Wouldn't I have the same problem with passwords? I would lose my phone and be unable to two factor log in to my Gmail account or bank from someone else's device?
With 2FA? Yes. 2FA is almost just as stupid and almost just as bad for regular users as passkeys are, but it got adopted due to historical loophole - by far the most popular form was TOTP delivered via SMS, then "authenticator" apps, both of which keep the code transferable - you can receive it on one device, transfer to yourself or someone else (which is a feature, not a bug) via any channel, and get it to work. Passkeys were created specifically to close that loophole.
Plus, SMS didn't allow for vendor lock-in, which is arguably why they're so hated in security circles (SIM-jacking is real, but doesn't scale anywhere near enough to warrant deprecating it as mechanism for regular users).
Passwords just don't provide a broad recoverability benefit once you commit to doing strong, unique passwords.
> Passkeys were created specifically to close that loophole.
Credential sharing? I have a family share with passwords and passkeys in it. Passkeys most certainly didn't stop this.
They did add friction to having a user being duped to share their password to someone claiming to be tech support, since you can no longer request plaintext secrets be sent over arbitrary channels.
> Plus, SMS didn't allow for vendor lock-in, which is arguably why they're so hated in security circles (SIM-jacking is real, but doesn't scale anywhere near enough to warrant deprecating it as mechanism for regular users).
SMS is an ugly user experience and more importantly is expensive. Now a lot of services do emailed codes when they don't have a regulatory reason to require SMS - an even worse user experience, but less expensive.
We have authenticator apps which use a standard OATH setup, and quite a few platforms which have integrated support to try to sand over the worst part of the UX. Unfortunately they just didn't become popular, and OATH fails the same regulatory requirements that emailed codes fail.
Passkeys are not meant to have a vendor lock-in story. Credential exchange allows for credentials stored in consumer credential managers to be imported into another credential managers. The platforms have added infrastructure specifically to make this easier for users.
The exceptions are when enterprises run their own passkey stores, or when the user explicitly picks a solution that doesn't allow export (like a physical Yubikey).
No, it's fine. Most common example, I log in to my bank, they send an SMS, I copy the code and paste it into the web site. Works fine and I don't have to pick up my stupid phone, like I would if I used an authenticator app instead.
"and more importantly is expensive."
Not for me. The bank made several billion dollars last quarter, don't think it's a big problem for them, either.
Or another example, someone hijacks my SMS'es, and then they log in as me.
SMS sucks. SMS is insecure.
The amount of times I've experienced customers complaining about SMS 2FA not working well despite it being on their carrier failing to deliver the messages in a timely fashion really showed me how terrible it is.
But for me, where I live now, with my bank, and my phone carrier, it works great. Never had a problem that I can think of. Typically, the SMS arrives within seconds. It's the least annoying and most reliable 2FA method I use.
I'm not that worried about potential security issues. Sure, it's a possible problem, but pretty low on the list of things to worry about.
In general, I do not have a "device currently in my hands" and having to pick one up and unlock it is annoying.
Good news then, this also works on desktops, even ones without cameras or touch sensors. That's a part of why I mentioned "typing in my PIN". But sure, keep moving goalposts. Maybe next you'll tell me real computers don't have numbers on the keyboards or something.
> In general, I do not have a "device currently in my hands" and having to pick one up and unlock it is annoying.
I agree, which is why SMS sucks so much for 2FA. Having to have my phone with me with signal just to auth into something sure is annoying, I don't know why anyone would prefer that compared to just using the authenticator physically inside their computer.
All of the 2FA methods forced on me by my employer and most online services that require it require a phone app. So no, it doesn't work on a desktop.
Which, while I can't speak to your specific employer, tons are moving to support passkeys. Largely because forcing these apps suck and SMS sucks.
No, that's not the way it went. I joined the conversation, such as it is, to respond to the guy who said "SMS is an ugly user experience" to say no, it's fine.
I haven't shifted any goalposts: I've basically just reiterated to you that I think it's fine and better than the alternatives. Not a word about passkeys from me.
It's not fine that SMS messages get delays. It's not fine that it requires a cell phone plan. It's not fine that it requires you to have cell service. Its not fine because it's insecure.
So many times I've had coworkers and clients frustrated they are pushed to letting their employer force SMS 2FA on their personal numbers. When they could just use passkeys these days baked into their work machines and not have those problems.
Then you decided, for some unknown reason, to jump in and... do something, but I'm not sure what. Seems like you're trying to convince me that my own view of my own experience is wrong somehow but — and one might think this would be obvious, but apparently not to you — that's not gonna work.