Activate Passkeys and Let Your Users Log in without a Password

riku-df
Thu, 29 Feb 2024 00:41:29 +0000

I think the passkeys feature is a really big step forward. I appreciate that Auth0 is pushing the envelope here.

There is one critical issue that I’d like to get help on before integrating it into production: Recovering account access after losing a passkey
If a user with a passkey is locked out (by losing their device / yubikey etc), there is no way to securely recover the account access.

Not-so-secure Workaround:
The user could recover access by clicking “Can’t login to your account?” on the Universal Login screen, send a password reset email and set a new password. However, from that point the user will be stuck in password login state. The passkey security benefit is gone.

Feature request:
“Send a passkey enrollment invitation” feature

The above problem will be solved if a new passkey enrollment invitation could be sent to the user’s email, instead of a password reset email.

User-initiated: “Can’t login to your account?” on the Universal Login screen shows an option for passkey

Admin-initiated: It’d be very straightforward if such a button is under: Dashboard > User Management > Users > user_instance > Passkeys
I’m not sure if adding a new passkey via email invitation is technically feasible, but UX-wise that would be very straightforward.

I’d love to hear the Auth0 team’s view on the lost passkey scenario.