@simon Love your blog and super admire your work!
-
@simon Love your blog and super admire your work!
Just wanted to say that I take a bit of an issue with DHH's opinion on passkeys.
His hot take is in fact a bit stale. Now, in addition to the platform lock-in option, you can choose a platform independent third party password manager like 1Password or even BitWarden and access your passkeys on all your devices and platforms!
I think it's an important distinction because I see passkeys as a good solution to the myriad problems with passwords for auth.
-
@feoh yeah, I saw this the other day: https://9to5mac.com/2024/10/14/new-passkeys-import-export/
I think his perspective as quoted still stands though: passkeys have a significant usability problem for many people right now who don't have a fully formed mental model of how to use them across multiple devices
Just because it's possible doesn't mean people can figure out how to do it!
-
Simon Willisonreplied to Simon Willison last edited by
@feoh as always, a quote doesn't mean I agree with the quoted opinion - but I do worry about passkey usability
(I'm hyper-sensitive to usability problems with alternative login methods having been a big proponent of OpenID back in the day)
-
-
Simon Willisonreplied to Matt Campbell last edited by [email protected]
@matt @feoh I still don't fully understand the best practices for implementing those
In particular, if I enter my email on my laptop and then click the link that it sends me on my mobile phone... what should happen?
Signing me in on the laptop feels dangerous because what if I entered someone else's email address and they clicked "approve" by mistake?
NOT signing me in on the laptop sucks, because that's where I'm trying to sign in
-
Simon Willisonreplied to Simon Willison last edited by
@matt @feoh one workaround could be to sign you in instantly if cookies say you clicked the link on the same device, whereas if you don't have that cookie you get challenged to enter a code sent in the email
But I'd like to understand if there's been a whole lot of research into the best way of handling this that I haven't seen
