>Passkeys and 2FA are a usability nightmare if you need to recover, or all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor.

Most providers continue to offer email-based recovery in the case that the end-user loses access to their primary factor, regardless of whether the primary factor is a password or a passkey.

And email based account recovery does not make the security advantages of passkeys disappear, which are:

- credential that's guaranteed to be unique

- credential that's guaranteed to be strong

- credential that cannot be phished (due to cryptographic binding to the domain at the time of credential creation)

- changes the incentives for compromising servers (they're nothing worth stealing from the server -- only public keys)

- if/when an app/website transitions to retiring password-based authN, then it will entirely eliminates credential stuffing attacks

password managers do the backup for you based on how you set them up (eg. to your google drive, or to a simple SFTP/FTPS/S3 URI)

those that don't have this built-in (eg. KeePassXC) recommend using Dropbox or some external sync mechanism

but the keys are stored in a file, which you can back up.

> all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor

no, not at all. it still gives you better UX, because when you use the passkey you know it's the site you want to log in to. (because there's mutual authentication.)

2FA secrets can be backed up, and everyone should do that, for the same reason you'd want to do it with passwords.

Passkeys can too, but there it's even more obfuscated than with 2FA.

You do the same as you do when you lose your SSH key. Restore from backup and move on with your life.

Why is there so much misinformation nonsense around passkeys?

Sounds like something security services would love people to use. Instead of using wrench to extract the password - and distressed person may lose memory, they can just locate the passkey.