alt Hacker News> How can I do that, if Passkeys are the only option to log in?
It is not feasible to remove password login or some other recovery login method.
> If I can just use a password to log into a website without Passkeys, then Passkey is useless and doesn't add any security benefit.
It isn’t useless, point is you don’t get to type in your password on a device that has passkey generated already, or get phished on a fake web address for example.
> I sell my old (and no longer updated) phone or PC and don't want someone to get access to my account by getting access to the secret keys.
Passkeys are meant to be protected by either PIN or biometrics, however they are also meant to be revocable on the web, at least they are for services i’ve been using with passkeys.
> It is not feasible to remove password login or some other recovery login method.
Then passkeys doesn't provide any real value if you have other less secure recovery option.
Let's say I have a bank account, going to the branch and doing an in person ID check is a valid recovery option, but nobody would want to do that just to log in from a new device.
> It isn’t useless, point is you don’t get to type in your password on a device that has passkey generated already, or get phished on a fake web address for example.
That's solved by letting the browser to remember the passwords.
> Passkeys are meant to be protected by either PIN or biometrics, however they are also meant to be revocable on the web, at least they are for services i’ve been using with passkeys.
PIN and biometrics doesn't have any inherent security. They rely on some hardware (or software separated from main system) feature, and even those can have vulnerabilities.