WhatsApp for iOS Gains Support for Passkeys

I’ve been moving everything I can to passkeys (as a replacement for telephone number/authentication app-dependent 2FA). It’s good but there are still 2 issues to be aware of:

1. They’re not portable. You cannot sync passkeys between an iCloud Keychain, or a Google account, or 1Password, etc. The standard has no mechanism for it - keys are bound to the keychain software you use when you make them - although it’s apparently something they’re looking in to.

You’re not completely locked-in, though. Accounts can have multiple passkeys (e.g. an iCloud one, a Google one, 1Password one, etc), but it’s a hassle to set that up. Also, you can use one device to authenticate a login from another device (e.g. if you want to login to an account on an Android device, you can get a prompt and confirm it on your iPhone which has the passkey).

2. Currently, most places only offer passkeys in addition to passwords, which kind of defeats the point. AFAIK only Microsoft accounts let you disable password logins entirely.

I get that this is probably a transitional thing, but I wish more places offered it as an option now. GitHub says they’ll likely offer that within a year. Hopefully they do, and hopefully all the early adopters follow suit.

Sure would love to use Passkeys to log into an iPad app… if you get what I’m saying. (I’m saying I’d like an iPad app)

"passkeys on the iPhone and the iPad"?

iPad??

"passkeys on the iPhone and the iPad"?

iPad??

I updated this post so I'm not confusing anyone. Removed iPad mention.

I don't get it. They have to verify the phone number first. After that, how many times are you going to be logging in? Maybe on a new phone but that's going to be rare.

I thought it was going to replace Two-Step Verification, but that doesn’t appear to be the case. It looks to purely be an alternative to receiving an SMS to authenticate.

Considering SMS authentication can’t be disabled, and the passkey can’t be used as a second factor, it provides zero additional security.

The fact it doesn’t replace 2FA is baffling. This is one of the key concepts of passkeys. Plus, WhatsApp is the only app in existence that constantly pesters me to confirm that I “remember” my PIN. In 2024 we shouldn’t be encouraging users to remember pins/passwords. This was bad practice 15 years ago. No, I don’t remember my PIN because it’s saved in my password manager. I know 2FA is enabled and I know where the PIN is. Give me the option to stop pestering me about it.

In other words, let's collect more human metrics and use it for our questionable purpose. Next step would be a DNA authentication. The road to hell is paved with good intentions.

This is not how Passkeys work.