alt Hacker News> ...it entirely depends on the service what kind of auth implementation they offer.
I think that's exactly the problem. These are all answerable questions, but getting those answers is confusing for most people.
Replies
> These are all answerable questions, but getting those answers is confusing for most people.
It's the same answer when someone asks 'how am I supposed to have a different password for every site' and 'how am I supposed to remember a password of X+ characters.' Use a password manager. Pretty sure every major one supports passkeys by now.
Don't think it's any more confusing than e.g. logging in with an email address and password, or logging in with email + code, etc. A website's auth is usually a black box that they don't explain, and the only reason people find passkeys confusing is because they've been conditioned to enter passwords instead.
Also from experience, most sites will implement it in every wrong way possible.
For example, all the major sites that allow the total of 1 active TotP authenticator app - trying to add one forces to delete the other. Which is fine while you have only one phone and aren't in the process of switching to another one.