Post #2923279

2025-11-07 23:03 UTC

@rmondello@hachyderm.io What’s your thoughts on sites that use passkeys + a second form of authentication? GitHub is one that comes to mind. Doesn’t that defeat one of the benefits?

Replies (4)

@rmondello@hachyderm.io 2025-11-07 23:05

@brandonbutler@mastodon.social I address this in the talk! Let me know what you think of my argument around this. :)

Open ##2923280
@gracjan@mastodon.online 2025-11-20 16:48

@brandonbutler@mastodon.social @rmondello@hachyderm.io I think every service should allow users to have a fully passwordless account. If I already have an account and I register a passkey — allow me to get rid of my password and other factors (like SMS or TOTP). If I lose access to all my passkeys (which I know won't happen) or I need to sign in where they aren't supported, I can use a “magic link” or e-mail recovery as a last resort. Also, it should be possible to register an account without ever creating a password.

Open ##2923282
@oscherler@tooting.ch 2025-11-23 15:08

@brandonbutler@mastodon.social I think I’m using passkeys exclusively on GitHub. At least I’m not finding any message verbally abusing them in my sent messages. But maybe I had to disable TOTP after I added the passkey.

Open ##2923283
@oscherler@tooting.ch 2025-11-27 16:20

@brandonbutler@mastodon.social @rmondello@hachyderm.io Today I discovered that the AWS console also uses passkeys incorrectly, requiring you to input username, password, and then submit the passkey. They even have their chatbot trained to gaslight you when you complain about it.

Open ##2923284