Lately, the process of accessing apps and websites has grown dizzying. “I’m in password hell,” a colleague confided to me recently. “Every login attempt is playing the lottery.” The problem is not just the sheer number of digital accounts, all of which require their own password, ideally unique and unguessable (which usually also means un-memorizable). It’s the pileup of solutions to that problem: all of the different layers of software offering to remember your passwords, the six-digit codes sent to your phone, the authenticator apps, the passkeys.
Passkeys are good at the fundamental level, but the practical implementation is lacking, despite their efforts.
IMO best way is /w a pw manager that’s also backed up, available, and synced everywhere you need it, but that’s a hurdle for most users.
I think the “intended way for normal ppl” is to set multiple keys, each on their trusted devices, like backup physical keys, but that’s kind of a pain to have for every service, too.