alt Hacker News> the only possible way to compete with that UX is to sync the private key across the user’s devices
This is my issue with passkeys. Either we lessen security to improve UX (syncing across devices implies extracting private keys from secure enclaves, at which point it’s no different to password syncing), or we have a proliferation of different keys per website across devices (assuming the website supports multiple passkeys).
Perhaps this trade off is not resolvable in a way that happily satisfies both the security constraint and the UX requirement.
Replies
crote • yesterday at 10:00 PM
> at which point it’s no different to password syncing
You still get the phishing resistance, though!
"A better version of password syncing" is exactly what Passkeys are and ought to be. Just like passwords, but unphishable, unguessable, not reusable across sites, not vulnerable to data breaches, and with better UX.
Stranding private keys in clone resistant secure enclaves has unacceptably bad UX for the average user, which is why very few implementations try to do that.