Wow. I forgot how nice passkeys are. Two new devices added to my website in five minutes.

I kind of cheated when logging in on my phone — using my password instead of plugging in my NitroKey. But I could do that!

Then I created a device-bound passkey on my phone. At least I think I did — Google's passkey UI is rather inconsistent, but my phone is on an older version of Android/GMS and it still has this weird bug that makes Google Password Manager not activate on navigator.credentials.create(). Well, I did want a device-bound passkey anyway (a roaming passkey is only little more secure than a password, since it can be extracted still) so I achieved my goal.

Then I decided my tablet also deserves a passkey. In a fit of whimsy I decided to start acpassley authentication flow right away — and quickly found an option to scan a QR code with my phone to leverage a passkey I already created. A tiny bit of fiddling with a QR code and a fingerprint scan later my tablet was in my site's dashboard.

And then I wanted to create a passkey on my tablet. Which immediately tried to shove me into a cloud passkey flow. I had to tap "other" — and then it assumed I'd want to plug in a USB key. Sort-of reasonable assumption, but no — I had to press "other" again. Finally, the OS gave up and asked me directly: "fine, where do you want your passkey then?" "This device" was the option I wanted.

Aside from this little argument with my tablet… I love living in the passwordless future.