Activate Passkeys and Let Your Users Log in without a Password

riku-df
Fri, 01 Mar 2024 19:37:44 +0000

Thanks @carlastabile for your insights! I really appreciate this discussion.

carlastabile:

If a user using a passkey is locked out, you can go through the password recovery flow as you mentioned. However the passkey benefit won’t be gone, once you have set a password you can create a new passkey for your account in another device (I actually tested this with my phone and my mac)

The password recovery flow + creating a new passkey certainly solves many parts of the problem, but there are a few issues left with the current flow.

1. After the recovery, the user is left with a (potentially weak) password, which opens up a new attack surface if the user was originally passkey-only.

2. (Less importantly) this passkey creation flow requires the Progressive Enrollment turned on, which may or may not work with some app’s needs.

Both of these points will be resolved if there is an option in the recovery flow to create a new passkey instead of a password.

carlastabile:

This is a great point! our product team is actually considering it for a future iteration.

I’m really glad that the product team is considering this feature!
We have been extensively testing the passkeys behavior, and I believe having this piece will make Auth0’s passkey solution very well-rounded.

Is there any ballpark timeline on the feature? We’d really love to see that coming