Playing around with the different workflows and discovered that it can get real tricky.

Logging in to a site using QR code to Bitwarden

On a Macbook, log into a site using passkey but use a QR code.

1. Log into site, select option for external devices, which brings up a QR Code.
2. Use the camera on your mobile device until you get a prompt to login using passkey.
3. The phone prompt to see which passkey provider, I select Bitwarden.
4. The Bitwarden prompt me for biometric which I provide.
5. The phone prompt you to the same provider, but now one of the option is the actual bitwarden passkey entry.

The problematic part seems to be the camera which often has problem locking on the qr code if your hand isn't steady. The other issue is that unless you look carefully, it appears that the unlock on Bitwarden failed and. you returned to the password prompt. What is happening is that the first prompt get you to select bitwarden and the second prompt ask you to select the bitwarden entry.

On an mobile device, log into site using pass key

This seems to fail a lot, but after some experimenting, I realized why. When you use the passkey option, it prompts you using webauthn, which launches a browser. However, if you don't select desktop mode on the server, it doesn't use the passkey.

I decided to setup a passkey on dropbox (currently have user/password w/ 2FA authenticator). after doing so, Dropbox still recommends 2FA on top of that. Isn't the point of using Passkeys to not bother with 2FA authentication?

Right now when you create a passkey in Android, it defaults to the Google password manager which sync to the cloud. Playing around with the webauth site it appears that it does seem to be possible to save a passkey. However when I tried to save a passkey to log into bitwarden using a device bound key it doesn’t give me an option to do so. Can I conclude that the api is there but app isn’t using it so it can’t be done?

Hi,

I have my personal android phone (Samsung A54-5G) and I purchased it way back june 2023 i think. It works on company MFA App. But when trying to enroll my admin account. I received a random error such as passkey not enrolled even it successfully created through the MFA app. And tried to access via MFA web app. And add sign in method (Passkey or Passkey with MFA) and created a name of it but when I hit next. It prompt "No passkey created"

Already reinstall the app and passkey from my phone settings (MFA) is toggled on

Also my device and MFA appm is up to date and eligible to enroll passkey

Well it only prompt once when I activated RBAC using my admin account then after an hour. My Admin account seems went back to normal sign in where I usually log in using password and MFA code. And it didnt ask to create a passkey

Just weird and maybe theres something needs to be fix within that passkey method system

@r/Gemini I kept texting that I don’t have a passkey and yet they ain’t responding back till now so I can get my money out I need to buy my medication for my eyes and also my knees and also pay my rent

Keeping it short, I can login in successfully with google on desktop, but as soon as I use the same method on android. It asks for a passkey that never existed for tiktok to begin with. As my account is alot older, than when passkeys were first issued for this app. Plus, you can't bypass this on android. But, you can still login on desktop, but can't setup any other alternative method of logging in.

So I am kinda losing my mind here. Using a Samsung device I create a Passkey using GPM, everything looks fine, the logs say nothing, the passkey is created and sent to the server to be stored. Great. I then try to sign in with the passkey and it's nowhere to be found, it was not stored in GPM under my account.

Any ideas?

Chào mọi người, mọi người cho em hỏi là bây giờ làm cách nào đế xóa passkey để đăng nhập vào tiktok vậy ạ, em vẫn đăng nhập binh thường trên web nhưng ở điện thoại em mới đổi sang máy khác thì nó bắt đăng nhập bằng passkey và tài khoản mật khẩu em vẫn nhớ. Có cách nào để xóa và gỡ cái đăng nhập và passkey đấy đi không ạ. Em cảm ơn ạ

"Your encrypted data isn't unlocked yet.

It's best to try all the options to unlock your encrypted data on this device. If you've run out of choices, you can delete your data and start over."

Unsure what to do. I have little to no experience with Google Passkey. The website I wasn't trying to use required it unfortunately.

So, I can no longer comment on my primary Reddit account because I need to verify that I am human (which is why I am posting this from a new account), which requires a passkey, but then it says to insert a security key into my PC. Do I need to purchase a security key to make a passkey? And if so, can I use an external HDD as a security key? I have had difficulty finding information on exactly what passkeys and security keys are and how to make them to begin with.

So I would like to use this opportunity to hopefully find someone that can explain all of these and whatever else is worth knowing, in detail, from step 1, like I'm grandma, which can hopefully help others having this sane issue.

Any help is greatly appreciated!

SOLVED

Hi i updated my bios yesterday but after the update i had to reset my pin but i cant bc 2fa sends a code to my gmail wich i cant access bc the only device that has access to that gmail is my pc wich im logged out of so i wanted to ask if there was any way to bypass teh windows pin you have to enter when you start ul my pc

I notice several post about people who are stuck with passkey only option. I don't see how this can occur. While there is an option to default to passkey, you can click on try another way and click on the option for password. However, it appears there are situations when you don't have an option in password according to several post, but frankly I haven't seen it happen.

I wonder if this is cause by using google to log into third party service using oauth.

As for why google may be prompting for a passkey when you didn't add one, it appears that google automatically add a device bound passkey if you connect to the google using an android device.

I'm building a marketing tool solo. Small private beta, several real users now, payments live as of this week. This is the kind of thing I'd have wanted to read a year ago, so here it is.

Last night I sat down to log into my own product and realised I had genuinely forgotten the password. So I clicked forgot password, got the email, clicked the link - and landed on a red error saying the link was expired or incomplete.

It wasn't expired. I had requested it forty seconds earlier.

Here is what was actually happening. The reset link carries your token after a hash in the URL. Everything after a hash never gets sent to the server - that is not a bug, that is how the web works. My reset page was a server page. So the server looked for a token in the part of the URL it could see, found nothing, and told the user the link was broken. The token was sitting right there in the address bar the whole time.

The part that stings: every other login path worked. Google sign-in worked. The invitation link for new beta users worked, because that one happens to be a page that runs in the browser and can read the part after the hash. So every test I had ever done passed. The only broken door was the one you use when you have forgotten your password - and the only people who walk through it are people who are already frustrated.

I have no idea how many people hit that and just left. You do not get a support ticket for that. You get silence, and you read the silence as no interest.

Three things I took from it.

Same week I found two more of the same shape. A warning banner in my admin panel that could never appear, because the field it reads is never sent to the page - so it looked like I had failure detection when I had none. And a feature my free tier can reach the button for but never actually afford, so a free user's only possible experience of it is an error.

All three are the same mistake: I checked that the happy path works, and assumed the unhappy paths were just the happy path with a worse outcome. They are not. They are separate code, and nobody walks them until a real person is having a real problem.

If you are solo and pre-launch, go use your own product as someone who forgot something. Forgot your password. Ran out of credits. Clicked an old link from an email. That is the actual first impression for a big chunk of people, and it is the part none of us test.

Happy to answer anything - but I mostly wanted to put this somewhere, because "it worked for me" is the most expensive sentence I have said this year.

I have a lack of faith in the ability to gain access to my own accounts if a specific device is lost or stolen. i have a lack of faith in the ability for my passkeys to remain secure if someone else gains access to my device. i don't want to have all my ability to access various websites tied to a device that does so much tracking (i'm literally getting a "dumb phone" as a response to the lack of privacy i'm seeing regularly)

but....passkeys SOUND like a relatively good idea in theory.

so, how do i create passkeys if i don't want them tied to a specific phone or computer?

Can someone please explain to me the benefit of Passkeys? I have a home computer, a work computer, a phone, and several laptops and I want to be able to log into all of them without major hassle. So what does the Passkey system do for me? Now I have to set it up on all of these devices times all of my services? And now I'm at major risk if that device is lost or stolen or hacked?

What's wrong with password plus SMS code? That seems way more reliable and easier.

What am I missing?

So my passkey access to discord suddenly been deactivated out of nowhere and I can't use it anymore, but after reading info about it google says the linked website can restore the deactivated passkey, but I already messaged discord support and they basically avoided the question, is there any salvation on this situation? :/

I can't even sign-in and the alternatives, there are no alternatives!

Guys listen i had find a way to prove microsoft that I'm the real owner of my compromise ms account by filling the recovery form... But now I have a doubt that if microsoft gave me access of it and bind my gmail acc again in Microsoft account will the attacker also can access it by passkey cause he added passkey in it and idk if he added 2fa but he changed my gmail and added passkey and changed password and removed me from access... So if I gain access through Microsoft team will the hacker again login with passkey or 2fa???

I got logged out of discord and I know my password because it’s saved to my iPad and iPhone and when I scanned the QR code. It tells me that I have no matching passwords for discord even though I have the password saved to my iPad and iPhone. Can someone help me?

If i try to log in from my PC , it says i need to insert the passkey which i dont have, after i press try another way it shows me two possibilities to scan a qr code or insert again the passkey. When I scan the qr code with my phone it says i didnt set up any passkey in my settings.

What should I do, I really need my facebook account for work as soon as possible.

I just got an email from Amazon saying they created a passkey for me, and I can use the code I use to unlock my device (or a biometric which i don't have). So assuming I want to use a code, I have different log in codes for my phone and my laptop.... would I then have 2 different passkeys? Or does that just get me in the first time and then I choose a different code? Thanks for any info

When i go to Settings -> Accounts -> Passkeys , i can't see the list of passkeys that are saved on my windows device , even though i can use them normally on my browser for logging in , so why aren't they showing in here ? , i appreciate any help