1. Criticism of LLM-based Quickstart for Security Code
Users criticized passkeybot's guide for delegating auth implementation to LLMs, preferring manual docs. "I’m not going to delegate a security-critical task to an LLM" (loloquwowndueo). "It's absolutely hilarious that someone would think that this passes for API docs" (gear54rus). Author clarified it's for code translation with review: "The LLM is only for converting the JS based example code into your language X" (emadda).
2. Vendor Lock-in via Attestation and Client Blacklisting
Debate raged over passkeys enabling Big Tech lock-in by blacklisting exportable clients like Bitwarden/KeePassXC. "The passkey spec authors think websites should be able to ban clients which allow users to manage their own data" (coldpie). "If enough RPs ban clients that let users manage their own data... it is effectively required" (coldpie). Defenders noted spec intent: "The point of passkeys is that they're unexportable" (jeroenhd).
3. Usability and Recovery Issues Across Devices
Passkeys frustrate with multi-device sync, orphaned keys, and poor fallbacks. "Lose your phone and laptop... you are locked out" (spockz). "If I lose the device that has all my passkeys, I wouldn't be able to login into my emails either" (literallywho). "Every login was... fails -> try again... two unnecessary clicks" (godelski). Edge cases like single-passkey limits persist (IgorPartola).