@maxpool Those are fair arguments, and points we could discuss.
It's worth noting though that the same problem exists if you store your passwords or passkeys in keychain and then lose your Apple account, you have the exact same recovery issue.
These are also not the points or concerns raised in the OP, which I believe don't stand up to scrutiny.
That's why the proposal: "third-party password manager, paired with an independent TOTP app" seems like the the best solution for personal use until passkeys have mature ecosystem.
Authentication is decoupled from OS vendor. Password vault and TOTP tokens exist independently. Even if Apple or Google bans your identity, you keep your credentials, can log in from any browser or OS, and can update your contact email on those third-party services.
I'm no expert, but if I understand the situation correctly, FIDO alliance has draft for transferring passkeys between ecosystems (Apple, Android, Google, Linux,... ) but it does not exist in practice.
It's probably just an attempt in lock-in to slow walk, or refuse to implement these parts.
@maxpool Right, but all I'm saying is you need to swap "password and TOTP" with "passkey" in that explanation and you're better off.
If someone already has their password in a password manager, what's the difference to it being a passkey in there instead?
All password managers I've seen can sync passkeys across any device where the password manager is installed.
this is one of the primary reasons whatarepasskeys.info was created: to help users find a credential manager that works for them and help them understand passkeys more generally.
@timcappalli @ScottHelme @maxpool
> If someone already has their password in a password manager, what's the difference to it being a passkey in there instead?
I can export my passwords out of Google Password Manager into a CSV. I can open it in a text editor and see my passwords in there. But I can't export passkeys the same way. I understand that the Credential Exchange Protocol is a thing and can use the flow to import them into Bitwarden or whatever but I prefer a little less opaqueness.
do you think that is appropriate for an elderly parent who can be easily tricked into exporting all their passkeys in plain text and uploading them to an attacker's site?
If plaintext export is something you want, there are credential managers which will give you that. Use them. But I don't think that's appropriate for the majority of consumers.
Oct 14, 2026, 5:22 PM@timcappalli @juancnuno @ScottHelme @maxpool counterpoint -> my mom finds password managers difficult enough to use already, and she prefers something she understands.
sure, but she's probably already using one without realizing it, because a majority of users prefer to have their trusted devices remember things for them.
@timcappalli @amonduin @juancnuno @ScottHelme @maxpool The older users I know are still using pieces of paper (or worse, an excel file!) to manage their passwords. Even TOTP is beyond at least some of them. SMS-based 2FA is frustrating to them but they have at least learned what they're expected to do.
For a certain age group, change - any change at all - is really, really difficult to cope with. It's confusing, and ultimately pushes them to reject technology. Then they feel isolated because so many things assume some level of online capability.
@GerardThornley @amonduin @juancnuno @ScottHelme @maxpool they're also the folks most at risk of being phished and losing their retirement. we have to try!
@timcappalli @amonduin @juancnuno @ScottHelme @maxpool Oh, I appreciate the risks arrayed against them. But if folks are struggling to cope with what they already have, the right solution is not asking them to learn something new.
I think for some people it might be better to move their interface to services offline - support people living in a simpler world.
@timcappalli @juancnuno @ScottHelme @maxpool Actually, if we're bringing up elderly (grand)parents, this introduces a new concern AGAINST passkeys.
Grandma IS going to do something dumb. I AM going to need to sign in to her accounts on my own devices. I AM going to need to fix hr accounts.My mom IS needing to take over her finances to get her bills paid.
Sure, grandma may not be able to handle a plaintext export, but as de-facto tech support? I'm going to find that feature invaluble.
@Epic_Null @timcappalli @juancnuno @ScottHelme @maxpool you can also run into issue with shared accounts to spouse/partner. I don't move some of the shopping accounts we use to them because for reasonable reasons my wife doesn't want the extra hoops of another app or having to find a specific device to okay it. Not when if it sends me mfa code I can rattle it off to her and she's just slightly inconvenienced but logged in.
@ppb1701 @timcappalli @juancnuno @ScottHelme @maxpool The moment you stop assuming an account can only be accessed by one person on devices they fully control, the entire problem of authentication changes dramaticallly.
most credential managers offer family passkey sharing specifically to address this case!
@timcappalli @ppb1701 @juancnuno @ScottHelme @maxpool Sure sure...
Grandma has an Apple and Mom and I do not. Mom struggles with the password manager I use regularly.
Now how do Mom and I step in and help Grandma under the passkey system?
@Epic_Null @timcappalli @juancnuno @ScottHelme @maxpool I'm guessing she relies on Apples app for hers?
@ppb1701 @timcappalli @juancnuno @ScottHelme @maxpool She has an odd combination of Apple's app (sign in with Face ID) and data stored in... i think her phone book?
Neither is particularly intentionally managed...
@Epic_Null @ppb1701 @juancnuno @ScottHelme @maxpool you can choose a credential manager that works on all platforms, and set it up for her. It's exactly what I've done with my parents!
@timcappalli @ppb1701 @juancnuno @ScottHelme @maxpool Yeaaaaaaaaaaaaaah I have met my grandma and on a scale of 1 to 10 the probability of that happening is a -50. As in somehow it would create a different, worse crisis if I tried to do that.
As for my mom, I have learned that the things that make me happy with a password manager are non-starters for her.
We have different needs and getting us on the same password manager is gonna be a "no".
@timcappalli @Epic_Null @juancnuno @ScottHelme @maxpool yep, but that's if you can get the family to use "yet another" app. Does work but there is a bit of an if there.
@ppb1701 @Epic_Null @juancnuno @ScottHelme @maxpool sure. that's the case in many parts of life.