From what you've written you've conflated separate things. Passkeys are not related to biometrics. Google wants your biometrics. Full stop. Google is a surveillance mega-corp. Full stop. Why are you still using Google? or Microsoft, which you clearly are uncomfortable with? That's rhetorical. Don't answer that. No one's interested in your pissing and moaning for why you can't leave this abusive relationship. Passkeys say nothing about biometrics. They're unrelated.

The surveillance corps implementation of passkeys will always be in their interest. Hardware passkeys are superior to device-locked passkeys that are stored in a TPM. Such schemes are nothing but vendor-lock ins. Oh, I don't want to buy a new phone; all my logins are stored on this phone. It's too much hassle. I can't leave Google's Android, it contains all my credentials securely. Hardware passkeys have no such friction. I can use them on any hardware.

The surveillance corps software-implementation is dodgy too. They've opted not to use some of the spec, which objectively weakens security. They'll claim it's for user-ease and whatever else they want to spout. The ease of silently using passkeys to access data they shouldn't, or to migrate the users passkeys to their new Google android phone--only Google android can migrate you to a new Google android device. You need Google android. Hit me harder daddy.

I mean, really, what are you trying to ask? You clearly don't trust these surveillance-companies. Passkeys are a good. Just like cryptography is just maths. There's no issue with the maths or passkeys. The issue lies in these mega-surveillance-corps that parasitically extract value from your computers--whether that's a desktop, laptop, server, smartphone or some other mobile-computer. You pay for the hardware, electricity, data-connection and you labour on them and these corps take everything from you. That's why Alphabet, Facebook and whatever other shit software-company has valuations in the billions or trillions.

Security is something they want. They want to be the sole holder of your information. They want a market monopoly. Strong cryptography helps them do that. Much like how a serial rapist and the police both like steel bars: one to keep their victims locked up in, the other to keep their victims locked up in too... huh... point is everyone likes strong cryptography.

As much as I trust them with passwords. Which is not too much trust. Implementations of passkeys also tend to be frustratingly bad.

I know very little about passkeys and would like to make use of this question to ask my own. How does backing the passkeys up work? Can I just keep a backup somewhere like with a password manager database? Can I use it anywhere, even if I want to use it one time on a friend's device, for example? If it's tied to a device, what if I lose it? What other practical advantages and disadvantages are there?

I know these are probably naive and simple questions and I could find the answers myself, but I remeber when I was trying to find similar things out about authenticators. I didn't want to use them until I learned how to make backups, use it on different devices, including those that are not mine etc. It took quite some time (of not that active looking, but still), most easily-found sources tend to not offer alternatives, especially when most people just use Google, Microsoft or Apple. I would very much appreciate some basic guidance from someone who has experience. I could probably ask AI, but honestly, I probably trust a kind internet stranger more.

Yes precisely because I don't rely on Microsoft or Google to handle that.

I have my own physical keys. I started like most with YubiKey, including a YubiKey Bio, then learned about NitroKey https://www.nitrokey.com/ thanks to NLNet https://nlnet.nl/project/Nitrokey-3/ so now I have passkey that I could verify https://certification.oshwa.org/list.html?q=nitrokey as they are certified and audited https://www.nitrokey.com/news/2015/nitrokey-storage-got-great-results-3rd-party-security-audit

That being said... IMHO your doubt raises an interesting question, why? Why do you NOT trust them? Do you imagine they have your data? Do you think an interactive explanation where one exchange data would help to understand why no trust is required or maybe better, where it matters?

Passkeys themself are a very good security measure, better than Password + 2FA via TOTP apps.

But having your passkey tied to a specific device on a specific OS is not good, you should try to avoid those and instead use a hardware key with passkey support or password manager.

I don't which is why I use my selfhosted vaultwarden instance to store mine. I refuse to add passkeys to any service if they don't properly invoke the standard passkey prompt in a way that's compatible with bitwarden, otherwise I love passkeys and use them everywhere possible as long as I have complete control over them.

I think the thought process from the site's perspective is simple: most of the attempts to hack into an account come from devices they have never seen, from places the user has never been. All a passkey does is tie your account to a "logical place," a device (whether a browser, a phone, or a specific hardware key).

The passkey itself doesn't tell the server anything it doesn't know already, it just confirms it, so there really isn't a whole lot of privacy implication beyond general concerns.

The big problem, and it's a more universal problem, comes when you are trying to log in from a device that has no passkey. Maybe you forgot your phone, or you bought a new computer, or something else. The "forgot password" flow, and the related "I am on a new device" flow are some of the weakest spots for computer security, because they presume that something happened that automatically lowers security credentials.

What I like about one-time codes like GAuth is that you can transfer the keys from device to device yourself. You are very rarely going to be in a position where you can't access the keys, and as a result it's fine to put you through extraordinary measures to reset your security. The issue with passkeys is that it's pretty common that you'll be using a new device, and as such you can't be forced to go through hoops every time you need to register a new one.

I think your problem is more to do with how shitty google is anymore more than the technology of passkeys. From a cryptography perspective passkeys are much more secure than simple username/password authentication as there’s no effective way to brute force or acquire through tools like key-loggers. Like another commenter said, start looking at self hosting your own services like Vaultwarden or the like and de-Google first and foremost. One other massive benefit with passkeys is the fact that they are cryptographically unique so even if an attacker acquires one, it’s only able to be used to access a single site/account.

don't mention it. back when this was new, i told everyone this was gonna happen and got downvoted and laughed at.

who is laughing now? well not me because it sucks anyway.

I have recently started using pass keys, but only because my keepass password manager supports them. Since the database is local to my device, I'm okay with it. I definitely wouldn't be using any kind of cloud thing for those though.

Because of how passkeys work, they are better by default. The site you are logging into doesn’t get any secrets to keep, the passkey identifies you and the control of it is on your side.

Where you are correct is that if the company has ‘I forgot my passkey please email me’ that makes the security no better than email, which is a shame.

The issue of storage of passkeys is also one to consider, like another comment said, pick something like Bitwarden to store them, not something vendor specific like Apple or Google.

I bought a nitrokey because of this trend. Though I haven’t started using it yet. Just gotta get my head around it.

In theory yes, but in practice no. Most companies have implemented them in the dumbest ways and have not used them to increase security. They can pretty much all be worked around with your phone number or email. It should also be a choice not trying to trick users into using it.

Amazon can fuck right off with their prompt to save on every single login. Microsoft will still try to save passkeys even when you turn it off in windowsso you can use a password manager. They are just creating a fucking mess.

Password + Passkey as 2fa would be nice.

Do you people trust companies with passkeys?

Not sure what you mean. Passkeys are vastly better than passwords. Who are you giving you're passkeys to, that you're worried about trusting them? Do you mean trusting they'll work, and you won't be locked out of your account?