosstodon.org have been using them for years on tons of sites. 1. make sure you understand how fallbacks and alternate auth methods work on every site you enable them on; I haven’t found a site that takes away all your fallbacks and I wouldn’t add a passkey to such a site; make sure you have a totp authenticator too 2. treat any passkey auth failure in a browser as *extremely* suspicious; close the browser and manually enter the URL. apps which don’t support passkeys are pretty common though